Re: [tcpm] AD Review: draft-ietf-tcpm-icmp-attacks-09

[Fernando Gont <[e-mail]>]

Hello, Lars,

>>>> If yes, then with delayed ACKs (or otherwise in corner cases) 
>>>> acked_packet_size is actually larger than maxsizesent always.
>>> Well, that depends on the amount of data you send. But yes, you
>>> could say that "acked_packet_size is actually larger than
>>> maxsizesent *usually*".
>>> 
>>>> On second reading, I don't think that's a problem for the
>>>> technique, but the name and description of the variable
>>>> confused me earlier.
>>> Should I add a clarification?
>> I think this would make sense. You might also want to change the
>> name of the variable.
> 
> this is the only issue I haven't seen addressed in -10.

Note that I did add a clarification and tweaked the relevant text (see
the diff). I didn't rename the variable, though, as I couldn't come up
with a better name (on first thought, at least), and because I thought
that the clarification I added would do. But please let me know if you
have any thoughts on how to improve this.


> I'll start the IETF Last Call based on -10 now; we can work out the
> few remaining issues (incl. this one) in parallel.

FWIW, in the next rev I would be replacing the current disclaimer with:

    We note that the counter-measures discussed in this document are not
    part of standard TCP behavior and this document does not change that
    state of affairs.  The consensus of the TCPM WG (TCP Maintenance and
    Minor Extensions Working Group) was to document this widespread
    implementation of TCP behavior and neither to change the TCP
    standard nor to make any new recommendations herein.

(This is Joe's proposed text, leaving out the "non-standard", as agreed
by others so far...)

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1