Re: [Int-area] Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with COMMENT)

[Eric Rescorla <[e-mail]>]

On Wed, Dec 13, 2017 at 1:43 PM, Ron Bonica <[e-mail]> wrote:

> Hi Eric,
>
> Thanks for the review. Responses inline......
>
>                         Ron
>
>
> > -----Original Message-----
> > From: Eric Rescorla [mailto:[e-mail]]
> > Sent: Tuesday, December 12, 2017 7:21 PM
> > To: The IESG <[e-mail]>
> > Cc: [e-mail]; Luigi Iannone <[e-mail]>;
> > [e-mail]; [e-mail]; [e-mail]
> > Subject: Eric Rescorla's No Objection on draft-ietf-intarea-probe-09:
> (with
> > COMMENT)
> >
> > Eric Rescorla has entered the following ballot position for
> > draft-ietf-intarea-probe-09: No Objection
> [RB ]
> [snip]
> >
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> > I share Yaron Sheffer's concern about the incoming ACL. Do you really
> mean
> > to list all the probe-capable nodes?
> [RB ]
> The ACL doesn't list all probe-capable nodes. It is configure on a
> probe-capable node and it enumerates the prefixes from which it will accept
> an ICMP Extended Echo Request.
>
> For example, assume that an ISP deploys PROBE capable software on its
> routers. By default, these routers won't accept an ICMP Extended Echo
> Request from anybody. The ISP will probably want to enable PROBE, but only
> if the ICMP Extended Echo Request comes from the NOC or from a few other
> trusted prefixes. So, the ISP will put those prefixes into the ACL.
>
> I am thinking that the number of prefixes will typically be very small
> (e.g., the NOC).
>

Thanks.


>    or IPv6 Neighbor Cache [RFC4861].  Otherwise, it reports that the
> >    interface does not exist.
> > Hmm... So you don't try to ping it yourself? That's interesting.
> [RB ]
> The proxy node could ping the probed interface, but that would require the
> router to main state. We don't want to go there for scaling and security
> reasons.
>
> Rather than doing that, PROBE looks for an entry in the ARP Table and
> Neighbor Cache. Prior version 08 of this draft, the proxy node assumed that
> the probed interface does not exist if it is not in the ARP Table and
> Neighbor Cache. IETF LC reviewers pointed out that this assumption is not
> safe. So now, the proxy node reports that the table entry does not exist.
> In no longer reports that the interface does not exist.
>

OK.


>       the probed node.  The L-bit is clear if the probed interface is
> >       directly connected to the probed node.
> > Maybe I'm missing something here, but how does the probing node know?
> > I.e., can it address by IP address and set L=0?
> [RB ]
> This is a parameter to the Probe application. See the appendix.
>

I did note that. It seems kind of limited, but it's your choice, obviously
-Ekr