Re: [Spud] ??????: Numbers...

Yoav Nir <ynir.ietf@gmail.com> Tue, 16 June 2015 09:15 UTC

Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <486B9F34-9E47-4B74-B9DE-56BC9A3D84FA@cisco.com>
Date: Tue, 16 Jun 2015 12:15:49 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <0D5AE723-1D37-4F21-B697-9D3A4F58CEB7@gmail.com>
References: <20150612143838.GJ27147@cisco.com> <DM2PR0301MB06555A1F115E2551C3D1BC8FA8BB0@DM2PR0301MB0655.namprd03.prod.outlook.com> <CALx6S34z-9gi7+VVnyVdFmLroR_QYeZMWPpbCeES_TJ46iSR0A@mail.gmail.com> <486B9F34-9E47-4B74-B9DE-56BC9A3D84FA@cisco.com>
To: "Pal Martinsen (palmarti)" <palmarti@cisco.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/spud/tvup2E3iRv6Emd5b_RKhjtPLpCQ>
Cc: Tom Herbert <tom@herbertland.com>, Youjianjie <youjianjie@huawei.com>, Martin Stiemerling <mls.ietf@gmail.com>, "mirja.kuehlewind@tik.ee.ethz.ch" <mirja.kuehlewind@tik.ee.ethz.ch>, "spud@ietf.org" <spud@ietf.org>, Christian Huitema <huitema@microsoft.com>
Subject: Re: [Spud] ??????: Numbers...
Precedence: list

> On Jun 16, 2015, at 11:12 AM, Pal Martinsen (palmarti) <palmarti@cisco.com> wrote:
> 
>> 
>> On 13 Jun 2015, at 01:37, Tom Herbert <tom@herbertland.com> wrote:
>> 
>> On Fri, Jun 12, 2015 at 10:22 AM, Christian Huitema
>> <huitema@microsoft.com> wrote:
>>>> I have never heard 99% of UDP is trash to be true. Security folks in Cisco told me
>>>> "a lot of unix networking apps from the 80th/90th based on UDP where
>>>> extremely insecure", and i think thats definitely true and has lead the first wave
>>>> of firewalling off UDP. The second wave was p2p sharing apps which also
>>>> caused a lot of enterprises to be weary of UDP and firewall it.
>>> 
>>> Two big applications that are running over UDP: voice and video with Skype, video-games with Xbox Live. Of course, there are places where UDP is blocked, in which case UDP applications will try tunneling over HTTPS. But in the vast majority of consumer networks, these applications use UDP just fine.
>>> 
>> Christian,
>> 
>> You present a very interesting datapoint, but I'm not sure how to
>> interpret it. Is UDP getting far reach now because most users are not
>> behind firewalls, firewalls are allowing all UDP to pass, or holes
>> have been commonly punched in firewalls for specific applications?
>> Would this imply there is less need to implement a UDP based protocol
>> to work with stateful firewalls?
>> 
> 
> 
> 
> Thanks Cristian for the datapoint. I think enterprise numbers are different (I am assuming that Skype and X-box are not typically enterprise applications).

Skype (or equivalent) does get used in enterprises. X-box? Not as much...

> But it shows that most home equipment work with this approach, and nothing in the middle on the big dark ans scary Internet breaks UDP. That is very useful information.

“Nothing" is perhaps too strong. As long as the UDP packets are small enough, the big bad Internet will let it through, but there are places where fragments are dropped. Not usually a problem for VoIP, but could be for other applications.

> So the remaining problem seems to be enterprise networks and the fears of opening up UDP. And hopefully something SPUD like can help with that.

Hopefully. But there’s also the coffee shop / hotel / public transit networks that tend to have some very badly configured firewalls with heavy-handed filtering. 

Yoav
(who works for a firewall vendor)

Re: [Spud] ??????: Numbers... Youjianjie
Re: [Spud] ??????: Numbers... Christian Huitema
Re: [Spud] ??????: Numbers... Tom Herbert
Re: [Spud] ??????: Numbers... Christian Huitema
Re: [Spud] ??????: Numbers... Yoav Nir
Re: [Spud] ??????: Numbers... Pal Martinsen (palmarti)
Re: [Spud] ??????: Numbers... Yoav Nir