Re: [bmwg] draft-green-bmwg-seceff-bench-meth-00

[Kenneth Green <[e-mail]>]

RFC2647 provides this useful definition:

3.19 Illegal traffic
  Definition:
    Packets specified for rejection in the rule set of the DUT/SUT.
  Discussion:
    A buggy or misconfigured firewall might forward packets even though
    its rule set specifies that these packets be dropped. Illegal   traffic differs
    from rejected traffic in that it describes all  traffic specified for rejection
    by the rule set, while rejected  traffic specifies only those packets actually
    dropped by the DUT/SUT.

We have described "evil" traffic as being in one of two classes, either malicious traffic intended to invade/damage/exploit the target or banned/disallowed traffic being that which is related to attempts to access disallowed sites or services, or to export proprietary information that is not allowed outside of the protected network.

It is useful in the prose to have language that naturally evokes the inherent contrast between traffic that should pass through and traffic that should be blocked. Hence the natural opposites of "good" and "evil" seemed appropriate.

However, the definition of "Illegal" given in 2647 does seem to encompass all packets that would be considered "evil" so long as the concept of "specified for rejection in the rule set of the DUT" is considered sufficiently broad to apply to whatever configuration features might be present in an NGF, IPS or UTM system which might go beyond ACLs and the like.

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia


-----Original Message-----
From: Dennis Cox [mailto:[e-mail]] 
Sent: Sunday, 30 October 2011 5:44 AM
To: Al Morton; Kenneth Green; [e-mail]
Subject: RE: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Al,

 Yes "evil" is used in a previous RFC, however that is a April Fools Day RFC. While it's a great RFC and we have actually implemented it in our product, all in good fun of course, I don't know if its the best term when talking about traffic that may only be slightly evil :)

For your reference
http://www.breakingpointsystems.com/community/blog/rfc3514-setting-the-evil-bit/

Dennis

________________________________________
From: Al Morton [[e-mail]]
Sent: Saturday, October 29, 2011 9:02 AM
To: Dennis Cox; Kenneth Green; [e-mail]
Subject: Re: [bmwg] draft-green-bmwg-seceff-bench-meth-00

At 08:49 AM 10/29/2011, Dennis Cox wrote:
>...Also, evil may not be the best word, perhaps malicious might be a 
>bit used instead.

Both terms are used in http://tools.ietf.org/html/rfc3514
Al
(as participant)