Return-Path: X-Original-To: v6ops@ietfa.amsl.com Delivered-To: v6ops@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52FA41B2C6E for ; Wed, 17 Jun 2015 10:48:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fG5EbqIUTB0P for ; Wed, 17 Jun 2015 10:48:21 -0700 (PDT) Received: from uillean.fuaim.com (uillean.fuaim.com [206.197.161.140]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F060D1B2C73 for ; Wed, 17 Jun 2015 10:48:20 -0700 (PDT) Received: from clairseach.fuaim.com (clairseach-high.fuaim.com [206.197.161.158]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by uillean.fuaim.com (Postfix) with ESMTP id D1DDA8813C for ; Wed, 17 Jun 2015 10:48:20 -0700 (PDT) Received: from brians-mbp.jhuapl.edu (swifi-nat.jhuapl.edu [128.244.87.133]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by clairseach.fuaim.com (Postfix) with ESMTP id 7AB2D1368268 for ; Wed, 17 Jun 2015 10:48:20 -0700 (PDT) Message-ID: <5581B2DF.8040207@innovationslab.net> Date: Wed, 17 Jun 2015 13:48:15 -0400 From: Brian Haberman User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: v6ops@ietf.org References: <20150515105406.GA3028@ernw.de> <87siav2m6p.fsf@stepladder-it.com> <20150517191841.GA26929@ernw.de> <20150617081424.GA15514@ernw.de> <505DC30B-8ED1-4C75-A13B-FAC9D4E5348C@cisco.com> <20150617174315.GA17641@ernw.de> In-Reply-To: <20150617174315.GA17641@ernw.de> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="pa5t5dGaGu6m7pXA6PbRFTeHH8S7K94rH" Archived-At: Subject: Re: [v6ops] [ipv6-wg] Extension Headers / Impact on Security Devices X-BeenThere: v6ops@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: v6ops discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jun 2015 17:48:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pa5t5dGaGu6m7pXA6PbRFTeHH8S7K94rH Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 6/17/15 1:43 PM, Enno Rey wrote: >=20 > Let's put it slightly different: the intrusion detector is supposed > to detect/block certain application layer attacks. Which it does as > long as those come in/pass by without extension If the device is trying to inspect application-layer data, it might as well act like the destination and re-assemble the fragments. Yes, this is costly processing, but it mitigates this bypass mechanism. Regards, Brian --pa5t5dGaGu6m7pXA6PbRFTeHH8S7K94rH Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQEcBAEBCAAGBQJVgbLkAAoJEBOZRqCi7goqDKEIAKhebBAd7zId8zOXcH+eW100 v6Yp7ox1gNTY8GQXDcuW+mlNnAXdEvKq2KVhkhBVn0fiWtoHtjxMQHFVwb4vBxQY nfqgm6UHbagA9Kt7GHdLzcYx11jozE6ZWPxnFznEJxSjA6mWEwvwN3J93cWUfktp aTB90rLrI2Q1P4tC7fHPYI0iLy4ni80molaW793pDoekzUAyTju6yyFYzv/Ycp4G +iDt0u69n/OkOSlX1Fbize1oZDw6XwXRO/V6S3nh5pKBtXJs7+k9h4jgTyxvrV5N KeZRrnNIWoq4fHmyeLrsX0DmNFVgAMXw6vI/1rhBGZfkc9DIJpW0/Pz/V2J7Bdc= =KMHw -----END PGP SIGNATURE----- --pa5t5dGaGu6m7pXA6PbRFTeHH8S7K94rH--