IETF Logo Mail Archive

Re: [OPSEC] Prospective issue with IPsec ESP-NULL & IGP packets

R Atkinson <ran.atkinson@gmail.com> Wed, 17 December 2008 16:21 UTC

Return-Path: <opsec-bounces@ietf.org>
X-Original-To: opsec-archive@optimus.ietf.org
Delivered-To: ietfarch-opsec-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 498C03A683D; Wed, 17 Dec 2008 08:21:12 -0800 (PST)
X-Original-To: opsec@core3.amsl.com
Delivered-To: opsec@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 021243A683D for <opsec@core3.amsl.com>; Wed, 17 Dec 2008 08:21:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I-9kBH1uM3r8 for <opsec@core3.amsl.com>; Wed, 17 Dec 2008 08:21:10 -0800 (PST)
Received: from mail-qy0-f11.google.com (mail-qy0-f11.google.com [209.85.221.11]) by core3.amsl.com (Postfix) with ESMTP id 383C03A67FD for <opsec@ietf.org>; Wed, 17 Dec 2008 08:21:10 -0800 (PST)
Received: by qyk4 with SMTP id 4so3808014qyk.13 for <opsec@ietf.org>; Wed, 17 Dec 2008 08:21:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=e5fdxxh/24ZgreAit53SAYVxYahZNBa/UrzCNGHJxVg=; b=hpOT6kbI5p64TvzoYYOzt4FEXQ5ahjUFwGTEj7224146XJrn7QqBglLiu5uom7NevM LTBzeqT6ek7KE7V8RDOA5leMuUfD00xyLuNTFpfWqnKbWmWVwz0nHT45CK70Fqv6bhsj rTujAMoFBKGPSOG7NHbKDMunJR0BsLHqfYFiY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=Va+YPOfP7nMuwE5Xn/LjVAH/t7+vaRoJ3SpL8z/ekpLiNYxgFz8/tZtpqURjPGQB2C Cw5UsAdHcnmL2bWmi+H9B1eSG1ntcIydArHiWRyX/m6SbJwhGx3a3owzd2UuEFYTK7wT kHz/ILzicHJGjPX2wla35L7zkJp05Ey54kNPM=
Received: by 10.215.100.9 with SMTP id c9mr1010618qam.356.1229530862149; Wed, 17 Dec 2008 08:21:02 -0800 (PST)
Received: from ?10.10.1.61? (67.111.52.130.ptr.us.xo.net [67.111.52.130]) by mx.google.com with ESMTPS id 7sm10056251qwf.47.2008.12.17.08.21.01 (version=TLSv1/SSLv3 cipher=RC4-MD5); Wed, 17 Dec 2008 08:21:01 -0800 (PST)
Message-Id: <A1EB330A-67A7-4D9D-B7DF-630BE4EBD1C1@gmail.com>
From: R Atkinson <ran.atkinson@gmail.com>
To: opsec@ietf.org
In-Reply-To: <77ead0ec0812170814j3c34ea6aof7df345adfeee56f@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v930.3)
Date: Wed, 17 Dec 2008 11:21:00 -0500
References: <14198D76-AA32-4E02-9425-0700ED57B07B@gmail.com> <77ead0ec0812161759g4900bd98h6ad6c07bb0d81fe3@mail.gmail.com> <89F12E27-304C-41AD-BC27-556BD9FA7040@gmail.com> <77ead0ec0812161851q204bd1e7nd9fc57538d161794@mail.gmail.com> <596A619D-6D7B-421E-A43C-47AD1762093F@gmail.com> <77ead0ec0812170814j3c34ea6aof7df345adfeee56f@mail.gmail.com>
X-Mailer: Apple Mail (2.930.3)
Subject: Re: [OPSEC] Prospective issue with IPsec ESP-NULL & IGP packets
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/opsec>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: opsec-bounces@ietf.org
Errors-To: opsec-bounces@ietf.org

On  17 Dec 2008, at 11:14, Vishwas Manral wrote:
> Ran, the point we were talking is about the packet actually not being
> able to be filtered by the edge node/ device because the packet is
> encapsulated in the ESP header. Is there something amiss here - when
> you say such a packet can be filtered?

Please go re-read my note to OPsec from yesterday
for the full analysis.

Cheers,

Ran

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec

v2.23.0 | Report a Bug | By Email