Re: [mpls] Spencer Dawkins' No Objection on draft-ietf-mpls-self-ping-05: (with COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

Hi, Ron,

On Thu, Oct 15, 2015 at 4:14 PM, Ronald Bonica <[e-mail]> wrote:

> Hi Spencer,
>
> Thanks for your thoughtful review.
>
> In the Security Considerations section, you will find the following text:
>
> "LSP Self-ping messages are easily forged.  Therefore, an attacker can
> send the ingress LSR a forged LSP Self-ping message, causing the ingress
> LSR to terminate the LSP Self-ping session prematurely.  In order to
> mitigate these threats, implementations SHOULD NOT assign Session-ID's in a
> predictable manner. Furthermore, operators SHOULD filter LSP Self-ping
> packets at network ingress points."
>
> The assignment of all LSP Self-ping traffic to UDP Port 8503 facilitates
> the above-mentioned filtering.
>

You were answering a different question than the one I was asking (I was
thinking of collisions on port numbers), but you provided an answer that
makes my question go away.

Good job! Were you once an AD?

;-)

Spencer


>
>                    Ron
>
>
> ------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> > I was looking at
> >
> >    o  The UDP Destination Port MUST be lsp-self-ping (8503) [IANA.PORTS]
> >
> > and wondering why this is a MUST. Is the answer that this mechanism works
> > within an administrative domain, so you can just tell the other end what
> the
> > port number needs to be?
> >
> >
> >
> >
> > ------------------------------
> >
>
>