Re: [mpls] Spencer Dawkins' No Objection on draft-ietf-mpls-self-ping-05: (with COMMENT)

[Ronald Bonica <[e-mail]>]

Hi Spence,

I guess you deserve a better answer ;-)

In LSP Self-ping, the ingress LSR:


-          Formats a packet addressed to itself

-          Sends the packet through the LSP under test

-          Waits for the packet to return to it

The ingress LSR is both the producer and consumer of the packet.

In an earlier version of the draft, the ingress LSR selected a UDP port from the dynamic range (49152- 65535). Implementations could pick a single port and use it all the time or pick a port for each LSP Self-ping session. However, if an implementation did this, it would be difficult to identify and filter LSP Self-ping packets at the domain edge. So, the WG decided to put all LSP Self-ping traffic on UDP port 8503, so it could be easily identified and filtered.

                                                 Ron

From: Spencer Dawkins at IETF [mailto:[e-mail]]
Sent: Thursday, October 15, 2015 5:44 PM
To: Ronald Bonica <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: Re: [mpls] Spencer Dawkins' No Objection on draft-ietf-mpls-self-ping-05: (with COMMENT)

Hi, Ron,

On Thu, Oct 15, 2015 at 4:14 PM, Ronald Bonica <[e-mail]<mailto:[e-mail]>> wrote:
Hi Spencer,

Thanks for your thoughtful review.

In the Security Considerations section, you will find the following text:

"LSP Self-ping messages are easily forged.  Therefore, an attacker can send the ingress LSR a forged LSP Self-ping message, causing the ingress LSR to terminate the LSP Self-ping session prematurely.  In order to mitigate these threats, implementations SHOULD NOT assign Session-ID's in a predictable manner. Furthermore, operators SHOULD filter LSP Self-ping packets at network ingress points."

The assignment of all LSP Self-ping traffic to UDP Port 8503 facilitates the above-mentioned filtering.

You were answering a different question than the one I was asking (I was thinking of collisions on port numbers), but you provided an answer that makes my question go away.

Good job! Were you once an AD?

;-)

Spencer

                                                                                             Ron


------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> I was looking at
>
>    o  The UDP Destination Port MUST be lsp-self-ping (8503) [IANA.PORTS]
>
> and wondering why this is a MUST. Is the answer that this mechanism works
> within an administrative domain, so you can just tell the other end what the
> port number needs to be?
>
>
>
>
> ------------------------------
>