Subject: RE: IETF multihoming powder: just add IPv6 and stir

From: "Tony Li" <[email-masked]>
Date: Tue, 13 May 2003 16:35:49 -0700

A filter that is looking at a locator is probably a bug.

Tony

|    On dinsdag, mei 13, 2003, at 23:37 Europe/Amsterdam, Masataka Ohta 
|    wrote:
|    
|    > OTOH, rewriting of source locator is not so useful, though I have
|    > no reason to forbid it.
|    
|    Unless the source address is already a valid address 
|    assigned by the 
|    ISP you're forwarding the packet to (which can't by 
|    definition always 
|    be the case in a locator/identifier scheme), you need to 
|    rewrite it in 
|    order to get through ingress filtering and to be able to 
|    receive ICMP 
|    messages. Remember that path MTU discovery is pretty much 
|    mandatory in 
|    IPv6 so you need those ICMPs. Ingress filtering is 
|    important to keep 
|    denial of service attacks in check to at least some degree.
|    
|    
|

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 14 May 2003 09:27:12 +0200

> A filter that is looking at a locator is probably a bug.

In that case there will be many bugs. Similar issues arise
for QOS classifiers (unless we get the flow label into general
use).

   Brian

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 14 May 2003 10:17:35 +0200

> A filter that is looking at a locator is probably a bug.

The need to filter is an operational reality.

So how do we filter on an identifier? Put them into the routing tables 
and then uRPF? And if the identifiers are in the routing tables, who 
needs a locator?

To me, identifiers belong at layer 4 and up. Locators belong at layer 
3. So any filtering on layer 3 must be on locators.