Re: Pseudorandom Flow Labels

[Fernando Gont <[e-mail]>]

Shane,

On 05/04/2011 06:23 p.m., Shane Amante wrote:
> As I pointed out below, we already have pseudorandom distribution of
> flows today, given that most host implementations use RFC 6056 and
> (IPv4) load-balancing routers/switches use the 5-tuple as input-keys
> ... included in those input-keys is a "pseudorandom ephemeral port".

Note that e.g. Linux implements the hash-based algorithm in RFC 6056,
rather than the random()-based algorithms. -- FWIW, see my response to
Thomas wrt the terminology that we are using.



>> I think we can assume that if we use both the src/dst, we will get
>> a good degree of distribution in the values. Adding the Flow Label
>> gives more. I am just not convinced that to get good distribution
>> we need to *require* (or strongly suggest) psuedo randomness in the
>> Flow Lable. We know that by simply incrementing the Flow Label by 1
>> for each flow, we get sufficient distribution. That is *way* easier
>> to implement than something else.
> 
> Unfortunately, if: a)  All hosts at a site start off selecting "1"
> for their flow-labels; 

We should have already learned the lesson that this is a really bad choice.


> or, b)  Don't cycle through the full-range of
> flow-label values; 

This would be an implementation bug.


> or, c)  a [large] set of hosts experience
> synchronization of flow-label values; 

Given that the FL field is large enough, and that the offset itself is
random, I deem this as *very* unlikely. Also, for synchronization to
occur, all those hosts would need to have the same frequency of
flows/time. -- and since the src IP would be also used for ECMP/LAG,
then I don't think that this would be a big deal, either.


> or, d)  Reset back to
> flow-label "1" after some short time period ... 

This would be a really dumb thing to do, btw.

Note: I'm not arguing that a random()-based algorithm would be a bad
idea. I'm arguing that such an algorithm is not necessarily the only
possible one, and not necessarily the best possible option, either.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1