Subject: RE: CELP (was RE:)

From: "Ayyasamy, Senthilkumar \(UMKC-Student\)" <[email-masked]>
Date: Mon, 16 Feb 2004 05:14:36 -0600

>> I still operate under the possibly-false view of an Internet that is
>> mostly reachable. Perhaps partitioning is already too much of a
>> problem,
>> for us to ignore this type of fine-grained mechanism?
>
> This is very much the world of *today*. 
 
If by "partition" dave meant "topology parition", it is very minimal.
The so-called dark or murky address space are well studied by arbor
network group (labovitz et all.) Dark address space is reachable
through one provider, but not accessible through some other providers.
It is due to broad band customers. The murky address space is due to
misconfiguration or use of 1918 address space or reserved ones. I did
some measurements last year and found it to be very minimal(which 
you can find in caida ISMA 02 workshop.) 
 
anyway, i am still puzzled by the whole partition argument. In 9/11
case, operators did reroute traffic although many outages were observed
in the NY area ( verio's junction got busted?) But, overall reachability 
was fine. OTOH, new sites had flash crowd problem. Hence, it is very 
essential for enterprise services to multihome and load balance/fail 
over across geographically distributed data centers. 
 
content distribution networks presents a legitimate partition case 
where certain prefix can be reached by a subset of nodes and not by 
others. 
 
or, you mean black holes, port blocking etc contribute to partitions?
 
As a side note, how is HIP going to allow port blocking? Will it avoid
worm attacks by its puzzle mechanism. I don't think it is possible (but
it can reduce its spawning speed.)

---

From: Pekka Nikander <[email-masked]>
Date: Mon, 16 Feb 2004 13:28:11 +0200

Senthil,

> it can reduce its spawning speed.)

You can build a HIP firewall that uses HIs as the level of
granularity.  Beyond that, on the port level, you have to
do locally at the host.  But that's the right way to do it
anyway, IMHO.  The current worms and other internet fauna
are a problem that SHOULD NOT be handled at the network level
but by the operating system.

Do you expect to run HIP in your Win98 box?

--Pekka N.

---

From: Tim Shepard <[email-masked]>
Date: Mon, 16 Feb 2004 13:01:47 -0500

> it can reduce its spawning speed.)

This is a very interesting question, and I expect there will never be a good
answer for this.  (The puzzle mechanism does not fundamentally help with
worm attacks, though it may help to defend against a DOS attack against
a specific server's CPU resources launched by a worm.)

How does IPSEC allow port blocking?  As far as I know, it does not.  After
the IKE exchange establishes a SA, ESP hides the TCP port numbers.
HIP has no better answer to this question than IPSEC, or any other protocol
that provides for encryption between strangers.

"Having an encrypted conversation with a stranger may be like meeting that
person in a dark alley.  Whatever happens, there are no witnesses."  (quote
is from Blumenthal and Clark, _Rethinking the Design of the Internet: The
End-to-End Arguments vs. the Brave New World, August 2001)

			-Tim Shepard
			 [email-masked]

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Fri, 20 Feb 2004 17:42:18 +0100

> If by "partition" dave meant "topology parition", it is very minimal.

[snip]

> or, you mean black holes, port blocking etc contribute to partitions?

Well, I was sort of referring to both or the phenomenon of partioning 
in general. Either by design or policy. But Marcelo also addressed 
this.

- - kurtis -

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 25 Feb 2004 09:20:32 +0100

> person in a dark alley.  Whatever happens, there are no witnesses."

Why would anyone want to filter based on port numbers? It provides no 
real security, just headaches. On the other hand, I can understand that 
people are unconfortable having internal hosts communicate with 
external ones without being able to see what's going on. A way to solve 
this would be to include firewalls in the authentication and 
authorization negotiations.

---

From: Tim Shepard <[email-masked]>
Date: Wed, 25 Feb 2004 08:48:14 -0500

> authorization negotiations.

Well, I agree with you.  But apparently there are some who have
raised objections to end-to-end encryption that does not allow a
meddling middlebox to discriminate based on port numbers.  I was
just pointing out that any such objection to HIP would be no
different than an objection to IPSEC in general.

			-Tim Shepard
			 [email-masked]