Re: [OPSEC] http://www.ietf.org/internet-drafts/draft-kumari-blackhole-urpf-00.txt

First let me say this is valuable work and it is well done.
It should be accepted as a WG document.

It suffers from inconsistent use of the following teams which appear to
mean the same thing I recommend Remote Triggered Black Hole filtering
but which ever term is used should be used consistently.

Triggered black-hole routing, Remote triggered black hole routing and
RTBH filtering.

If "As a matter of policy, operators SHOULD NOT accept source-based RTBH
announcements from their peers or customers" then why bother asking for
a registered community from IANA?

The cisco and juniper examples only covers destination based RTBH
filtering no urpf statements are included and therefore source based
RTBH is not provided by the example configs. That may have been the
intention of the authors but it wasn't what I expected.

Does this imply that strict mode urpf can't be used for source based
RTBH?

"In loose mode some vendors also verify that the destination route
   does not point to a discard interface."
If so going from strict mode to loose to support source based RTBH has
some serious security implications.

Security through obscurity WORKS against some worms and ssh attacks:)
Donald.Smith@qwest.com giac 

> -----Original Message-----
> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] 
> On Behalf Of Joel Jaeggli
> Sent: Thursday, September 11, 2008 11:58 AM
> To: opsec wg mailing list
> Subject: 
> [OPSEC]http://www.ietf.org/internet-drafts/draft-kumari-blackh
> ole-urpf-00.txt
> 
> Was one of the upcoming documents mentioned in the dublin meeting.
> 
> this document expands on the method in RFC3882 and I think much more
> accurately represents current operational practice.
> 
> some review on it's current form and consensus as to whether we should
> accept it as a working group document would be appreciated.
> 
> Thanks
> joelja
> _______________________________________________
> OPSEC mailing list
> OPSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/opsec
> 

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec