Subject: [midcom] Few Q's on Requirements of MIDCOM

From: Aradhya Rohit V-A15094 <[email-masked]>
Date: Wed, 18 Sep 2002 10:38:59 +0530

Hi,
      'am new to this mailing list, i have few questions regarding  RFC 3304 " Middlebox Communications (midcom) Protocol Requirements" any pointers or directions are highly appreciated.

1.What are the charcterstics of association between midcom agent and middlebox?? Is the association defined here are specific to a particular service, if a midcom agent wants to have two types of services, then does he has to have two associations?.. Is a lifetime associated with association.
2.Is midcom agent is the final authority in determining the traffic behaviour at middlebox,  is there a possibility that middlebox may decide to override any of the expected behavior by midcom agent at later point of stage after associations are established, if middlebox does so does that means it is a end of association?? Or its permissiable for middlebox to alter the characterstics of  associations (with notification to midcom agent ofcourse..), but the association is not renegotiatated.
3.Is there any threat perception analysis done for this protocol?.. any pointers are really appreciated.. Is security needed??.. 
4. Is there a restriction that the machines lying on immediately attached network to middlebox can only become midcom agents? May be its good to have a concept of REALMs, which are valid and should be allowed to be midcom agents, any machine lying outside this realm should not be allowed to be a midcom agent.
5.Why there is a need for mutual authentication??.. isn't it a overhead, whats the gain from it.. ya.. I understand there will be attacks on middlebox agents like session hijaking, dos etc, but I guess it will be pretty visible to end user or midcom agents immediately.. 

-Regards
  Rohit