Re: [OPSEC] Fwd: ID Tracker State Update Notice: <draft-ietf-opsec-protect-control-plane-06.txt>

On 1/4/11 3:33 PM, George Jones wrote:
> 
> 
> On Tue, Jan 4, 2011 at 10:22 AM, John Kristoff <jtk@cymru.com
> <mailto:jtk@cymru.com>> wrote:
> 
>     On Thu, 23 Dec 2010 15:22:22 -0500
>     Warren Kumari <warren@kumari.net <mailto:warren@kumari.net>> wrote:
> 
>     > So, our active queue is beginning to look very sparse... I have a
>     > draft that I started writing a while ago that Chris Morrow and Danny
>     > McPherson have agreed to fix / update (poke...), does anyone have
>     > anything else that they are working on?
> 
>     I had started a port filtering draft.  A second revision has been
>     started, but we haven't spent much time on it lately.  I can endeavor
>     to get this work going again this week.
> 
>      <http://tools.ietf.org/html/draft-kristoff-opsec-port-filtering-00>
> 
> 
> 
> Looks like you were tackling the "what to filter and why" + gotchas.  
> Noble.  Useful.
> But if the device just can't do it, not sufficient.

So another thought has to do with how port filtering is done, and
essentially this is a control plane policy exercise. If filtering a port
in an acl is less expensive than passing a packet up to the control
plane (where it ends up being discarded because there's no listening
service) do you win?

> Again, what I had in mind was as series of docs that provide testable
> security features,
> possibly paired with a test methodology.
> 
> Before diving into any serious work, though, it would be worth asking
> the question,
> would anybody care/be positively impacted if the docs were finished.  
> Does anybody
> do this sort of testing?  Would they?   Would a list in the form of RFCs
> help ?
> 
> ----George Jones
> 
> 
> 
> _______________________________________________
> OPSEC mailing list
> OPSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/opsec