Re: Re: Lack of packets from other end

On Wed, 2004-12-15 at 00:07, Bora Akyol wrote:

> I agree with Joe here. There are legitimate situations where there may
> be no packets from the other end for a long period of time. We have DPD
> to detect a dead peer. If a peer moves from one IP addr to another
> without notifying the security gateway, I don't think it is the SG's job
> to detect and recover from this.

this is an somewhat akin to path mtu blackhole detection; inter-layer side 
channels could well allow an upper-layers repeated RTO to trigger a hunt
for a better path.  it's not the sort of thing which will be as immediately
effective as a link-down indication from L2 but it's not something that we 
should explicitly declare out of spec.

						- Bill