Subject: RE: [Dime] Question: source of address/port to be used for serverresponses

From: "Parker, James" <[email-masked]>
Date: Fri, 23 Feb 2007 15:33:00 -0700

Thanks.

I *think* this means my first method (clone a response channel) is
correct, and the use of "accept" in the RFC is a term of art rather than
a common language term.  My concern was that this creates a connection
with one end being an ephimeral port on the client.

This means the statement "The base Diameter protocol is run on port 3868
of both TCP [TCP] and SCTP [SCTP] transport protocols" does not mean
that all messages must use that port, even once a connection is
established.  Given that this has an impact on the configuration of
firewalls over which the connection may pass, this could have been
interpreted differently.

James Parker
Distinguished Software Development Engineer
Comverse, Inc.

-----Original Message-----
From: Tolga Asveren [mailto:[email-masked]] 
Sent: Friday, February 23, 2007 2:32 PM
To: [email-masked]
Subject: RE: [Dime] Question: source of address/port to be used
forserverresponses

James,

There is always a single Diameter connection between two adjacent
entities, and answers are always sent on the connection from which the
corresponding requests has been received.

    Thanks,
    Tolga

> -----Original Message-----
> From: Parker, James [mailto:[email-masked]]
> Sent: Friday, February 23, 2007 2:14 PM
> To: [email-masked]
> Subject: [Dime] Question: source of address/port to be used for 
> serverresponses
>
>
> I am looking at implementing the Diameter protocol for a server, and I

> cannot find a clear statement as to how to create the proper channel 
> to send responses (answers).  Is the proper method:
>
>     - Clone a response channel (e.g., by an accept() system call)?
>     - Open the CER Origin-Host/port 3868
>     - Open the CER Host-Realm (port 3868 if none specified)
>     - Open the CER Host-IP-Address(es)/port 3868
>     - Some other method
>
> The first seems the most logical; however that could result in 
> security issues if a firewall is crossed (since arbitrary ports must
be opened).
>
> Thanks in Advance
>
> James Parker
> Distinguished Software Development Engineer Comverse, Inc.
>
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: David Frascone <[email-masked]>
Date: Fri, 23 Feb 2007 17:58:36 -0500

It means that the destination port of the peer doing the connect should
be 3868.  The source port will vary.  Firewalls should work fine with
this mechanism

-Dave

-- 

David Frascone

           Why doesn't DOS ever say "Excellent command or filename!"