Subject: RE: [midcom] Re: Need to close too (was: Topology considerations documents)

From: Mark Duffy <[email-masked]>
Date: Thu, 13 Sep 2001 15:42:21 -0400

At 12:15 PM 9/13/01 -0700, Christian Huitema wrote:
>Proposed requirement R86 (or whatever is the number):
>
>R86: It should possible to define specific filters that are more
>restrictive than an overlapping generic filter, including filters that
>would prevent traffic for a specific set of IP addresses and transport
>parameters even if that traffic was authorized by an overlapping
>"wildcard" filter.
>
>Reasoning: this is required for rapid response to intrusion detection. 
>

Sounds good to me.  However, I have a few questions on details:

1. Does "more restrictive" here refer to having a more specific (less
wildcarded) classifier rule, or does it refer to the disposition rule being
less likely to allow the packet through?  Can we clarify the wording?

2. Does the above R86 imply that the agent must be able to tell the
middlebox that this "new" rule should be matched to packets with a higher
precedence then the "older", more highly wildcarded rule?  Or do you
believe a ridgidly defined canonical ordering system can cover that need? 

- Thanks, Mark

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom