Re: [tcpm] Some comments on tcpsecure

[Joe Touch <[e-mail]>]

Fernando Gont wrote:
> At 05:21 p.m. 04/04/2008, Joe Touch wrote:
> 
...
>> ICMPs are already filtered out for security reasons at firewalls. The 
>> key here is whether to recommend that action or not.
> 
> tcpsecure should not talk about what to do with ICMP error messages. 

I disagree; as you noted, to accomplish any level of protection by 
filtering RSTs etc., ICMPs need to be filtered as well. It can cite your 
doc on the issues, but IMO needs to include a recommendation on 
accompanying requirements.s

...
>>> And, for what is worth, strictly speaking there's no such a thing as 
>>> a TCP MSL, either. TCP's MSL is based on the assumption that the IP 
>>> TTL is decremented at least once every second. And this is not 
>>> warranted, either. There's not such enforcement as there is in, e.g., 
>>> Delta-t.
>>
>> If there's no MSL, then that's even more reason not to use window 
>> information to determine the validity of an ICMP.
> 
> And no reason to use sequence numbers at all, and no reason for TCP's 
> quiet time, and no reason for TCP's TIME-WAIT state, etc., etc., etc. 
> From that purist (??) point of view, TCP would not even work at all.

Absolutely - that's the absurdity of *your* point about there being no 
such thing as MSL. However, MSL is irrelevant to ICMP even if (contrary 
to your point above) MSL is meaningful to TCP.

Jo

_______________________________________________
tcpm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tcpm