Re: [shara] [BEHAVE] TR: I-DAction:draft-boucadair-pppext-portrange-option-00.txt

[<[e-mail]>]

Dan,

We have a draft pending on Internet-Draft submission tool: http://www.ietf.org/proceedings/staging/draft-bajko-pripaddrassign-00.txt that describes what you ask. (Note: that link will not work after the draft gets published).

Please check that out, it is discussing more about this and also describing alternative solution using cryptographically random port allocation scheme.

These administrators could configure a host to get say 1000 ports, but of course not specific ones as those would be randomized from the 64K-1K range. With proper tools administrators can of course see what ports are/were assigned to users.

Best regards,

        Teemu

>-----Original Message-----
>From: [e-mail] [mailto:[e-mail]]
>On Behalf Of ext Dan Wing
>Sent: 06 February, 2009 09:11
>To: [e-mail];
>[e-mail]; [e-mail]
>Cc: [e-mail]; [e-mail]
>Subject: Re: [BEHAVE] [shara]TR:
>I-DAction:draft-boucadair-pppext-portrange-option-00.txt
>
>
>
>
>> -----Original Message-----
>> From: [e-mail]
>> [mailto:[e-mail]]
>> Sent: Thursday, February 05, 2009 10:35 PM
>> To: [e-mail]; [e-mail]; [e-mail]
>> Cc: [e-mail]; [e-mail]
>> Subject: RE: [BEHAVE] [shara]TR:
>> I-DAction:draft-boucadair-pppext-portrange-option-00.txt
>>
>>
>> Thank you for your comment.
>>
>> There is a subtlety between subnet mask and port mask:
>> subnets need to be hierarchical but not port ranges!
>
>I disagree.  Port ranges all belong to the same IP address --
>from the view of the rest of the Internet.  This is akin to
>the rest of the Internet's view of a subnet.  It is only the
>local IP address (subnet) that is aware of the separation of
>ports (or IP addresses) to individual hosts.
>
>> Non contiguous port range is proposed as a solution to assign with a
>> single mask for instance "M" Port Ranges with "n" Port Ranges within
>> the well-known Port Range. This means that well-known PR won't be
>> assigned to the same user.
>>
>> I see other advantages on the usage of non contiguous PR:
>> e.g. an attacker would have more difficulty to "guess" a port value
>> within the Port Range.
>
>draft-boucadair-pppext-portrange-option does not describe this
>advantage.  I am not convinced this would thwart an attacker
>significantly.  If a user is permitted XXXX ports, an attacker
>can determine what ports they are by a range of contiguous
>bits or a range of non-contiguous bits.  I agree the attacker
>has to perform more probes to learn the non-contiguous bit
>pattern, of course.  But an analysis of this advantage would be useful.
>
>> By the way, I have the same question as Randy.
>
>I am not talking about the proverbial Grandma or "Joe Sixpack"
>when I say "users".  Those users have no need to understand
>255.255.255.0, or IP addresses, or ARP.
>
>However, network administrators are users, and they need to
>understand these bit-masks in order to successfully configure
>equipment.  Based on industry experience with IP,
>non-contiguous subnet masks are not used in very many
>networks.  This is because the complexity to use them exceeds
>their value.
>
>Justification of the value of non-contiguous port masks would
>be useful.
>
>-d
>
>
>>
>>
>> Med
>>
>>
>>
>> -----Message d'origine-----
>> De : [e-mail] [mailto:[e-mail]] De la
>> part de Dave Thaler Envoyé : vendredi 6 février 2009 02:10 À : Randy
>> Bush; Dan Wing Cc : [e-mail]; [e-mail] Objet : Re:
>> [BEHAVE] [shara]TR:
>> I-DAction:draft-boucadair-pppext-portrange-option-00.txt
>>
>> Yes.  :)
>>
>> I had the same feedback last IETF.
>> This is the same thing all over again as a non-contiguous
>subnet mask,
>> which the industry effectively got rid of as having too many
>problems
>> in practice (but being fine in theory).
>>
>> -Dave
>>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]]
>On Behalf
>> Of Randy Bush
>> Sent: Thursday, February 05, 2009 3:35 PM
>> To: Dan Wing
>> Cc: [e-mail]; [e-mail]
>> Subject: Re: [shara] [BEHAVE] TR:
>> I-DAction:draft-boucadair-pppext-portrange-option-00.txt
>>
>> > I like this draft overall, but I would restrict this so that only
>> > contiguous port ranges are permitted.  Non-contiguous
>> subnet masks are
>> > difficult for many people to understand (even today) and I expect
>> > there would be similar confusion with non-contiguous port ranges.
>>
>> do people have to understand these?
>>
>> randy
>> _______________________________________________
>> shara mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/shara
>>
>> _______________________________________________
>> Behave mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/behave
>
>_______________________________________________
>Behave mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/behave
>