From opsec-bounces@ietf.org Sun Jan 06 08:07:19 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBVDZ-0002Be-Le; Sun, 06 Jan 2008 08:07:09 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBVDY-0002BT-RN for opsec@ietf.org; Sun, 06 Jan 2008 08:07:08 -0500 Received: from chokecherry.srv.cs.cmu.edu ([128.2.185.41]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JBVDX-0000dt-9i for opsec@ietf.org; Sun, 06 Jan 2008 08:07:08 -0500 Received: from atlantis.pc.cs.cmu.edu (ATLANTIS-HOME.PC.CS.CMU.EDU [128.2.200.132]) (authenticated bits=0) by chokecherry.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id m06D73YQ000364 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 6 Jan 2008 08:07:04 -0500 (EST) Date: Sun, 06 Jan 2008 08:07:03 -0500 From: Jeffrey Hutzelman To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev4 - your thoughts requested... Message-ID: <79B18C692AFFBA3BB19746D9@atlantis.pc.cs.cmu.edu> In-Reply-To: <47720011.8010703@bogus.com> References: <47720011.8010703@bogus.com> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Cc: X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org --On Tuesday, December 25, 2007 11:17:37 PM -0800 Joel Jaeggli wrote: > The OPSEC WG will document best current practices with regard to network > security. That sounds a quite a bit broader than I think is intended. In particular, "with regard to network security" can be read as meaning anything to do with security of network devices, traffic, nodes attached to the network, applications running over it, users using it, etc. Perhaps it would be better to use a more targeted phrase like "with regard to security of network infrastructure" or something. Just my $0.02. -- Jeff _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Jan 07 05:59:41 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBphf-0006R7-Ml; Mon, 07 Jan 2008 05:59:35 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBphe-0006O7-R2 for opsec@ietf.org; Mon, 07 Jan 2008 05:59:34 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JBphe-0002hm-Du for opsec@ietf.org; Mon, 07 Jan 2008 05:59:34 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m07AxXC9024969 for ; Mon, 7 Jan 2008 05:59:34 -0500 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m07AxXmp024961 for ; Mon, 7 Jan 2008 05:59:33 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Mon, 7 Jan 2008 05:59:33 -0500 Message-ID: <4782068D.30105@mitre.org> Date: Mon, 07 Jan 2008 06:01:33 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev4 - your thoughts requested... References: <47720011.8010703@bogus.com> <79B18C692AFFBA3BB19746D9@atlantis.pc.cs.cmu.edu> In-Reply-To: <79B18C692AFFBA3BB19746D9@atlantis.pc.cs.cmu.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 07 Jan 2008 10:59:33.0478 (UTC) FILETIME=[6292C860:01C8511C] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Jeffrey Hutzelman wrote: > > --On Tuesday, December 25, 2007 11:17:37 PM -0800 Joel Jaeggli > wrote: > > > The OPSEC WG will document best current practices with regard to network > > security. > > That sounds a quite a bit broader than I think is intended. In > particular, > "with regard to network security" can be read as meaning anything to do > with security of network devices, traffic, nodes attached to the network, > applications running over it, users using it, etc. Perhaps it would be > better to use a more targeted phrase like "with regard to security of > network infrastructure" or something. > > Just my $0.02. > Make that $0.04. ---George Jones _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Jan 07 14:33:34 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBxip-0001Pq-5V; Mon, 07 Jan 2008 14:33:19 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JBxio-0001Oh-DX for opsec@ietf.org; Mon, 07 Jan 2008 14:33:18 -0500 Received: from [2001:418:1::81] (helo=nagasaki.bogus.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JBxio-0007D3-0r for opsec@ietf.org; Mon, 07 Jan 2008 14:33:18 -0500 Received: from [192.103.16.246] ([192.103.16.246]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m07JXHdt075609 for ; Mon, 7 Jan 2008 19:33:17 GMT (envelope-from joelja@bogus.com) Message-ID: <47827E6E.90702@bogus.com> Date: Mon, 07 Jan 2008 11:33:02 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev4 - your thoughts requested... References: <47720011.8010703@bogus.com> <79B18C692AFFBA3BB19746D9@atlantis.pc.cs.cmu.edu> <4782068D.30105@mitre.org> In-Reply-To: <4782068D.30105@mitre.org> X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.91.1/5420/Mon Jan 7 14:34:42 2008 on nagasaki.bogus.com X-Virus-Status: Clean X-Spam-Score: -1.4 (-) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org sorry for the delayed response... I think these are valid points and that another rev is in order. I'd also like to address what work we we have to bring immediately under the character, I have some ideas that currently don't have champions yet. joelja George M Jones wrote: > Jeffrey Hutzelman wrote: >> >> --On Tuesday, December 25, 2007 11:17:37 PM -0800 Joel Jaeggli >> wrote: >> >> > The OPSEC WG will document best current practices with regard to >> network >> > security. >> >> That sounds a quite a bit broader than I think is intended. In >> particular, >> "with regard to network security" can be read as meaning anything to do >> with security of network devices, traffic, nodes attached to the network, >> applications running over it, users using it, etc. Perhaps it would be >> better to use a more targeted phrase like "with regard to security of >> network infrastructure" or something. >> >> Just my $0.02. >> > > Make that $0.04. > > ---George Jones > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 09 17:06:31 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCj3Z-0008MH-8i; Wed, 09 Jan 2008 17:05:53 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCj3W-0008MB-To for opsec@ietf.org; Wed, 09 Jan 2008 17:05:50 -0500 Received: from nagasaki.bogus.com ([147.28.0.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JCj3U-0002yQ-Jx for opsec@ietf.org; Wed, 09 Jan 2008 17:05:50 -0500 Received: from [192.103.16.246] ([192.103.16.246]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m09M5YTM002093; Wed, 9 Jan 2008 22:05:35 GMT (envelope-from joelja@bogus.com) Message-ID: <47854520.3040300@bogus.com> Date: Wed, 09 Jan 2008 14:05:20 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list , Danny McPherson Subject: Re: [OPSEC] charter skeleton rev4 - your thoughts requested... References: <47720011.8010703@bogus.com> In-Reply-To: X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.91.1/5459/Wed Jan 9 16:00:29 2008 on nagasaki.bogus.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Cc: X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Danny McPherson wrote: > >> >> * protocols, tools and technologies extant at the time of >> writing that are used to address the threat, > > Could 'extant' be augmented with envisioned here? Given the > 'Scope' section above, 'proposals for new approaches' are > explicitly within scope. I think the following bullet addresses the possibility that present tools are inadequate... provided of course that the bullets are evaluated on a first match basis... ;) >> * the possibility that a solution does not exist within existing tools >> or technologies. >> New protocol development or requirements work should be addressed in a >> working group chartered in the appropriate area or as individual >> submissions. The OPSEC WG may take on documents related to >> the practices of using such work. > > I think it's perfectly reasonable (desirable?) for OPSEC to provide > requirements to other WGs, be it folks like BMWG or folks designing > protocols. Perhaps the above text should allude to this. I think the comments is related to the above one as well. we were specifically trying to avoid the issue of producing requirements documents that cause implementors to have go work on new features. That was a place where documents under the previous charter got bogged down. While I think the WG should be engaged supporting requirements and features work done elsewhere I don't think it's there that we should be forging a new path. (I'm prepared to be wrong on that)... in my mind for example this might result in something the the bgp ttl hack implementation be in scope while sBGP implementation might not be (until you get ot operational considerations) > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 09 18:47:38 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCkdl-0003QL-Vc; Wed, 09 Jan 2008 18:47:21 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCkdl-0003QF-6D for opsec@ietf.org; Wed, 09 Jan 2008 18:47:21 -0500 Received: from nagasaki.bogus.com ([147.28.0.81]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JCkdk-0004WI-LW for opsec@ietf.org; Wed, 09 Jan 2008 18:47:21 -0500 Received: from [192.103.16.246] ([192.103.16.246]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m09NlGdS006224 for ; Wed, 9 Jan 2008 23:47:17 GMT (envelope-from joelja@bogus.com) Message-ID: <47855CF6.9060104@bogus.com> Date: Wed, 09 Jan 2008 15:47:02 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec@ietf.org X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.91.1/5459/Wed Jan 9 16:00:29 2008 on nagasaki.bogus.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Subject: [OPSEC] charter skeleton rev5 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org This version incorporates comments from: Ron Bonica Danny McPherson Dan Romascanu George Jones ---- Goals: The OPSEC WG will document best current practices with regard to network security. In particular an effort will be made to clarify the rational supporting current operational practice, address gaps in currently understood best practices for forwarding, control plane, and management plane security and make clear the liabilities inherent in security practices where they exist. Scope: The scope of the OPSEC WG is intended to include the protection and secure operation of the forwarding, control and management planes. Documentation of best common practices, revision of existing operational security practices documents and proposals for new approaches to operational challenges are in scope. Method: It is expected that the work product of the working group will fall into the category of best current practices documents. Taxonomy or problem statement documents may provide a basis for best current practices documents. Best Current Practices Document For each topic addressed, a document will be produced that attempts to capture current practices related to secure operation. This will be primarily based on operational experience. Each entry will list: * threats addressed, * current practices for addressing the threat, * protocols, tools and technologies extant at the time of writing that are used to address the threat, * the possibility that a solution does not exist within existing tools or technologies. Taxonomy and Problem Statement Documents A document which attempts to describe the scope of particular operational security challenge or problem space without necessarily coming to a conclusion or proposing a solution. Such a document might be a precursor to a best common practices document. While the principal input of the Working Group are operational experience and needs, the output should be directed both to provide guidance to the operators community as well as to Working Groups that develop protocols or the community of protocol developers at large, as well as to the implementers of these protocols. Non-Goals: The Operations security working group is not the place to do new protocols or requirements documents. New protocol development or requirements work should be addressed in a working group chartered in the appropriate area or as individual submissions. The OPSEC WG may take on documents related to the practices of using such work. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 06:13:52 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCvM2-0001GE-Hi; Thu, 10 Jan 2008 06:13:46 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCvM1-0001Dg-Ek for opsec@ietf.org; Thu, 10 Jan 2008 06:13:45 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JCvM1-0004Ti-6W for opsec@ietf.org; Thu, 10 Jan 2008 06:13:45 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0ABDiEI002105 for ; Thu, 10 Jan 2008 06:13:44 -0500 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0ABDig8002102 for ; Thu, 10 Jan 2008 06:13:44 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 06:13:44 -0500 Message-ID: <4785FE75.6040502@mitre.org> Date: Thu, 10 Jan 2008 06:16:05 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com> In-Reply-To: <47855CF6.9060104@bogus.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 10 Jan 2008 11:13:44.0549 (UTC) FILETIME=[DD172950:01C85379] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org rev5 looks good. Now I think we need to try to flesh it out with 3-4 proposed documents to see if it works. ---George Jones _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 09:44:52 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCye2-0003Cx-Om; Thu, 10 Jan 2008 09:44:34 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCye1-0003Cr-NE for opsec@ietf.org; Thu, 10 Jan 2008 09:44:33 -0500 Received: from exprod7og103.obsmtp.com ([64.18.2.159]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JCye0-0008Pj-4w for opsec@ietf.org; Thu, 10 Jan 2008 09:44:33 -0500 Received: from source ([66.129.224.36]) by exprod7ob103.postini.com ([64.18.6.12]) with SMTP; Thu, 10 Jan 2008 06:44:11 PST Received: from proton.jnpr.net ([10.10.2.37]) by gamma.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 06:43:31 -0800 Received: from [172.23.1.65] ([172.23.1.65] RDNS failed) by proton.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 09:43:31 -0500 Message-ID: <47862F0E.9060407@juniper.net> Date: Thu, 10 Jan 2008 09:43:26 -0500 From: Ron Bonica User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> In-Reply-To: <4785FE75.6040502@mitre.org> X-Enigmail-Version: 0.93.0.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 10 Jan 2008 14:43:32.0091 (UTC) FILETIME=[2BD9A4B0:01C85397] X-Spam-Score: -4.0 (----) X-Scan-Signature: d6b246023072368de71562c0ab503126 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org I agree. Once we have done that, I will take it to the IESG. Ron George M Jones wrote: > rev5 looks good. > > Now I think we need to try to flesh it out with 3-4 proposed documents > to see if it works. > > ---George Jones > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 11:39:23 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD0R5-00074N-Mj; Thu, 10 Jan 2008 11:39:19 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD0R5-00074C-2p for opsec@ietf.org; Thu, 10 Jan 2008 11:39:19 -0500 Received: from monster.hopcount.ca ([199.212.90.4]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JD0R3-0003NR-4R for opsec@ietf.org; Thu, 10 Jan 2008 11:39:18 -0500 Received: from [199.212.90.22] (helo=yxu1a22.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JD0R0-000AV0-1o for opsec@ietf.org; Thu, 10 Jan 2008 16:39:14 +0000 Message-Id: From: Joe Abley To: opsec wg mailing list In-Reply-To: <47862F0E.9060407@juniper.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [OPSEC] charter skeleton rev5 Date: Thu, 10 Jan 2008 11:39:11 -0500 References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On 10-Jan-2008, at 09:43, Ron Bonica wrote: > I agree. Once we have done that, I will take it to the IESG. Apologies for my extensive silence on this thread. Sick children, =20 vacation detox, etc. R=FCdiger Volk and I have been talking for some time about writing up a =20= way for customers to signal their desire to send blackhole routes to =20 their ISPs (long-prefix routes with particular community string =20 attributes which cause traffic with destinations covered by the route =20= to be null-routed upstream of the customer). The mechanism that R=FCdi =20= devised used RPSL/RPSS. If the wg (with more details) found such a =20 thing to be relevant to this charter, we could probably pick that up =20 here. There was some earlier talk about writing up some best practices =20 relating to ICMP filtering, I believe? Joe= _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 12:22:46 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD173-0004aT-Lw; Thu, 10 Jan 2008 12:22:41 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD172-0004aO-TN for opsec@ietf.org; Thu, 10 Jan 2008 12:22:40 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD172-0000Fd-Gx for opsec@ietf.org; Thu, 10 Jan 2008 12:22:40 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0AHMdcH007696 for ; Thu, 10 Jan 2008 12:22:40 -0500 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0AHMdZN007693 for ; Thu, 10 Jan 2008 12:22:39 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 12:22:39 -0500 Message-ID: <478654EE.2080403@mitre.org> Date: Thu, 10 Jan 2008 12:25:02 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 10 Jan 2008 17:22:39.0661 (UTC) FILETIME=[66A535D0:01C853AD] X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Joe Abley wrote: > > > > > There was some earlier talk about writing up some best practices > relating to ICMP filtering, I believe? > I took a stab at starting something http://www3.tools.ietf.org/wg/opsec/trac/wiki/ICMP%20Filtering It's a wiki. Other people are welcome/encouraged to contribute. I am going to poke a few people who have done some writing on the subject to see if anyone wants to be the "editor" (e.g. filter what everyone does to the Wiki). ---George _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 12:52:10 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD1ZX-0005Cq-K6; Thu, 10 Jan 2008 12:52:07 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD1ZW-0005AK-Ly for opsec@ietf.org; Thu, 10 Jan 2008 12:52:06 -0500 Received: from [2001:418:1::81] (helo=nagasaki.bogus.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JD1ZW-0004gP-6K for opsec@ietf.org; Thu, 10 Jan 2008 12:52:06 -0500 Received: from [192.103.16.246] ([192.103.16.246]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m0AHq59a053347 for ; Thu, 10 Jan 2008 17:52:05 GMT (envelope-from joelja@bogus.com) Message-ID: <47865B36.4080307@bogus.com> Date: Thu, 10 Jan 2008 09:51:50 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> In-Reply-To: X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.91.1/5470/Thu Jan 10 14:49:37 2008 on nagasaki.bogus.com X-Virus-Status: Clean Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by nagasaki.bogus.com id m0AHq59a053347 X-Spam-Score: -1.4 (-) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Joe Abley wrote: >=20 > On 10-Jan-2008, at 09:43, Ron Bonica wrote: >=20 >> I agree. Once we have done that, I will take it to the IESG. >=20 > Apologies for my extensive silence on this thread. Sick children, > vacation detox, etc. >=20 > R=FCdiger Volk and I have been talking for some time about writing up a > way for customers to signal their desire to send blackhole routes to > their ISPs (long-prefix routes with particular community string > attributes which cause traffic with destinations covered by the route t= o > be null-routed upstream of the customer). The mechanism that R=FCdi > devised used RPSL/RPSS. If the wg (with more details) found such a thin= g > to be relevant to this charter, we could probably pick that up here. >=20 > There was some earlier talk about writing up some best practices > relating to ICMP filtering, I believe? There is also tina bird's effort to produce a taxonomy of events that should be logged. I don't think all of it is in scope for this working group (end systems) but some of it likely is. >=20 > Joe > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 13:31:41 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2Bk-0001e3-Ja; Thu, 10 Jan 2008 13:31:36 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2Bj-0001dy-PX for opsec@ietf.org; Thu, 10 Jan 2008 13:31:35 -0500 Received: from aharp.ittns.northwestern.edu ([129.105.153.69]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD2Bj-0001kE-GS for opsec@ietf.org; Thu, 10 Jan 2008 13:31:35 -0500 Received: from dsl017-022-071.chi1.dsl.speakeasy.net (aharp [127.0.0.1]) by aharp.ittns.northwestern.edu (smtpd) with SMTP id 10222136C82 for ; Thu, 10 Jan 2008 12:31:35 -0600 (CST) Date: Thu, 10 Jan 2008 12:31:34 -0600 From: John Kristoff To: opsec wg mailing list Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <478654EE.2080403@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> X-Mailer: Sylpheed version 2.2.2 (GTK+ 2.8.12; i386-apple-darwin8.5.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20080110183135.10222136C82@aharp.ittns.northwestern.edu> X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On Thu, 10 Jan 2008 12:25:02 -0500 George M Jones wrote: > It's a wiki. Other people are welcome/encouraged to contribute. My standard advice is to by default allow a subset of ICMP types (all codes), local rate limit policies CAN be used, but should not be set by default: icmp type 0 (echo reply) icmp type 3 (destination unreachable) icmp type 8 (echo) icmp type 11 (time exceeded) icmp type 12 (parameter problem) On hosts and some networks I've configured, I've filtered all others, but that may not be a good universal default. Perhaps for certain end hosts or certain types of devices it may be. I've also implemented rate limits for allowed ICMP types. I've had good luck in not running into trouble doing that, but again it probably shouldn't be the default. I tended to set a global ingress subnet of approximately /24 maximum hosts to about 2% of the max router interface bit rate for all ICMP. John _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 13:40:26 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2KH-0007kD-Nc; Thu, 10 Jan 2008 13:40:25 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2KH-0007k8-51 for opsec@ietf.org; Thu, 10 Jan 2008 13:40:25 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD2KG-0001sQ-Q4 for opsec@ietf.org; Thu, 10 Jan 2008 13:40:25 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0AIeOOD001566 for ; Thu, 10 Jan 2008 13:40:24 -0500 Received: from IMCFE1.MITRE.ORG (imcfe1.mitre.org [129.83.29.3]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0AIeO9G001563 for ; Thu, 10 Jan 2008 13:40:24 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by IMCFE1.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 13:40:23 -0500 Message-ID: <47866727.3040401@mitre.org> Date: Thu, 10 Jan 2008 13:42:47 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org> <20080110183135.10222136C82@aharp.ittns.northwestern.edu> In-Reply-To: <20080110183135.10222136C82@aharp.ittns.northwestern.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 10 Jan 2008 18:40:24.0006 (UTC) FILETIME=[42CFC660:01C853B8] X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org John Kristoff wrote: > > On Thu, 10 Jan 2008 12:25:02 -0500 > George M Jones wrote: > > > It's a wiki. Other people are welcome/encouraged to contribute. > > My standard advice > Go edit the wiki ! Maybe add this to an "experiences" section ? > > is to by default allow a subset of ICMP types (all > codes), local rate limit policies CAN be used, but should not be set > by default: > > icmp type 0 (echo reply) > icmp type 3 (destination unreachable) > icmp type 8 (echo) > icmp type 11 (time exceeded) > icmp type 12 (parameter problem) > > On hosts and some networks I've configured, I've filtered all others, > but that may not be a good universal default. Perhaps for certain end > hosts or certain types of devices it may be. I've also implemented > rate limits for allowed ICMP types. I've had good luck in not running > into trouble doing that, but again it probably shouldn't be the default. > I tended to set a global ingress subnet of approximately /24 maximum > hosts to about 2% of the max router interface bit rate for all ICMP. > Add a section/advice on rate limiting ? ---George _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 13:43:21 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2N3-0003u3-Vg; Thu, 10 Jan 2008 13:43:17 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2N2-0003tN-Jn for opsec@ietf.org; Thu, 10 Jan 2008 13:43:16 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD2N0-0001u1-CK for opsec@ietf.org; Thu, 10 Jan 2008 13:43:16 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 377E05A8AA5 for ; Thu, 10 Jan 2008 16:42:30 -0200 (ARDT) Received: from notebook.gont.com.ar (201-254-46-178.speedy.com.ar [201.254.46.178] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0AIgOjo031078 for ; Thu, 10 Jan 2008 16:42:25 -0200 Message-Id: <200801101842.m0AIgOjo031078@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 10 Jan 2008 15:42:11 -0200 To: opsec wg mailing list From: Fernando Gont Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <478654EE.2080403@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Thu, 10 Jan 2008 16:42:28 -0200 (ARDT) X-Spam-Score: 0.8 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 03:25 p.m. 10/01/2008, George M Jones wrote: >I took a stab at starting something > > http://www3.tools.ietf.org/wg/opsec/trac/wiki/ICMP%20Filtering > >It's a wiki. Other people are welcome/encouraged to contribute. > >I am going to poke a few people who have done some writing on the >subject to see if anyone wants to be the "editor" (e.g. filter what >everyone does to the Wiki). I'd be glad to volunteer. I have authored the "ICMP attacks against TCP" (draft-ietf-tcpm-icmp-attacks) and "TCP's reaction to soft errors" (draft-ietf-tcp-soft-errors) of the TCPM WG, and have co-authored a (yet unpublished) "ICMP roadmap" IETF draft. Have also helped with NISCC VU#532967. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 13:49:00 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2SY-0007i7-F0; Thu, 10 Jan 2008 13:48:58 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2SX-0007i2-Kz for opsec@ietf.org; Thu, 10 Jan 2008 13:48:57 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD2SX-00020W-4U for opsec@ietf.org; Thu, 10 Jan 2008 13:48:57 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 1FF425A8AAA for ; Thu, 10 Jan 2008 16:48:56 -0200 (ARDT) Received: from notebook.gont.com.ar (201-254-46-178.speedy.com.ar [201.254.46.178] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0AImonW001387 for ; Thu, 10 Jan 2008 16:48:52 -0200 Message-Id: <200801101848.m0AImonW001387@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 10 Jan 2008 15:48:34 -0200 To: opsec wg mailing list From: Fernando Gont Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <47866727.3040401@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <20080110183135.10222136C82@aharp.ittns.northwestern.edu> <47866727.3040401@mitre.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Thu, 10 Jan 2008 16:48:55 -0200 (ARDT) X-Spam-Score: 0.8 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 04:42 p.m. 10/01/2008, you wrote: >>is to by default allow a subset of ICMP types (all >>codes), local rate limit policies CAN be used, but should not be set >>by default: >> >> icmp type 0 (echo reply) >> icmp type 3 (destination unreachable) >> icmp type 8 (echo) >> icmp type 11 (time exceeded) >> icmp type 12 (parameter problem) It might make sense sense to include some recommendations for stateful firewalls. (e.g., any ICMP message meant for a TCP connection should have an entry in the state-table of the firewall). IIRC, some firewalls (e.g., OpenBSD's PF) even check the embedded TCP sequence number and let the ICMP error through only if it's within the receive window. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 14:14:10 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2qt-0004Rw-Pd; Thu, 10 Jan 2008 14:14:07 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD2qs-0004Rr-JO for opsec@ietf.org; Thu, 10 Jan 2008 14:14:06 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JD2qo-0005rO-O7 for opsec@ietf.org; Thu, 10 Jan 2008 14:14:06 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 313E65A7461 for ; Thu, 10 Jan 2008 17:14:01 -0200 (ARDT) Received: from notebook.gont.com.ar (201-254-46-178.speedy.com.ar [201.254.46.178] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0AJDpQi026181 for ; Thu, 10 Jan 2008 17:13:53 -0200 Message-Id: <200801101913.m0AJDpQi026181@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 10 Jan 2008 16:12:44 -0200 To: opsec wg mailing list From: Fernando Gont Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <47866727.3040401@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <20080110183135.10222136C82@aharp.ittns.northwestern.edu> <47866727.3040401@mitre.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Thu, 10 Jan 2008 17:13:58 -0200 (ARDT) X-Spam-Score: 1.9 (+) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 04:42 p.m. 10/01/2008, you wrote: >Add a section/advice on rate limiting ? BTW, this might be of interest: http://www.gont.com.ar/papers/filtering-of-icmp-error-messages.pdf . It describes ingress- and egress-filtering of ICMP error messages. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 16:09:06 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD4e3-0000ho-Vn; Thu, 10 Jan 2008 16:08:59 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD4e2-0000hb-ML for opsec@ietf.org; Thu, 10 Jan 2008 16:08:58 -0500 Received: from suomp64i.qwest.com ([155.70.16.237]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JD4e2-00057T-81 for opsec@ietf.org; Thu, 10 Jan 2008 16:08:58 -0500 Received: from suomp60i.qintra.com (suomp60i.qintra.com [151.117.69.27]) by suomp64i.qwest.com (8.14.0/8.14.0) with ESMTP id m0AL8vCo016243 for ; Thu, 10 Jan 2008 15:08:57 -0600 (CST) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp60i.qintra.com (8.14.0/8.14.0) with ESMTP id m0AL8i1v016234 for ; Thu, 10 Jan 2008 15:08:52 -0600 (CST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Jan 2008 14:08:49 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Date: Thu, 10 Jan 2008 14:08:49 -0700 Message-ID: In-Reply-To: <200801101848.m0AImonW001387@venus.xmundo.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Importance: normal thread-index: AchTuXd8JuwHEgmPRsSxPHddES5rYwAARsqg Priority: normal References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org><20080110183135.10222136C82@aharp.ittns.northwestern.edu><47866727.3040401@mitre.org> <200801101848.m0AImonW001387@venus.xmundo.net> From: "Smith, Donald" To: "opsec wg mailing list" X-OriginalArrivalTime: 10 Jan 2008 21:08:49.0729 (UTC) FILETIME=[FF094310:01C853CC] X-Spam-Score: 0.0 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org If I understood it correctly this groups charter it is for network operations aka ISPs or SPs. In general network operators do not run statefull firewalls in front of their network elements. If this is going to be applied to enterprise networks then I would agree.=20 Security through obscurity WORKS against some worms and other tools:) Donald.Smith@qwest.com giac > -----Original Message----- > From: Fernando Gont [mailto:fernando@gont.com.ar]=20 > Sent: Thursday, January 10, 2008 10:49 AM > To: opsec wg mailing list > Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) >=20 > At 04:42 p.m. 10/01/2008, you wrote: >=20 > >>is to by default allow a subset of ICMP types (all > >>codes), local rate limit policies CAN be used, but should not be set > >>by default: > >> > >> icmp type 0 (echo reply) > >> icmp type 3 (destination unreachable) > >> icmp type 8 (echo) > >> icmp type 11 (time exceeded) > >> icmp type 12 (parameter problem) >=20 > It might make sense sense to include some recommendations for=20 > stateful firewalls. (e.g., any ICMP message meant for a TCP=20 > connection should have an entry in the state-table of the firewall).=20 > IIRC, some firewalls (e.g., OpenBSD's PF) even check the embedded TCP=20 > sequence number and let the ICMP error through only if it's within=20 > the receive window. >=20 > Kind regards, >=20 > -- > Fernando Gont > e-mail: fernando@gont.com.ar || fgont@acm.org > PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 This communication is the property of Qwest and may contain confidential = or privileged information. Unauthorized use of this communication is = strictly=20 prohibited and may be unlawful. If you have received this communication = in error, please immediately notify the sender by reply e-mail and = destroy=20 all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 10 16:22:55 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD4rV-0001Vt-MI; Thu, 10 Jan 2008 16:22:53 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JD4rU-0001Vn-EP for opsec@ietf.org; Thu, 10 Jan 2008 16:22:52 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JD4rS-00080J-My for opsec@ietf.org; Thu, 10 Jan 2008 16:22:52 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 7038F5A7461 for ; Thu, 10 Jan 2008 19:22:53 -0200 (ARDT) Received: from notebook.gont.com.ar (201-254-46-178.speedy.com.ar [201.254.46.178] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0ALMlHG017238 for ; Thu, 10 Jan 2008 19:22:49 -0200 Message-Id: <200801102122.m0ALMlHG017238@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 10 Jan 2008 18:18:26 -0200 To: opsec wg mailing list From: Fernando Gont Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <20080110183135.10222136C82@aharp.ittns.northwestern.edu> <47866727.3040401@mitre.org> <200801101848.m0AImonW001387@venus.xmundo.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Thu, 10 Jan 2008 19:22:52 -0200 (ARDT) X-Spam-Score: 1.9 (+) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 07:08 p.m. 10/01/2008, you wrote: >If I understood it correctly this groups charter it is for network >operations aka ISPs or SPs. Didn't check the charter... just thinking out loud. But given that there's no other RFC on ICMP filtering, it might be worthwhile considering adding some text on the subject. (It's up to the group, though). >Security through obscurity WORKS against some worms and other tools:) ? Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Jan 11 16:36:46 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDRYF-0005cq-As; Fri, 11 Jan 2008 16:36:31 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDRYE-0005ci-7y for opsec@ietf.org; Fri, 11 Jan 2008 16:36:30 -0500 Received: from suomp64i.qwest.com ([155.70.16.237]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JDRYB-0005fb-Us for opsec@ietf.org; Fri, 11 Jan 2008 16:36:30 -0500 Received: from sudnp796.qintra.com (sudnp796.qintra.com [151.116.2.212]) by suomp64i.qwest.com (8.14.0/8.14.0) with ESMTP id m0BLaRWo025703 for ; Fri, 11 Jan 2008 15:36:27 -0600 (CST) Received: from ITDENE2KSM01.AD.QINTRA.COM (localhost [127.0.0.1]) by sudnp796.qintra.com (8.14.0/8.14.0) with ESMTP id m0BLaMT4011565 for ; Fri, 11 Jan 2008 14:36:22 -0700 (MST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM01.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Fri, 11 Jan 2008 14:36:22 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [OPSEC] charter skeleton rev5 Date: Fri, 11 Jan 2008 14:36:21 -0700 Message-ID: In-Reply-To: <47855CF6.9060104@bogus.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] charter skeleton rev5 thread-index: AchTGgScSnWc+a2wS7uaGqWl2OSw/wBfQ7JQ Importance: normal Priority: normal References: <47855CF6.9060104@bogus.com> From: "Smith, Donald" To: "opsec wg mailing list" X-OriginalArrivalTime: 11 Jan 2008 21:36:22.0136 (UTC) FILETIME=[025C4F80:01C8549A] X-Spam-Score: 0.0 (/) X-Scan-Signature: 67c1ea29f88502ef6a32ccec927970f0 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org I thought at one point this charter included scoping that addressed type of network specifically ISP vs enterprise. SP networks tend to be more complex, larger and carry more protocols then an enterprise network. I think there are major differences between the two especially from a security pov. =20 01100101000010|10011010111101? Hint 7 bit ascii Donald.Smith@qwest.com giac=20 > -----Original Message----- > From: Joel Jaeggli [mailto:joelja@bogus.com]=20 > Sent: Wednesday, January 09, 2008 4:47 PM > To: opsec@ietf.org > Subject: [OPSEC] charter skeleton rev5=20 >=20 > This version incorporates comments from: >=20 > Ron Bonica > Danny McPherson > Dan Romascanu > George Jones >=20 >=20 > ---- >=20 > Goals: >=20 > The OPSEC WG will document best current practices with regard=20 > to network > security. In particular an effort will be made to clarify the rational > supporting current operational practice, address gaps in currently > understood best practices for forwarding, control plane, and=20 > management > plane security and make clear the liabilities inherent in security > practices where they exist. >=20 > Scope: >=20 > The scope of the OPSEC WG is intended to include the protection and > secure operation of the forwarding, control and management planes. >=20 > Documentation of best common practices, revision of existing=20 > operational > security practices documents and proposals for new approaches to > operational challenges are in scope. >=20 > Method: >=20 > It is expected that the work product of the working group will > fall into the category of best current practices documents.=20 > Taxonomy or > problem statement documents may provide a basis for best current > practices documents. >=20 > Best Current Practices Document >=20 > For each topic addressed, a document will be produced that attempts to > capture current practices related to secure operation. This will be > primarily based on operational experience. Each entry will list: >=20 > * threats addressed, >=20 > * current practices for addressing the threat, >=20 > * protocols, tools and technologies extant at the time of =09 > writing that are used to address the threat, >=20 > * the possibility that a solution does not exist within existing tools > or technologies. >=20 > Taxonomy and Problem Statement Documents >=20 > A document which attempts to describe the scope of particular > operational security challenge or problem space without necessarily > coming to a conclusion or proposing a solution. Such a=20 > document might be > a precursor to a best common practices document. >=20 > While the principal input of the Working Group are operational > experience and needs, the output should be directed both to provide > guidance to the operators community as well as to Working Groups that > develop protocols or the community of protocol developers at large, as > well as to the implementers of these protocols. >=20 > Non-Goals: >=20 > The Operations security working group is not the place to do new > protocols or requirements documents. >=20 > New protocol development or requirements work should be addressed in a > working group chartered in the appropriate area or as individual > submissions. The OPSEC WG may take on documents related to > the practices of using such work. >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 This communication is the property of Qwest and may contain confidential = or privileged information. Unauthorized use of this communication is = strictly=20 prohibited and may be unlawful. If you have received this communication = in error, please immediately notify the sender by reply e-mail and = destroy=20 all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Jan 11 16:57:28 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDRsS-0003DM-0j; Fri, 11 Jan 2008 16:57:24 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDRsQ-0003DH-Mu for opsec@ietf.org; Fri, 11 Jan 2008 16:57:22 -0500 Received: from monster.hopcount.ca ([199.212.90.4]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JDRsQ-00042M-AG for opsec@ietf.org; Fri, 11 Jan 2008 16:57:22 -0500 Received: from [199.212.90.22] (helo=yxu1a22.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JDRsP-0002Sv-E2 for opsec@ietf.org; Fri, 11 Jan 2008 21:57:21 +0000 Message-Id: <94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> From: Joe Abley To: opsec wg mailing list In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [OPSEC] charter skeleton rev5 Date: Fri, 11 Jan 2008 16:57:20 -0500 References: <47855CF6.9060104@bogus.com> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On 11-Jan-2008, at 16:36, Smith, Donald wrote: > I thought at one point this charter included scoping that addressed > type > of network specifically ISP vs enterprise. > > SP networks tend to be more complex, larger and carry more protocols > then an enterprise network. Amusingly, this is precisely the reverse of what I have always thought. In past lives I have had to wrangle enterprise networks in which SNA, SMB, IPX/SIX and IP traffic had to coexist, all at high (for the time) speeds, through a mixture of ethernet and token ring with corresponding MTU hilarity. By comparison the ISP/carrier networks I dealt with at the same time were all much lower speed, mono-protocol affairs which were much easier to debug and manage. I've not had a reason to meddle in the fairs of an enterprise network for about 10 years, so it certainly wouldn't surprise me to find out that the situation today is reversed. But I still find it amusing. :-) Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Jan 11 17:38:55 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDSWT-0008Aa-LG; Fri, 11 Jan 2008 17:38:45 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDSWS-0008AQ-Lw for opsec@ietf.org; Fri, 11 Jan 2008 17:38:44 -0500 Received: from sudnp799.qwest.com ([155.70.32.99]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JDSWS-0004tm-57 for opsec@ietf.org; Fri, 11 Jan 2008 17:38:44 -0500 Received: from sudnp796.qintra.com (sudnp796.qintra.com [151.116.2.212]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m0BMch2S017747 for ; Fri, 11 Jan 2008 15:38:43 -0700 (MST) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by sudnp796.qintra.com (8.14.0/8.14.0) with ESMTP id m0BMcb6W004720 for ; Fri, 11 Jan 2008 15:38:38 -0700 (MST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Fri, 11 Jan 2008 15:38:37 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [OPSEC] charter skeleton rev5 Date: Fri, 11 Jan 2008 15:38:36 -0700 Message-ID: In-Reply-To: <94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] charter skeleton rev5 thread-index: AchUnPU6gG23BVfyQu2U2PFn2PJNQQAA0HtA Importance: normal Priority: normal References: <47855CF6.9060104@bogus.com> <94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> From: "Smith, Donald" To: "opsec wg mailing list" X-OriginalArrivalTime: 11 Jan 2008 22:38:37.0578 (UTC) FILETIME=[B4DB86A0:01C854A2] X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org I too worked on some complex enterprise networks so I will concede that some enterprise networks are very complex:) Most enterprises can block protocols that they don't need especially at the network edges while most ISP can not block any of the 256 ip protocols. ISPs tend to run more routing protocols. ISPs don't usually have stateful firewalls protecting them from the internet. There are of course exceptions to all of the above statements. Regardless, this question remains. Is this work expected to address both enterprise and ISP type networks? 01100101000010|10011010111101? Hint 7 bit ascii Donald.Smith@qwest.com giac=20 > -----Original Message----- > From: Joe Abley [mailto:jabley@ca.afilias.info]=20 > Sent: Friday, January 11, 2008 2:57 PM > To: opsec wg mailing list > Subject: Re: [OPSEC] charter skeleton rev5=20 >=20 >=20 > On 11-Jan-2008, at 16:36, Smith, Donald wrote: >=20 > > I thought at one point this charter included scoping that=20 > addressed =20 > > type > > of network specifically ISP vs enterprise. > > > > SP networks tend to be more complex, larger and carry more protocols > > then an enterprise network. >=20 > Amusingly, this is precisely the reverse of what I have=20 > always thought. >=20 > In past lives I have had to wrangle enterprise networks in=20 > which SNA, =20 > SMB, IPX/SIX and IP traffic had to coexist, all at high (for=20 > the time) =20 > speeds, through a mixture of ethernet and token ring with =20 > corresponding MTU hilarity. By comparison the ISP/carrier networks I =20 > dealt with at the same time were all much lower speed, mono-protocol =20 > affairs which were much easier to debug and manage. >=20 > I've not had a reason to meddle in the fairs of an enterprise=20 > network =20 > for about 10 years, so it certainly wouldn't surprise me to find out =20 > that the situation today is reversed. But I still find it amusing. :-) >=20 >=20 > Joe >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 This communication is the property of Qwest and may contain confidential = or privileged information. Unauthorized use of this communication is = strictly=20 prohibited and may be unlawful. If you have received this communication = in error, please immediately notify the sender by reply e-mail and = destroy=20 all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Jan 11 17:41:41 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDSZJ-0004Td-41; Fri, 11 Jan 2008 17:41:41 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JDSZH-0004Sr-E3 for opsec@ietf.org; Fri, 11 Jan 2008 17:41:39 -0500 Received: from monster.hopcount.ca ([199.212.90.4]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JDSZF-0006b0-8W for opsec@ietf.org; Fri, 11 Jan 2008 17:41:39 -0500 Received: from [199.212.90.22] (helo=yxu1a22.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JDSZC-0002wM-7P for opsec@ietf.org; Fri, 11 Jan 2008 22:41:36 +0000 Message-Id: From: Joe Abley To: opsec wg mailing list In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v915) Subject: Re: [OPSEC] charter skeleton rev5 Date: Fri, 11 Jan 2008 17:41:33 -0500 References: <47855CF6.9060104@bogus.com> <94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> X-Mailer: Apple Mail (2.915) X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On 11-Jan-2008, at 17:38, Smith, Donald wrote: > Regardless, this question remains. Is this work expected to address > both > enterprise and ISP type networks? I think our target market consists mainly of ISPs. I say "mainly" because I'm quite sure that there are enterprises whose networks look very much like those of service providers, and vice versa. I don't know to define what a "service provider network" is, and I'm not sure that we want to bother. Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Jan 13 16:31:18 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JEAQ7-00022R-SU; Sun, 13 Jan 2008 16:31:07 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JEAQ6-0001qG-T3 for opsec@ietf.org; Sun, 13 Jan 2008 16:31:06 -0500 Received: from [2001:418:1::81] (helo=nagasaki.bogus.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JEAQ6-0005d1-Cp for opsec@ietf.org; Sun, 13 Jan 2008 16:31:06 -0500 Received: from [192.168.88.109] (adsl-76-203-75-173.dsl.pltn13.sbcglobal.net [76.203.75.173]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m0DLV5H8048418 for ; Sun, 13 Jan 2008 21:31:05 GMT (envelope-from joelja@bogus.com) Message-ID: <478A8318.80605@bogus.com> Date: Sun, 13 Jan 2008 13:31:04 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com> <94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> In-Reply-To: X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.91.1/5481/Sun Jan 13 18:04:16 2008 on nagasaki.bogus.com X-Virus-Status: Clean X-Spam-Score: -1.4 (-) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Smith, Donald wrote: > I too worked on some complex enterprise networks so I will concede that > some enterprise networks are very complex:) > > Most enterprises can block protocols that they don't need especially at > the network edges while most ISP can not block any of the 256 ip > protocols. > > ISPs tend to run more routing protocols. > ISPs don't usually have stateful firewalls protecting them from the > internet. > > There are of course exceptions to all of the above statements. > > Regardless, this question remains. Is this work expected to address both > enterprise and ISP type networks? There are some issues with enterprise networks that are probably pretty clearly out of scope for this working group. How people deploy network access controls or what you dpi/ips sensor should be looking for example. The protection of network infrastructure is clearly relevant to the needs of enterprise network operators however. > 01100101000010|10011010111101? > Hint 7 bit ascii > Donald.Smith@qwest.com giac > >> -----Original Message----- >> From: Joe Abley [mailto:jabley@ca.afilias.info] >> Sent: Friday, January 11, 2008 2:57 PM >> To: opsec wg mailing list >> Subject: Re: [OPSEC] charter skeleton rev5 >> >> >> On 11-Jan-2008, at 16:36, Smith, Donald wrote: >> >>> I thought at one point this charter included scoping that >> addressed >>> type >>> of network specifically ISP vs enterprise. >>> >>> SP networks tend to be more complex, larger and carry more protocols >>> then an enterprise network. >> Amusingly, this is precisely the reverse of what I have >> always thought. >> >> In past lives I have had to wrangle enterprise networks in >> which SNA, >> SMB, IPX/SIX and IP traffic had to coexist, all at high (for >> the time) >> speeds, through a mixture of ethernet and token ring with >> corresponding MTU hilarity. By comparison the ISP/carrier networks I >> dealt with at the same time were all much lower speed, mono-protocol >> affairs which were much easier to debug and manage. >> >> I've not had a reason to meddle in the fairs of an enterprise >> network >> for about 10 years, so it certainly wouldn't surprise me to find out >> that the situation today is reversed. But I still find it amusing. :-) >> >> >> Joe >> >> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www1.ietf.org/mailman/listinfo/opsec >> > > > This communication is the property of Qwest and may contain confidential or > privileged information. Unauthorized use of this communication is strictly > prohibited and may be unlawful. If you have received this communication > in error, please immediately notify the sender by reply e-mail and destroy > all copies of the communication and any attachments. > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Jan 14 12:56:48 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JETY3-0006Id-VP; Mon, 14 Jan 2008 12:56:35 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JETY3-0006H9-It for opsec@ietf.org; Mon, 14 Jan 2008 12:56:35 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JETY3-0000qW-99 for opsec@ietf.org; Mon, 14 Jan 2008 12:56:35 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0EHuYJN006304 for ; Mon, 14 Jan 2008 12:56:34 -0500 Received: from imcfe2.MITRE.ORG (imcfe2.mitre.org [129.83.29.4]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0EHuY86006300 for ; Mon, 14 Jan 2008 12:56:34 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by imcfe2.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 Jan 2008 12:56:34 -0500 Message-ID: <478BA2ED.1090409@mitre.org> Date: Mon, 14 Jan 2008 12:59:09 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com><94DEC4C9-1ECE-4FD7-830C-87E516522593@ca.afilias.info> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 14 Jan 2008 17:56:34.0570 (UTC) FILETIME=[CD32AEA0:01C856D6] X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Joe Abley wrote: > > On 11-Jan-2008, at 17:38, Smith, Donald wrote: > > > Regardless, this question remains. Is this work expected to address > > both > > enterprise and ISP type networks? > > I think our target market consists mainly of ISPs. > > I say "mainly" because I'm quite sure that there are enterprises whose > networks look very much like those of service providers, and vice versa. > > I don't know to define what a "service provider network" is, and I'm > not sure that we want to bother. > We spent a lot of time on this. I think we came down on the side of limiting scope to devices providing transit services. You need at least some rule of thumb to allow you to make semi-objective calls on what's in and what's out of scope. Are web proxies that provide anti-virus scanning out of scope ? Why ? It's a "best" current security practice related to internet security. ---George Jones _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 16 03:01:08 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JF3Cf-0006Rk-BC; Wed, 16 Jan 2008 03:00:53 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JF3Ce-0006Rd-9g for opsec@ietf.org; Wed, 16 Jan 2008 03:00:52 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JF3Cd-0001rl-P6 for opsec@ietf.org; Wed, 16 Jan 2008 03:00:52 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 194415A8A8C for ; Wed, 16 Jan 2008 06:00:15 -0200 (ARDT) Received: from notebook.gont.com.ar (168-226-21-194.speedy.com.ar [168.226.21.194] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0G807Zc002605 for ; Wed, 16 Jan 2008 06:00:12 -0200 Message-Id: <200801160800.m0G807Zc002605@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 16 Jan 2008 05:54:45 -0200 To: opsec wg mailing list From: Fernando Gont Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <478654EE.2080403@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Wed, 16 Jan 2008 06:00:12 -0200 (ARDT) X-Spam-Score: 0.8 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 04:25 p.m. 10/01/2008, George M Jones wrote: >I took a stab at starting something > > http://www3.tools.ietf.org/wg/opsec/trac/wiki/ICMP%20Filtering > >It's a wiki. Other people are welcome/encouraged to contribute. > >I am going to poke a few people who have done some writing on the >subject to see if anyone wants to be the "editor" (e.g. filter what >everyone does to the Wiki). Would it make sense if I prepare and publsh a draft on the subject. (Much of the work is already done for other drafts I have work on on several issues about ICMP). Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 16 09:07:55 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JF8rJ-0006qT-FU; Wed, 16 Jan 2008 09:03:13 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JF8rI-0006m7-AG for opsec@ietf.org; Wed, 16 Jan 2008 09:03:12 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JF8rC-0003SJ-Uz for opsec@ietf.org; Wed, 16 Jan 2008 09:03:07 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0GE36V5032397 for ; Wed, 16 Jan 2008 09:03:06 -0500 Received: from imcfe2.MITRE.ORG (imcfe2.mitre.org [129.83.29.4]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0GE36AK032389 for ; Wed, 16 Jan 2008 09:03:06 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by imcfe2.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Wed, 16 Jan 2008 09:03:05 -0500 Message-ID: <478E0F38.9080904@mitre.org> Date: Wed, 16 Jan 2008 09:05:44 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> In-Reply-To: <200801160800.m0G807Zc002605@venus.xmundo.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 16 Jan 2008 14:03:05.0924 (UTC) FILETIME=[84387040:01C85848] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Fernando Gont wrote: > > At 04:25 p.m. 10/01/2008, George M Jones wrote: > > >I took a stab at starting something > > > > http://www3.tools.ietf.org/wg/opsec/trac/wiki/ICMP%20Filtering > > > >It's a wiki. Other people are welcome/encouraged to contribute. > > > >I am going to poke a few people who have done some writing on the > >subject to see if anyone wants to be the "editor" (e.g. filter what > >everyone does to the Wiki). > > Would it make sense if I prepare and publsh a draft on the subject. > (Much of the work is already done for other drafts I have work on on > several issues about ICMP). > Yes. ---George Jones _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 16 11:48:31 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JFBR4-00005M-WA; Wed, 16 Jan 2008 11:48:18 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JFBR4-00005G-EM for opsec@ietf.org; Wed, 16 Jan 2008 11:48:18 -0500 Received: from smtp1.xmundo.net ([201.216.232.80]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JFBR3-000205-Ub for opsec@ietf.org; Wed, 16 Jan 2008 11:48:18 -0500 Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id E1C715A8A8A for ; Wed, 16 Jan 2008 14:48:18 -0200 (ARDT) Received: from notebook.gont.com.ar (168-226-21-194.speedy.com.ar [168.226.21.194] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m0GGjaLN000739 for ; Wed, 16 Jan 2008 14:48:12 -0200 Message-Id: <200801161648.m0GGjaLN000739@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 16 Jan 2008 14:43:36 -0200 To: opsec wg mailing list From: Fernando Gont Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: <478E0F38.9080904@mitre.org> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Wed, 16 Jan 2008 14:48:16 -0200 (ARDT) X-Spam-Score: 0.8 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org At 12:05 p.m. 16/01/2008, you wrote: >> >I am going to poke a few people who have done some writing on the >> >subject to see if anyone wants to be the "editor" (e.g. filter what >> >everyone does to the Wiki). >> >>Would it make sense if I prepare and publsh a draft on the subject. >>(Much of the work is already done for other drafts I have work on on >>several issues about ICMP). > >Yes. Okay. Will do. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Jan 19 17:01:10 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGLkB-0007xa-IG; Sat, 19 Jan 2008 17:00:51 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGLk9-0007wn-CM for opsec@ietf.org; Sat, 19 Jan 2008 17:00:49 -0500 Received: from host-not-found.adelman.com ([204.87.183.39]) by chiedprmail1.ietf.org with smtp (Exim 4.43) id 1JGLk8-000677-Fq for opsec@ietf.org; Sat, 19 Jan 2008 17:00:49 -0500 Received: from [192.168.66.51] by Host-Not-Found.Adelman.COM via Internet ; Sat, 19 Jan 2008 14:00:44 PST Mime-Version: 1.0 (Apple Message framework v753) In-Reply-To: <47855CF6.9060104@bogus.com> References: <47855CF6.9060104@bogus.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <61EE7556-BFFF-46AD-82F0-A2A9D85E65FB@doubleshotsecurity.com> Content-Transfer-Encoding: 7bit From: Merike Kaeo Subject: Re: [OPSEC] charter skeleton rev5 Date: Sat, 19 Jan 2008 14:06:15 -0800 To: opsec wg mailing list X-Mailer: Apple Mail (2.753) X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ff9c467ad7f19c2a6d058acd7faaec8 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org I just re-read all discussion from charter skeleton 3 onwards and here is some input from me: - regarding work with other wg's. Can we have a paragraph in the charter that says something like (and I take some wording from Dan Roascanu's comment as well as IPPM wg (where I remember this came up when I was co-chair there): " The principal input of the Working Group are operational experience and needs. The intended output of the wg is to provide guidance to the operators community as well as to Working Groups that develop protocols or the community of protocol developers at large to promote consistent approaches for supporting existing operational security practices and to promote new approaches where operationally desired. Within the IETF process, OPsec security practice documents will be subject to as rigorous a scrutiny for usefulness, clarity, and accuracy as other protocol standards. The OPsec WG will interact with other areas of IETF activity whose scope intersect with the requirement of these specific practices. These include working groups such as BMWG, v6ops, and ". - in v6ops there's discussion on draft-ietf-v6ops-rfc3330-for- ipv6-04.txt .......specific to which prefixes should get filtered.......we probably want to support/comment on that work?!? - Some work items I see as relevant: -- IPv6 specific operational security concerns (despite common 'it's no different than v4' comments) I think there's things like RA advertisement suppression and some similar things that may need some consideration. -- logging document...definitely needs to be included somehow....is Tina signed up for the work? [I totally am in sync with George's comment a few weeks ago that getting operator input was tough.......especially as doc editors.........it is important to get people signed up for the writing part....and no, I'm not volunteering right now.......] -- AAA related things...how devices get authenticated to and how activities get logged/audited One thing that I see in practice is that things that are a 'duh - of course you would do that' is not something that's second nature to all operators, especially the ones with less experience. And make that ditto for new equipment vendors. I have a story where I had to explain a year ago why NTP was important for timestamping of logs :) Anyhow.....just some thoughts.....sorry for late contribution........ - merike On Jan 9, 2008, at 3:47 PM, Joel Jaeggli wrote: > This version incorporates comments from: > > Ron Bonica > Danny McPherson > Dan Romascanu > George Jones > > > ---- > > Goals: > > The OPSEC WG will document best current practices with regard to > network > security. In particular an effort will be made to clarify the rational > supporting current operational practice, address gaps in currently > understood best practices for forwarding, control plane, and > management > plane security and make clear the liabilities inherent in security > practices where they exist. > > Scope: > > The scope of the OPSEC WG is intended to include the protection and > secure operation of the forwarding, control and management planes. > > Documentation of best common practices, revision of existing > operational > security practices documents and proposals for new approaches to > operational challenges are in scope. > > Method: > > It is expected that the work product of the working group will > fall into the category of best current practices documents. > Taxonomy or > problem statement documents may provide a basis for best current > practices documents. > > Best Current Practices Document > > For each topic addressed, a document will be produced that attempts to > capture current practices related to secure operation. This will be > primarily based on operational experience. Each entry will list: > > * threats addressed, > > * current practices for addressing the threat, > > * protocols, tools and technologies extant at the time of > writing that are used to address the threat, > > * the possibility that a solution does not exist within existing tools > or technologies. > > Taxonomy and Problem Statement Documents > > A document which attempts to describe the scope of particular > operational security challenge or problem space without necessarily > coming to a conclusion or proposing a solution. Such a document > might be > a precursor to a best common practices document. > > While the principal input of the Working Group are operational > experience and needs, the output should be directed both to provide > guidance to the operators community as well as to Working Groups that > develop protocols or the community of protocol developers at large, as > well as to the implementers of these protocols. > > Non-Goals: > > The Operations security working group is not the place to do new > protocols or requirements documents. > > New protocol development or requirements work should be addressed in a > working group chartered in the appropriate area or as individual > submissions. The OPSEC WG may take on documents related to > the practices of using such work. > > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Jan 20 22:03:06 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGmvu-0000oL-5x; Sun, 20 Jan 2008 22:02:46 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGmvs-0000oF-Jp for opsec@ietf.org; Sun, 20 Jan 2008 22:02:44 -0500 Received: from nagasaki.bogus.com ([147.28.0.81]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JGmvr-00083I-K0 for opsec@ietf.org; Sun, 20 Jan 2008 22:02:44 -0500 Received: from [192.168.11.104] (c-24-23-195-240.hsd1.mn.comcast.net [24.23.195.240]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m0L32c4O072452; Mon, 21 Jan 2008 03:02:39 GMT (envelope-from joelja@bogus.com) Message-ID: <47940B48.2050001@bogus.com> Date: Sun, 20 Jan 2008 19:02:32 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list , Merike Kaeo Subject: Re: [OPSEC] charter skeleton rev5 References: <47855CF6.9060104@bogus.com> <61EE7556-BFFF-46AD-82F0-A2A9D85E65FB@doubleshotsecurity.com> In-Reply-To: <61EE7556-BFFF-46AD-82F0-A2A9D85E65FB@doubleshotsecurity.com> X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.91.1/5505/Sun Jan 20 23:48:59 2008 on nagasaki.bogus.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 Cc: X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Merike Kaeo wrote: > I just re-read all discussion from charter skeleton 3 onwards and here > is some input from me: > > - regarding work with other wg's. Can we have a paragraph in the > charter that says something like (and I take some wording from Dan > Roascanu's comment as well as IPPM wg (where I remember this came up > when I was co-chair there): > > " The principal input of the Working Group are operational experience > and needs. The intended output of the wg is to provide guidance to the > operators community as well as to Working Groups that develop protocols > or the community of protocol developers at large to promote consistent > approaches for supporting existing operational security practices and to > promote new approaches where operationally desired. Within the IETF > process, OPsec security practice documents will be subject to as > rigorous a scrutiny for usefulness, clarity, and accuracy as other > protocol standards. The OPsec WG will interact with other areas of IETF > activity whose scope intersect with the requirement of these specific > practices. These include working groups such as BMWG, v6ops, and others?>". I like the tenor of this, but I am also in favor of compactness, and I think rev 5 is quite attractive in the extent to which it is pared back to a minimalist core. would you consider it incomplete without this sentiment? > - in v6ops there's discussion on > draft-ietf-v6ops-rfc3330-for-ipv6-04.txt .......specific to which > prefixes should get filtered.......we probably want to support/comment > on that work?!? One of the concerns I have with enterprise networks in general but also with forwarding and control plane protection is the congruence of policy between ipv4 and ipv6 configuration. So I would agree and if possible amplify that sentiment. > - Some work items I see as relevant: > > -- IPv6 specific operational security concerns (despite common 'it's no > different than v4' comments) I think there's things like RA > advertisement suppression and some similar things that may need some > consideration. Indeed... Operationally it's easy enough to respond to and mitigate sources of rogue's RA's but can you suppress them a priori without features that may/probably do not exist in your switch platform? Practice wise there's something be said for not relying on RA's when your devices are going to be statically configured. > -- logging document...definitely needs to be included somehow....is Tina > signed up for the work? [I totally am in sync with George's comment a > few weeks ago that getting operator input was tough.......especially as > doc editors.........it is important to get people signed up for the > writing part....and no, I'm not volunteering right now.......] Tina has expressed interest I know she's busy so I have avoided hasseling her. > -- AAA related things...how devices get authenticated to and how > activities get logged/audited > > One thing that I see in practice is that things that are a 'duh - of > course you would do that' is not something that's second nature to all > operators, especially the ones with less experience. And make that > ditto for new equipment vendors. I have a story where I had to explain > a year ago why NTP was important for timestamping of logs :) > Anyhow.....just some thoughts.....sorry for late contribution........ > > - merike > > On Jan 9, 2008, at 3:47 PM, Joel Jaeggli wrote: > >> This version incorporates comments from: >> >> Ron Bonica >> Danny McPherson >> Dan Romascanu >> George Jones >> >> >> ---- >> >> Goals: >> >> The OPSEC WG will document best current practices with regard to network >> security. In particular an effort will be made to clarify the rational >> supporting current operational practice, address gaps in currently >> understood best practices for forwarding, control plane, and management >> plane security and make clear the liabilities inherent in security >> practices where they exist. >> >> Scope: >> >> The scope of the OPSEC WG is intended to include the protection and >> secure operation of the forwarding, control and management planes. >> >> Documentation of best common practices, revision of existing operational >> security practices documents and proposals for new approaches to >> operational challenges are in scope. >> >> Method: >> >> It is expected that the work product of the working group will >> fall into the category of best current practices documents. Taxonomy or >> problem statement documents may provide a basis for best current >> practices documents. >> >> Best Current Practices Document >> >> For each topic addressed, a document will be produced that attempts to >> capture current practices related to secure operation. This will be >> primarily based on operational experience. Each entry will list: >> >> * threats addressed, >> >> * current practices for addressing the threat, >> >> * protocols, tools and technologies extant at the time of >> writing that are used to address the threat, >> >> * the possibility that a solution does not exist within existing tools >> or technologies. >> >> Taxonomy and Problem Statement Documents >> >> A document which attempts to describe the scope of particular >> operational security challenge or problem space without necessarily >> coming to a conclusion or proposing a solution. Such a document might be >> a precursor to a best common practices document. >> >> While the principal input of the Working Group are operational >> experience and needs, the output should be directed both to provide >> guidance to the operators community as well as to Working Groups that >> develop protocols or the community of protocol developers at large, as >> well as to the implementers of these protocols. >> >> Non-Goals: >> >> The Operations security working group is not the place to do new >> protocols or requirements documents. >> >> New protocol development or requirements work should be addressed in a >> working group chartered in the appropriate area or as individual >> submissions. The OPSEC WG may take on documents related to >> the practices of using such work. >> >> >> >> >> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www1.ietf.org/mailman/listinfo/opsec >> > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Jan 21 00:12:00 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGowv-0006n2-2z; Mon, 21 Jan 2008 00:11:57 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGowt-0006mw-Vn for opsec@ietf.org; Mon, 21 Jan 2008 00:11:55 -0500 Received: from smtp.resortinternet.net ([65.114.208.135]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JGowr-0003u6-O0 for opsec@ietf.org; Mon, 21 Jan 2008 00:11:55 -0500 Received: from [10.40.22.89] ([70.89.162.249]) by smtp.resortinternet.net with Microsoft SMTPSVC(6.0.3790.3959); Sun, 20 Jan 2008 22:11:52 -0700 In-Reply-To: <47940B48.2050001@bogus.com> References: <47855CF6.9060104@bogus.com> <61EE7556-BFFF-46AD-82F0-A2A9D85E65FB@doubleshotsecurity.com> <47940B48.2050001@bogus.com> Mime-Version: 1.0 (Apple Message framework v753) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <06F7B472-E699-40A0-900E-367F2477BE21@doubleshotsecurity.com> Content-Transfer-Encoding: 7bit From: Merike Kaeo Subject: Re: [OPSEC] charter skeleton rev5 Date: Sun, 20 Jan 2008 21:17:16 -0800 To: Joel Jaeggli X-Mailer: Apple Mail (2.753) X-OriginalArrivalTime: 21 Jan 2008 05:11:52.0522 (UTC) FILETIME=[224202A0:01C85BEC] X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Cc: opsec wg mailing list X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org > > I like the tenor of this, but I am also in favor of compactness, > and I > think rev 5 is quite attractive in the extent to which it is pared > back > to a minimalist core. > > would you consider it incomplete without this sentiment? no - it was simply a suggestion........I have no attachment to the suggestion :) > >> - in v6ops there's discussion on >> draft-ietf-v6ops-rfc3330-for-ipv6-04.txt .......specific to which >> prefixes should get filtered.......we probably want to support/ >> comment >> on that work?!? > > One of the concerns I have with enterprise networks in general but > also > with forwarding and control plane protection is the congruence of > policy > between ipv4 and ipv6 configuration. So I would agree and if possible > amplify that sentiment. > >> - Some work items I see as relevant: >> >> -- IPv6 specific operational security concerns (despite common >> 'it's no >> different than v4' comments) I think there's things like RA >> advertisement suppression and some similar things that may need some >> consideration. > > Indeed... Operationally it's easy enough to respond to and mitigate > sources of rogue's RA's but can you suppress them a priori without > features that may/probably do not exist in your switch platform? > Practice wise there's something be said for not relying on RA's when > your devices are going to be statically configured. > >> -- logging document...definitely needs to be included >> somehow....is Tina >> signed up for the work? [I totally am in sync with George's >> comment a >> few weeks ago that getting operator input was >> tough.......especially as >> doc editors.........it is important to get people signed up for the >> writing part....and no, I'm not volunteering right now.......] > > Tina has expressed interest I know she's busy so I have avoided > hasseling her. Only reason I ask is that the work has been 'in progress' for a few years.....I totally understand busy but if someone else could be recruited to co-author that may be something to consider to help get the writing going?!?!? It is very important for this wg to get authors of documents......while input from operators is critical, so is the task of actually writing the documents. That was the challenge in the past few years for opsec. - merike _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Jan 21 00:20:49 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGp5U-0004HB-Ka; Mon, 21 Jan 2008 00:20:48 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JGp5S-0004Fi-K0 for opsec@ietf.org; Mon, 21 Jan 2008 00:20:46 -0500 Received: from [2001:418:1::81] (helo=nagasaki.bogus.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JGp5S-000470-8B for opsec@ietf.org; Mon, 21 Jan 2008 00:20:46 -0500 Received: from [192.168.11.104] (c-24-23-195-240.hsd1.ca.comcast.net [24.23.195.240]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m0L5Kjss078348 for ; Mon, 21 Jan 2008 05:20:45 GMT (envelope-from joelja@bogus.com) Message-ID: <47942BA6.5060301@bogus.com> Date: Sun, 20 Jan 2008 21:20:38 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.91.1/5505/Sun Jan 20 23:48:59 2008 on nagasaki.bogus.com X-Virus-Status: Clean Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by nagasaki.bogus.com id m0L5Kjss078348 X-Spam-Score: -1.4 (-) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Subject: [OPSEC] housekeeping details and news. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org News... * Joe and I discussed reserving a meeting slot for IETF 71. However, given uncertainty over how far along the new efforts will be over the next 60 days we would prefer not to schedule a meeting which might have a rather short agenda. This does not mean the group is moribund and I think it's rather fitting that a group that should be outwardly focused would not be hell bent on meeting at the IETF. That said, organizing an informal or bar BOF at 71 is something we should probably plan on doing. * Rev 5 of the charter has been on the list for 9 days without catching to many bullets. * Work Items that have been proposed: icmp filtering draft - Fernando Gont and George Jones http://www1.ietf.org/mail-archive/web/opsec/current/msg00041.html log event taxonomy (what to log) - tina bird (more detail required) signaling upstream black hole routes - Joe abley, R=FCdiger Volk http://www1.ietf.org/mail-archive/web/opsec/current/msg00023.html proposed, ipv6 specific security considerations * I have a brief slot to talk and the NANOG isp security BOF so if anyone has questions they'd like posed or specific recruiting message I should be carrying, I'm happy to try and get it on the agenda, I have a few of my own ideas. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Jan 29 22:31:50 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JK3fm-0000HQ-Cw; Tue, 29 Jan 2008 22:31:38 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JK3fl-00009i-6l for opsec@ietf.org; Tue, 29 Jan 2008 22:31:37 -0500 Received: from dog.tcb.net ([64.78.150.133]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JK3fk-0005xq-Oj for opsec@ietf.org; Tue, 29 Jan 2008 22:31:36 -0500 Received: by dog.tcb.net (Postfix, from userid 0) id 1446E268096; Tue, 29 Jan 2008 20:31:36 -0700 (MST) Received: from [192.168.1.7] (division.aa.arbor.net [152.160.38.65]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; for opsec@ietf.org; Tue, 29 Jan 2008 20:31:35 -0700 (MST) (envelope-from danny@tcb.net) Mime-Version: 1.0 (Apple Message framework v753) In-Reply-To: <200801161648.m0GGjaLN000739@venus.xmundo.net> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> Content-Transfer-Encoding: 7bit From: Danny McPherson Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Date: Tue, 29 Jan 2008 20:31:18 -0700 To: opsec wg mailing list X-Mailer: Apple Mail (2.753) X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On Jan 16, 2008, at 9:43 AM, Fernando Gont wrote: > > Okay. Will do. I'd be happy to help with this, and if we can't find it a home here I'm certain we can find it a home elsewhere. -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 05:36:29 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKAIp-0003BW-Ax; Wed, 30 Jan 2008 05:36:23 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKAIo-0003BR-1s for opsec@ietf.org; Wed, 30 Jan 2008 05:36:22 -0500 Received: from smtp-bedford.mitre.org ([129.83.20.191]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JKAIn-0004wk-2u for opsec@ietf.org; Wed, 30 Jan 2008 05:36:21 -0500 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0UAaKaT018824 for ; Wed, 30 Jan 2008 05:36:20 -0500 Received: from imcfe2.MITRE.ORG (imcfe2.mitre.org [129.83.29.4]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m0UAaKb6018817 for ; Wed, 30 Jan 2008 05:36:20 -0500 Received: from [128.29.82.40] ([128.29.82.40]) by imcfe2.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Wed, 30 Jan 2008 05:36:20 -0500 Message-ID: <47A053F1.8040103@mitre.org> Date: Wed, 30 Jan 2008 05:39:45 -0500 From: George M Jones User-Agent: Thunderbird 2.0.0.6 (X11/20071022) MIME-Version: 1.0 To: opsec wg mailing list Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org><200801160800.m0G807Zc002605@venus.xmundo.net><478E0F38.9080904@mitre.org><200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> In-Reply-To: <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 30 Jan 2008 10:36:20.0124 (UTC) FILETIME=[F39215C0:01C8632B] X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Danny McPherson wrote: > > On Jan 16, 2008, at 9:43 AM, Fernando Gont wrote: > > > > Okay. Will do. > > I'd be happy to help with this, and if we can't find it a > home here I'm certain we can find it a home elsewhere. > I think there's consensus that the work belongs here. Go forth and draft. ---George _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 11:36:23 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKFv8-0000SW-Gl; Wed, 30 Jan 2008 11:36:18 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKFv6-0000SM-Fv for opsec@ietf.org; Wed, 30 Jan 2008 11:36:16 -0500 Received: from sudnp799.qwest.com ([155.70.32.99]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JKFv6-0001GO-3V for opsec@ietf.org; Wed, 30 Jan 2008 11:36:16 -0500 Received: from suomp61i.qintra.com (suomp61i.qintra.com [151.117.69.28]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m0UGaFd5020294 for ; Wed, 30 Jan 2008 09:36:15 -0700 (MST) Received: from ITDENE2KSM01.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp61i.qintra.com (8.14.0/8.14.0) with ESMTP id m0UGa9qH021555 for ; Wed, 30 Jan 2008 10:36:10 -0600 (CST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM01.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Wed, 30 Jan 2008 09:36:09 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Date: Wed, 30 Jan 2008 09:36:08 -0700 Message-ID: In-Reply-To: <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Importance: normal Priority: normal thread-index: Achi8MC6IdQSLavUTwySsf8df0Y5OQAbUo9Q References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org><200801160800.m0G807Zc002605@venus.xmundo.net><478E0F38.9080904@mitre.org><200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> From: "Smith, Donald" To: "opsec wg mailing list" X-OriginalArrivalTime: 30 Jan 2008 16:36:09.0184 (UTC) FILETIME=[37A73600:01C8635E] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org I too would like to work on the ICMP filtering. We should include rate limiting of icmp msgs FROM the router too. RM=3Dfor(1) {manage_risk(identify_risk(product[i++]))} Donald.Smith@qwest.com giac=20 > -----Original Message----- > From: Danny McPherson [mailto:danny@tcb.net]=20 > Sent: Tuesday, January 29, 2008 8:31 PM > To: opsec wg mailing list > Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) >=20 >=20 > On Jan 16, 2008, at 9:43 AM, Fernando Gont wrote: > > > > Okay. Will do. >=20 > I'd be happy to help with this, and if we can't find it a > home here I'm certain we can find it a home elsewhere. >=20 > -danny >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 This communication is the property of Qwest and may contain confidential = or privileged information. Unauthorized use of this communication is = strictly=20 prohibited and may be unlawful. If you have received this communication = in error, please immediately notify the sender by reply e-mail and = destroy=20 all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 14:30:56 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKIds-000283-7v; Wed, 30 Jan 2008 14:30:40 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKIdr-00027y-3b for opsec@ietf.org; Wed, 30 Jan 2008 14:30:39 -0500 Received: from aharp.ittns.northwestern.edu ([129.105.153.69]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JKIdq-0005oO-RW for opsec@ietf.org; Wed, 30 Jan 2008 14:30:39 -0500 Received: from jtk.cstcis.cti.depaul.edu (aharp [127.0.0.1]) by aharp.ittns.northwestern.edu (smtpd) with SMTP id 85740136C82 for ; Wed, 30 Jan 2008 13:30:38 -0600 (CST) Date: Wed, 30 Jan 2008 13:30:38 -0600 From: John Kristoff To: opsec wg mailing list Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> X-Mailer: Sylpheed version 2.2.2 (GTK+ 2.8.12; i386-apple-darwin8.5.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20080130193038.85740136C82@aharp.ittns.northwestern.edu> X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On Wed, 30 Jan 2008 09:36:08 -0700 "Smith, Donald" wrote: > I too would like to work on the ICMP filtering. > We should include rate limiting of icmp msgs FROM the router too. I believe RFC 1812 Section 4.3.2.8 is widely implemented in routers for ICMP generation already. Are you seeing something different or did you have something else in mind? Perhaps a reference or update to that RFC with stronger language is desired? John _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 14:53:24 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKIzr-0007Sf-Nv; Wed, 30 Jan 2008 14:53:23 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKIzp-0007S1-Jd for opsec@ietf.org; Wed, 30 Jan 2008 14:53:21 -0500 Received: from sudnp799.qwest.com ([155.70.32.99]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JKIzp-00082c-1s for opsec@ietf.org; Wed, 30 Jan 2008 14:53:21 -0500 Received: from suomp61i.qintra.com (suomp61i.qintra.com [151.117.69.28]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m0UJrKVo006155 for ; Wed, 30 Jan 2008 12:53:20 -0700 (MST) Received: from ITDENE2KSM01.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp61i.qintra.com (8.14.0/8.14.0) with ESMTP id m0UJrEXX005591 for ; Wed, 30 Jan 2008 13:53:15 -0600 (CST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM01.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Wed, 30 Jan 2008 12:53:14 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Date: Wed, 30 Jan 2008 12:53:12 -0700 Message-ID: In-Reply-To: <20080130193038.85740136C82@aharp.ittns.northwestern.edu> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Importance: normal Priority: normal thread-index: Achjdp6FtnogDFsGTbCsmTA/0qb43AAAL0NA References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org><200801160800.m0G807Zc002605@venus.xmundo.net><478E0F38.9080904@mitre.org><200801161648.m0GGjaLN000739@venus.xmundo.net><138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> From: "Smith, Donald" To: "opsec wg mailing list" X-OriginalArrivalTime: 30 Jan 2008 19:53:14.0208 (UTC) FILETIME=[BFEAAE00:01C86379] X-Spam-Score: 0.0 (/) X-Scan-Signature: c0bedb65cce30976f0bf60a0a39edea4 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org Thanks John, I it has been a while since I looked at that rfc. The reference you make is a good one especially for what a router is expected to be able to filter. They don't really reference very many ICMP types/codes that you may wish to limit the generation of on the router itself. Specific examples I was thinking of include: Generation of unreachables on routers that are doing destination based blackhole filtering. While that could be seen as a violation of 4.3.3.1 I would argue that you have a route/path it just happens to be towards the bit bucket.=20 Another would be TTL expiration. I have seen what appeared to be reflective attacks that used low ttl's and spoofed the victims source IP address. I think we could include those types of operational recommendations without generating new requirements for the router vendors based on this statement: " A router SHOULD also be able to limit the rate at which it sends other sorts of ICMP error messages (Destination Unreachable, Redirect, Time Exceeded, Parameter Problem). The rate limit parameters SHOULD be settable as part of the configuration of the router. How the limits are applied (e.g., per router or per interface) is left to the implementor's discretion." RM=3Dfor(1) {manage_risk(identify_risk(product[i++]))} Donald.Smith@qwest.com giac=20 > -----Original Message----- > From: John Kristoff [mailto:jtk@northwestern.edu]=20 > Sent: Wednesday, January 30, 2008 12:31 PM > To: opsec wg mailing list > Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) >=20 > On Wed, 30 Jan 2008 09:36:08 -0700 > "Smith, Donald" wrote: >=20 > > I too would like to work on the ICMP filtering. > > We should include rate limiting of icmp msgs FROM the router too. >=20 > I believe RFC 1812 Section 4.3.2.8 is widely implemented in routers > for ICMP generation already. Are you seeing something different or > did you have something else in mind? Perhaps a reference or update > to that RFC with stronger language is desired? >=20 > John >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec >=20 This communication is the property of Qwest and may contain confidential = or privileged information. Unauthorized use of this communication is = strictly=20 prohibited and may be unlawful. If you have received this communication = in error, please immediately notify the sender by reply e-mail and = destroy=20 all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 23:02:13 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKQcd-0007Gn-07; Wed, 30 Jan 2008 23:01:55 -0500 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKQcb-0007Ev-ST for opsec@ietf.org; Wed, 30 Jan 2008 23:01:53 -0500 Received: from sj-iport-6.cisco.com ([171.71.176.117]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JKQcb-0002Bm-7Z for opsec@ietf.org; Wed, 30 Jan 2008 23:01:53 -0500 Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-6.cisco.com with ESMTP; 30 Jan 2008 20:01:52 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id m0V41qBp030820 for ; Wed, 30 Jan 2008 20:01:52 -0800 Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id m0V41qAn015293 for ; Thu, 31 Jan 2008 04:01:52 GMT Received: from xmb-sjc-227.amer.cisco.com ([128.107.191.43]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 30 Jan 2008 20:01:52 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Date: Wed, 30 Jan 2008 20:01:48 -0800 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) Thread-Index: Achjdp6FtnogDFsGTbCsmTA/0qb43AAAL0NAABGVQYA= References: <47855CF6.9060104@bogus.com><4785FE75.6040502@mitre.org><47862F0E.9060407@juniper.net><478654EE.2080403@mitre.org><200801160800.m0G807Zc002605@venus.xmundo.net><478E0F38.9080904@mitre.org><200801161648.m0GGjaLN000739@venus.xmundo.net><138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net><20080130193038.85740136C82@aharp.ittns.northwestern.edu> From: "Barry Greene (bgreene)" To: "opsec wg mailing list" X-OriginalArrivalTime: 31 Jan 2008 04:01:52.0173 (UTC) FILETIME=[02C91DD0:01C863BE] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3844; t=1201752112; x=1202616112; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=bgreene@cisco.com; z=From:=20=22Barry=20Greene=20(bgreene)=22=20 |Subject:=20RE=3A=20ICMP=20filtering=20(was=20Re=3A=20[OPSE C]=20charter=20skeleton=20rev5) |Sender:=20; bh=YVXWxH0P97VyukB0HxrqzrvSAd0obaTuHr5iqtf0onk=; b=BFGSsxayG2wa9Bm2X/hto9/DIX02yVwjSkFSZTiXUgYnPHzd+7tjB3H6AM CkwKXIcX8BUygIIQqUI+KI+DnmvhYmYqhbV8nTSpDfbTwzlqfYVkGOzddCX1 8D5MdLAgSp; Authentication-Results: sj-dkim-3; header.From=bgreene@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); X-Spam-Score: -4.0 (----) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org =20 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I would say that a router that strictly codes to RFC 1812 is a router which can be attacked and used to attack others. As Don mentioned, routers today need a lot more capabilities and reset of expectations. Consideration - a total relook at RFC 1812 - updating it so that all routers behave the same way - in a way that it is safe from attack and cannot be used to attack others.=20 =20 > -----Original Message----- > From: Smith, Donald [mailto:Donald.Smith@qwest.com]=20 > Sent: Wednesday, January 30, 2008 11:53 AM > To: opsec wg mailing list > Subject: RE: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) >=20 > Thanks John, I it has been a while since I looked at that rfc. > The reference you make is a good one especially for what a=20 > router is expected to be able to filter. > They don't really reference very many ICMP types/codes that=20 > you may wish to limit the generation of on the router itself. >=20 > Specific examples I was thinking of include: > Generation of unreachables on routers that are doing=20 > destination based blackhole filtering. > While that could be seen as a violation of 4.3.3.1 I would=20 > argue that you have a route/path it just happens to be=20 > towards the bit bucket.=20 >=20 > Another would be TTL expiration. I have seen what appeared to=20 > be reflective attacks that used low ttl's and spoofed the=20 > victims source IP address. >=20 > I think we could include those types of operational=20 > recommendations without generating new requirements for the=20 > router vendors based on this > statement: > " A router SHOULD also be able to limit the rate at which it=20 > sends other sorts of ICMP error messages (Destination=20 > Unreachable, Redirect, Time Exceeded, Parameter Problem). =20 > The rate limit parameters SHOULD be settable as part of the=20 > configuration of the router. How the limits are applied=20 > (e.g., per router or per interface) is left to the=20 > implementor's discretion." >=20 >=20 > RM=3Dfor(1) > {manage_risk(identify_risk(product[i++]))} > Donald.Smith@qwest.com giac=20 >=20 > > -----Original Message----- > > From: John Kristoff [mailto:jtk@northwestern.edu] > > Sent: Wednesday, January 30, 2008 12:31 PM > > To: opsec wg mailing list > > Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton > > rev5) =20 > >=20 > > On Wed, 30 Jan 2008 09:36:08 -0700 > > "Smith, Donald" wrote: > >=20 > > > I too would like to work on the ICMP filtering. > > > We should include rate limiting of icmp msgs FROM the router > > > too.=20 > >=20 > > I believe RFC 1812 Section 4.3.2.8 is widely implemented in > > routers for ICMP generation already. Are you seeing something > > different or did you have something else in mind? Perhaps a > > reference=20 > or update to=20 > > that RFC with stronger language is desired? > >=20 > > John > >=20 > > _______________________________________________ > > OPSEC mailing list > > OPSEC@ietf.org > > https://www1.ietf.org/mailman/listinfo/opsec > >=20 >=20 >=20 > This communication is the property of Qwest and may contain=20 > confidential or privileged information. Unauthorized use of=20 > this communication is strictly prohibited and may be=20 > unlawful. If you have received this communication in error,=20 > please immediately notify the sender by reply e-mail and=20 > destroy all copies of the communication and any attachments. >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www1.ietf.org/mailman/listinfo/opsec -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBR6FILL/UEA/xivvmEQKI/QCgt5+XEx//9O8Q203IGcDOj5LdlIgAoP6k WIdAI4uw/FsX4eA8gUXExn/T =3DmoaD -----END PGP SIGNATURE----- _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Jan 30 23:40:52 2008 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKREI-0000Lv-OV; Wed, 30 Jan 2008 23:40:50 -0500 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JKREH-0000Lp-Ku for opsec@ietf.org; Wed, 30 Jan 2008 23:40:49 -0500 Received: from aharp.ittns.northwestern.edu ([129.105.153.69]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1JKREH-0004Tp-CO for opsec@ietf.org; Wed, 30 Jan 2008 23:40:49 -0500 Received: from dsl017-022-071.chi1.dsl.speakeasy.net (aharp [127.0.0.1]) by aharp.ittns.northwestern.edu (smtpd) with SMTP id BB2EC136C82 for ; Wed, 30 Jan 2008 22:40:48 -0600 (CST) Date: Wed, 30 Jan 2008 22:40:48 -0600 From: John Kristoff To: opsec@ietf.org Subject: Re: ICMP filtering (was Re: [OPSEC] charter skeleton rev5) In-Reply-To: References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> X-Mailer: Sylpheed version 2.2.2 (GTK+ 2.8.12; i386-apple-darwin8.5.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20080131044048.BB2EC136C82@aharp.ittns.northwestern.edu> X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: opsec-bounces@ietf.org On Wed, 30 Jan 2008 12:53:12 -0700 "Smith, Donald" wrote: > They don't really reference very many ICMP types/codes that you may wish > to limit the generation of on the router itself. As I understand it, implementations use these guidelines for any ICMP response they generate. And I'm not certain, but I thought it applies the rate limit to the router ICMP response rate as a whole and not on a per flow basis (which may be a DoS in itself if someone is willing to flood the router with ICMP messages. Perhaps if those who are writing documents could put that on a todo list to find out and perhaps make note of it in what they end up writing. John _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www1.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Jan 31 20:25:43 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19CD328C15E; Thu, 31 Jan 2008 20:25:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.654 X-Spam-Level: X-Spam-Status: No, score=0.654 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_40=-0.185, SARE_RECV_SPEEDY_AR=0.808] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wtsxaT9o58wm; Thu, 31 Jan 2008 20:25:42 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 40A0628C138; Thu, 31 Jan 2008 20:25:42 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E96B028C0DA for ; Thu, 31 Jan 2008 20:25:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i0uo+d9YAQJj for ; Thu, 31 Jan 2008 20:25:40 -0800 (PST) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id EDEBB28C141 for ; Thu, 31 Jan 2008 20:25:39 -0800 (PST) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id AE85F5A745A; Fri, 1 Feb 2008 02:27:15 -0200 (ARDT) Received: from notebook.gont.com.ar (168-226-57-113.speedy.com.ar [168.226.57.113] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m114R79n013321; Fri, 1 Feb 2008 02:27:08 -0200 Message-Id: <200802010427.m114R79n013321@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 01 Feb 2008 02:26:16 -0200 To: opsec wg mailing list From: Fernando Gont In-Reply-To: References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Fri, 01 Feb 2008 02:27:15 -0200 (ARDT) Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 02:01 a.m. 31/01/2008, you wrote: >I would say that a router that strictly codes to RFC 1812 is a router >which can be attacked and used to attack others. As Don mentioned, >routers today need a lot more capabilities and reset of expectations. > >Consideration - a total relook at RFC 1812 - updating it so that all >routers behave the same way - in a way that it is safe from attack >and cannot be used to attack others. The same thing applies to most RFCs, including RFC 1122 (host requirements), the core TCP and IP specifications, and so on. What's really bad is is that people seem to feel happy about it. I doubt whether we would ever be able to get consensus to rewrite RFC 1122 or RFC 1812. The older the RFC, the more controversial it turns out to be. Think about any of the most well known network attacks we have faced in the past (Smurf, SYN-flood, netkill, or whatever), and try to find a reference to them in any IETF RFC. Only since a couple of years ago we have had IDs or RFCs on a few of these issues (ICMP attacks, TCP-based attacks, SYN-floods)... but most of these efforts ended up in Informational RFCs (rather than Standards track)... Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec