Re: Suggestions for changes to draft-ietf-itrace-03.txt

Marcus Leech wrote:
> 
> Mikael Olsson wrote:
> >
> > Tom-PT Taylor wrote:
> > >
> > > Could people please look through this and see what else has to be done
> > > besides changing the signature algorithm codepoints as agreed yesterday.
> >
> > 1. Two years ago, there seemed to be consensus on building the message
> >    more according to common ICMP message layout, e.g.:
> >    - Transport IP header
> >    - ICMP itrace header
> >    - IP header of previous datagram, plus 8 IP data octets
> >    - Tag-length-value scheme, possibly including even more
> >      of the original datagram
> >
> >   The specification now shows the TLV scheme beginning right after
> >   the ICMP header. - Why? It makes it harder for state tracking
> >   firewalls to figure out which stream the ICMP message belongs to.
> >
> I'm not utterly-wedded to the existing format.  What do others think?

You know, I've given this some thought, and I don't think keeping
IPH+64bits at the beginning of the ICMP data is such a good idea
any more.  Firewalls that track state of ICMP errors will be 
utterly confused in either case.  They'll handle the reverse
traces just fine, but they'll get the forward traces (which are
the ones that will be useful in 'normal' DDoS) wrong.

The real problem with putting the data at the beginning is that
it's a Good Thing to include more than 64 bits of L4 data, 
something which updated ICMP documentation reflects.
Doing this would require some sort of additional length encoding
scheme, so that one can learn where the TLVs begin, and I for
one can't think of a good scheme for doing that. (Putting length
info BEFORE the included datagram breaks the idea to begin with!)

Actually, I think that the specification should say that one
should include the original IP header, and then as much L4
data as the total ICMP data size constraint permits.


-- 
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50       WWW: http://www.clavister.com