Re: [Spud] SPUD's open/close are unconvincing

[Roland Bless <[e-mail]>]

Hi Brian,

On 09.04.2015 at 00:03 Brian Trammell wrote:

> SPUD's ACK (roughly TCP SYN/ACK) is more interesting. A SYN/ACK in 
> proper response to a SYN means that someone on the other side of
> the firewall decided a connection could proceed, or more mundanely
> means there is now actually state on the endpoint so any state the
> network needs should be there too. For bidirectional transports
> (i.e., for

Interesting thought, but only for the very simple TCP model the
endpoint already created state and is thus vulnerable to TCP SYN flood
attacks. So a responding endpoint is probably not a sufficient
indication...see also below.

> every transport one should be running over SPUD, since congestion 
> control requires feedback, as does proof of reverse reachability
> to reduce spoofing) it might be that ACK is sufficient to get us
> what we need. (In reviewing that paragraph, we probably also need
> to name it something other than ACK.)

SYN Flooding would also result in endpoints responding, i.e.,
the SYN/ACK is IMHO not a sufficient indication for a proper
conversation/state setup as the third way (ACK) would probably be.
Moreover, purely unidirectional data flows
(e.g., very sparse measurement data) may have no such prior handshake,
or multicast flows may have no ACKs.

> some sort of heuristic for rate-limiting. Indeed, these all speak 
> toward making ACK the important OPEN.

Maybe, but that is still not sufficient IMHO.

Regards,
 Roland