Re: [sunset4] CGN document for consideration

Reinaldo -

A comment about this draft:
In section 3.2, you mention immediate purge of mapping when a TCP RST is received. While it's not a unique issue to this recommendation, I think there's a security consideration around this - an attacker could cause a lot of state-mapping churn on the CGN (in addition to the obvious impact to the customer session itself) by sending random TCP RSTs to ports on the external IP address block of the CGN. Therefore it may not be advisable to recommend this behavior without some sort of rate-limiting or a discussion of ways to distinguish legitimate TCP RSTs that do legitimately occur from maliciously initiated RSTs.

Thanks,

Wes George, speaking as an individual

> -----Original Message-----
> From: sunset4-bounces@ietf.org [mailto:sunset4-bounces@ietf.org] On
> Behalf Of Reinaldo Penno
> Sent: Tuesday, May 01, 2012 6:01 PM
> To: sunset4@ietf.org
> Subject: [sunset4] CGN document for consideration
>
> Hi,
>
> I would like to submit this document to the WG for consideration.
>
> http://tools.ietf.org/html/draft-penno-behave-rfc4787-5382-5508-bis-02
>
> I'm assuming that port allocation method drafts should be submitted to
> this WG.
>
> Thanks,
>
> Reinaldo
>
>
> _______________________________________________
> sunset4 mailing list
> sunset4@ietf.org
> https://www.ietf.org/mailman/listinfo/sunset4

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.