IETF Logo Mail Archive

Re: [shara] port randomization (draft-ymbk-aplusp-03)

<mohamed.boucadair@orange-ftgroup.com> Tue, 17 March 2009 13:57 UTC

Return-Path: <mohamed.boucadair@orange-ftgroup.com>
X-Original-To: shara@core3.amsl.com
Delivered-To: shara@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C1893A6A3A for <shara@core3.amsl.com>; Tue, 17 Mar 2009 06:57:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.293
X-Spam-Level:
X-Spam-Status: No, score=-2.293 tagged_above=-999 required=5 tests=[AWL=-0.045, BAYES_00=-2.599, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PjxYVZ-zoA0M for <shara@core3.amsl.com>; Tue, 17 Mar 2009 06:57:40 -0700 (PDT)
Received: from R-MAIL1.rd.francetelecom.com (r-mail1.rd.francetelecom.com [217.108.152.41]) by core3.amsl.com (Postfix) with ESMTP id C5BFE3A6A5C for <shara@ietf.org>; Tue, 17 Mar 2009 06:57:39 -0700 (PDT)
Received: from ftrdmel3.rd.francetelecom.fr ([10.193.117.155]) by ftrdsmtp1.rd.francetelecom.fr with Microsoft SMTPSVC(6.0.3790.3959); Tue, 17 Mar 2009 14:58:20 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C9A708.6D998690"
Date: Tue, 17 Mar 2009 14:58:18 +0100
Message-ID: <6CF039C5B32037498B02251E11CDE6B007DB7EBD@ftrdmel3>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [shara] port randomization (draft-ymbk-aplusp-03)
Thread-Index: AcmnBoHQbr5gemqDTkScNqqMDiU8mgAADKsA
References: <022a01c9a2ab$fd5abf60$fd736b80@cisco.com><49B91C8B.5010906@go6.si><04a201c9a338$d5ce8f70$fd736b80@cisco.com><49B9752B.8030407@go6.si> <051901c9a64a$0256bf40$fd55150a@cisco.com><49BE9F0D.2080804@go6.si><06e601c9a697$e6c67c90$fd55150a@cisco.com><A99B171D26E1564B92D36826128CD66127EE106A92@NOK-EUMSG-01.mgdnok.nokia.com><000c01c9a69f$e7ab3da0$c2f0200a@cisco.com> <49BF8115.307@go6.si> <6CF039C5B32037498B02251E11CDE6B007DB7E13@ftrdmel3> <49BFA22B.9010303@go6.si> <6CF039C5B32037498B02251E11CDE6B007DB7E50@ftrdmel3> <49BFA93B.3020009@go6.si>
From: <mohamed.boucadair@orange-ftgroup.com>
To: <jan@go6.si>
X-OriginalArrivalTime: 17 Mar 2009 13:58:20.0505 (UTC) FILETIME=[6E127490:01C9A708]
Cc: Gabor.Bajko@nokia.com, shara@ietf.org
Subject: Re: [shara] port randomization (draft-ymbk-aplusp-03)
X-BeenThere: shara@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Sharing of an IPv4 Address discussion list <shara.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/shara>, <mailto:shara-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/shara>
List-Post: <mailto:shara@ietf.org>
List-Help: <mailto:shara-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/shara>, <mailto:shara-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Mar 2009 13:57:41 -0000

 
 
Thank you for  this clarification. 
 
Please see inline.

  _____  

De : Jan Zorz @ go6.si [mailto:jan@go6.si] 
Envoyé : mardi 17 mars 2009 14:44
À : BOUCADAIR Mohamed RD-CORE-CAE
Cc : Gabor.Bajko@nokia.com; shara@ietf.org; dwing@cisco.com
Objet : Re: [shara] port randomization (draft-ymbk-aplusp-03)


mohamed.boucadair@orange-ftgroup.com wrote: 

 
Thanks.
 
What I missed in your initial answer is why you are referring to offloading the DNS resv to the **core (PRR)**.


Mohamed, hi.

Sorry for the mess. This referred to avoiding to complicate even further with port randomization within contiguous, non-contiguous or random port ranges allocated to CPE. My personal feeling is that we already did a solution complex enough and we might not have to go towards the way of making it even more complex.

 
[Med]  Randomisation should not be seen as a target per se, but rather the problem it solves. For me, randomisation does not solve security issues but makes difficult some attacks. Non-contiguous port range does also...
 
Randomisation can also be implemented with port range solutions, but some concerns are to be studied: 
- What is the port range limit beyond which randomisation is not **efficient**? 
- If randomisation is to be implemented, instead of non contiguous port ranges for instance, what is the impact on the PRR performances?
 
BTW, I agree with you and Pierre that a minimum of functionalities are needed to have implementation of port range solution. 
 
Cheers,
Med 
 

Thanks, Jan Zorz

v2.8.7 | Report a Bug | By Email