Re: [Tsvwg] Re: [tcpm] Revision of draft-larsen-tsvwg-port-randomization

[Joe Touch <[e-mail]>]

Murari Sridharan wrote:
> In this context I wanted to bring up a related issue that might also
strengthen this sort of a port randomization proposal.
> 
> Today the 64k port limitation is starting to become a huge problem
> and
> most often admins add ip addresses to increase the scalability. Given
> that most often the destination port (and sometimes the destination
> address) is well known, the only scalability left is the source address.
> Increasing ip addresses to improve scalability seems a fairly round
> about approach and frankly doesn't scale well. Given that the 64k limit
> is not fundamental why not provide a scaling factor similar to the
> receive window to scale the number of usable ports. This also makes
> randomization much more meaningful because in certain proxy scenarios
> the number of connections quickly exhausts the available ports and at
> that point the attacker can simply use any port assuming he can guess
> the source address.

Scale works for windows because of two things:

1) the scale increases the granularity of the window info

2) the scale factor can be negotiated during SYN exchange

Neither is true for ports.

1-p) ports are specific numbers; extended fields could be provided in
options, but that's equivalent to having the port number itself in an
option anyway

2-p) we can negotiate the use of these extended port ranges with
endpoints, but it will break NATs

Portnames is a step in these directions, but is currently experimental
at best. See
http://www.isi.edu/touch/pubs/draft-touch-tcp-portnames-00.txt (to be
updated shortly).

Joe

-- 
----------------------------------------------------------------------
Joe Touch                Sr. Network Engineer, USAF TSAT Space Segment
               Postel Center Director & Research Assoc. Prof., USC/ISI

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm