Re: [shara] port randomization (draft-ymbk-aplusp-03)

Dan Wing wrote:
> http://tools.ietf.org/html/draft-ymbk-aplusp-03#section-4.8 says, in part:
>
>    ...
>    Port randomization is also a bit compromised in A+P solution.  As CPE
>    can randomize ports only within port range that is allocated to it,
>    randomness is more limited than in the the scenario with full range
>    of ports, allowed for randomization.  We can assume, that CPE either
>    gets port range from ephemeral range (49152-65535) or from
>    "registered ports" range (1024-49151).  Both ranges can be used for
>    randomization, see [I-D.ietf-tsvwg-port-randomization] for more
>    details.
>
> Has consideration been given to having the PRR return only *one* port
> for each request, or to returning a list of port numbers which are
> not consecutive and are not a bit-pattern of ports?  These techniques
> would allow the PRR to distribute the requests randomly across the 
> entire port range instead of within a block of ~100 (or whatever). 
>   
Hi. My concern with this approach is massive number of "states" or 
"redirects" in form
"IP+port -> tunnelX", that PRR would have to maintain. On the other 
hand, fragmented blocks of
ports (or one port per request) are much easier to release, when not in 
use anymore. But if we distribute
consecutive blocks to CPE's I think that we considerably lower the 
number of moving parts in the whole system.

Needs to be discussed.
> Further fleshing out of the technique described in Section 4.4
> ("Dynamic allocation of port ranges") could be useful towards 
> allowing applications to benefit from the security advantage of 
> port randomization.
>   
How important is port randomization and how big is the impact in real 
life, if we randomize within
smaller range? Is it worthy to make already complex solution (shared IP) 
even more complex just because of that?

Regards, Jan Zorz
> -d
>
>
> _______________________________________________
> shara mailing list
> shara@ietf.org
> https://www.ietf.org/mailman/listinfo/shara
>