Re: issue 11 -- window size
Tero Kivinen <[email protected]>
| Newsgroups | gmane.ietf.mobike |
|---|---|
| Message-ID | <[email protected]> |
Mohan Parthasarathy writes: > Sorry to beat up on the same point again.. The reason the retransmitted > request cannot change (except IP headers) is because it would break > implementations that store the hash of the request to detect retransmissions. > Is that right ? Yes. > I was talking about an "option" for detecting the presence of NATs > securely where you don't accept blindly what you see in IP headers but also There is no way to detect NATs securely, unless you have co-operation of NAT. NAT is an attacker on the way from initiator to the responder who changes the IP-addresses. There is no way to distinguish that from the real attacker, without changing NATs. > check the payload (if address is present in the MOBIKE NAT-D > payload) to see if the address on the IP header is same. It is easy to securely detect that there is NO NAT between, and that does not require changing of packets for retransmission. We simply need to keep the other end up to date which addresses we might be using, and if the address is one of those, then there is no NAT between. -- [email protected]