Re: Greasing more of QUIC

[<[e-mail]>]

I'm talking about middle observers which we do use every day to maintain real-life networks. We deploy them 
intentionally, after being notified of issues by other means, and make human decisions on their observations. No "short 
loop" with automated, too fast reactions.

My point is that this use case is an important one to support. The theoretical possibility of misuse of its enablers has 
no bearing on the cost of *not* supporting it. Which is huge.

-Alex

On 13/12/2017 18:15, Mikkel Fahnøe Jørgensen wrote:
> A passive middle box observer can do harm if the deployment is large scale and mission critical. If it mis-interprets
> new QUIC version it may report network damage which may cause operators to explicitly block new QUIC versions as opposed
> to deal with upgrading passive, but mission critical, middleware.
>
> Kind Regards,
> Mikkel Fahnøe Jørgensen
>
>
> On 13 December 2017 at 17.09.15, [e-mail] <mailto:[e-mail]>
> ([e-mail] <mailto:[e-mail]>) wrote:
>
>> Hello Brian,
>>
>> On -10/01/-28163 20:59, Brian Trammell (IETF) wrote:
>> >
>> > [...] what I was hoping I'd see here, and didn't, is an explicit statement of the threat model the greasing we apply
>> > is meant to counter.
>>
>> Thanks for focusing on this. I'd like to take this opportunity to chime in with a network operator's perspective on
>> these matters.
>>
>> As it turns out, the generic term "middlebox", which seems to be rather loaded in this context, somehow hides another
>> important use case for us: a passive middle observer meant for troubleshooting.
>>
>> While I agree that all active middleboxes may somehow wreck things in creative though unwilling ways, a passive middle
>> observer can do no harm. But the point is that this middle observer is not only harmless, but necessary for the smooth
>> operation of the network, which benefits the whole chain: its purpose is simply to locate, as effectively as possible,
>> the offending link or piece of equipment, once some problem has been detected end-to-end.
>>
>> To do so, the most efficient method is dichotomy, which allows to home in on the problem in logN steps for a path of N
>> segments, where each steps means (1) installing the middle observer at a chosen point on the path and (2) deciding
>> whether the problem happens upstream or downstream from that point.
>>
>> Clearly step (2) assumes that the measurements done by the middle observer give the upstream/downstream information.
>> This means that the observable of interest (RTT, loss or reordering) should be available for both upstream and
>> downstream segments. This somehow constrains the class of methods that can be designed to support the use case. In this
>> respect, the spin bit is satisfactory (since it gives both upstream and downstream RTT estimates), while proposed
>> alternatives like packet number echo aren't (since they only yield end-to-end RTTs).
>>
>> Now, while pondering options like a random key shared by the endpoints, please keep in mind the use case of dichotomic
>> troubleshooting, where typically none of the endpoints is under control. You may still impose stateful operation on the
>> middle observer though. But don't just kill it.
>>
>> -Alex


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.