Subject: sessions and connections

From: "Murali S" <[email-masked]>
Date: Tue, 18 Dec 2001 12:42:00 +0530

Hi all,

	do we have to do a login for each connection in a session? If not
where do we generate a CID for each connection.
	Draft says that CID should be generated during login phase.

-Murali

---

From: [email-masked]
Date: Tue, 18 Dec 2001 10:15:32 -0500

Yes, you must do a login for each connection.  --David

> -----Original Message-----
> From: Murali S [mailto:[email-masked]]
> Sent: Tuesday, December 18, 2001 2:12 AM
> To: [email-masked]
> Subject: sessions and connections
> 
> 
> Hi all,
>

---

From: [email-masked]
Date: Tue, 18 Dec 2001 22:48:27 -0500

> But you don't need to authenticate & negotiate parameters for 
> all the connections in the session or do you? 
> Isn't the leading connection sufficient...

NO!!  The IP addresses don't have to be the same for connections
in a session.  If subsequent connections aren't authenticated, an
attacker waits for the first connection to establish, adds his
connection to the Target to the session and sends a format command ...

Some of the negotiated parameters can only be negotiated on the
leading connection and are indicated as such in the draft.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 249-6449 *NEW*      FAX: +1 (508) 497-8500
[email-masked]       Mobile: +1 (978) 394-7754
---------------------------------------------------