From opsec-bounces@ietf.org Tue May 6 23:35:15 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D23443A6BC2; Tue, 6 May 2008 23:35:15 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 528573A70C7 for ; Tue, 6 May 2008 23:35:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BTLNP8oWyQMb for ; Tue, 6 May 2008 23:35:10 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 713513A70BB for ; Tue, 6 May 2008 23:35:10 -0700 (PDT) Received: from [192.168.1.117] (c-24-130-16-195.hsd1.ca.comcast.net [24.130.16.195]) (authenticated bits=0) by nagasaki.bogus.com (8.14.2/8.14.2) with ESMTP id m476Ywfh084014 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 7 May 2008 06:35:01 GMT (envelope-from joelja@bogus.com) Message-ID: <48214D92.7060403@bogus.com> Date: Tue, 06 May 2008 23:34:58 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: Fernando Gont References: <200803302248.m2UMmhSn014472@venus.xmundo.net> In-Reply-To: <200803302248.m2UMmhSn014472@venus.xmundo.net> X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/7046/Wed May 7 03:35:44 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I think, given the commentary over the last month that this is worth accepting as a working group document. I think it's pretty clear that there were some comments regarding the structure but relatively little regarding the content, which is consistent with what we discussed prior to IETF 71. joelja Fernando Gont wrote: > Folks, > > After quite some time of discussing this subject on the list, we have > finally published a (very drafty) internet draft on ICMP filtering. > Our draft borrows its structure from the wiki George Jones had > started on the subject. > > We have spent an extraordinary amount of time digging into the specs, > in the hope of being able to include pointers to the relevant RFCs > where each of the ICMP messages are defined (part of this work should > be credited to Carlos Pignataro). > > So far, we have included all this information in our draft, and have > already started populating the "uses", "security threats" and > "Operational implications if blocked" subsections corresponding to > each of the ICMP messages. > > We'd like to receive feedback on the structure of the draft. That is, > whether you are happy with the current structure of the draft (so > that we continue moving in this direction), or whether some changes > would be needed for you to feel happier about it. Among the possible > changes could be: > > * Discuss request/response messages in the same section, rather than > having subsections for each of them. I think the current structure > (having a subsection for each type/code) is good, but... > > * Changing the structure of the draft actually, the xml tag in the > xml source) so that "Uses", "Threats" and > "Operational/interoperability impact if blocked" are NOT "sections". > This would avoid section numbers having a fifth level of nesting > (e.g., 1.2.3.4.5)... but might be good for referencing a specific > part of this draft. > > Any other comments are welcome. > > The draft is available at the ID repository, but we have also put it > online (and in different fancy formats) at: > http://www.gont.com.ar/drafts/icmp-filtering/index.html > > Thanks! > > Kind regards, > > -- > Fernando Gont > e-mail: fernando@gont.com.ar || fgont@acm.org > PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed May 7 08:29:29 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A01D28C8FA; Wed, 7 May 2008 08:29:29 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 77BC128C95F for ; Wed, 7 May 2008 08:29:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_91=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l8Hy03DM80o0 for ; Wed, 7 May 2008 08:29:25 -0700 (PDT) Received: from smtp-out.google.com (smtp-out.google.com [216.239.33.17]) by core3.amsl.com (Postfix) with ESMTP id 4A9F028C681 for ; Wed, 7 May 2008 08:25:56 -0700 (PDT) Received: from zps36.corp.google.com (zps36.corp.google.com [172.25.146.36]) by smtp-out.google.com with ESMTP id m47FPC3u014327; Wed, 7 May 2008 16:25:13 +0100 Received: from dot.corp.google.com (dot.corp.google.com [172.29.23.83]) (authenticated bits=0) by zps36.corp.google.com with ESMTP id m47FP6ib013864 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 7 May 2008 08:25:09 -0700 Message-Id: From: Warren Kumari To: Joel Jaeggli In-Reply-To: <48214D92.7060403@bogus.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Wed, 7 May 2008 11:25:05 -0400 References: <200803302248.m2UMmhSn014472@venus.xmundo.net> <48214D92.7060403@bogus.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On May 7, 2008, at 2:34 AM, Joel Jaeggli wrote: > I think, given the commentary over the last month that this is worth > accepting as a working group document. Yes, I fully agree... > I think it's pretty clear that > there were some comments regarding the structure but relatively little > regarding the content, which is consistent with what we discussed > prior > to IETF 71. > Yup. > joelja > > Fernando Gont wrote: >> Folks, >> >> After quite some time of discussing this subject on the list, we have >> finally published a (very drafty) internet draft on ICMP filtering. >> Our draft borrows its structure from the wiki George Jones had >> started on the subject. >> >> We have spent an extraordinary amount of time digging into the specs, >> in the hope of being able to include pointers to the relevant RFCs >> where each of the ICMP messages are defined (part of this work should >> be credited to Carlos Pignataro). >> >> So far, we have included all this information in our draft, and have >> already started populating the "uses", "security threats" and >> "Operational implications if blocked" subsections corresponding to >> each of the ICMP messages. >> >> We'd like to receive feedback on the structure of the draft. That is, >> whether you are happy with the current structure of the draft (so >> that we continue moving in this direction), or whether some changes >> would be needed for you to feel happier about it. Among the possible >> changes could be: >> >> * Discuss request/response messages in the same section, rather than >> having subsections for each of them. I think the current structure >> (having a subsection for each type/code) is good, but... >> >> * Changing the structure of the draft actually, the xml tag in the >> xml source) so that "Uses", "Threats" and >> "Operational/interoperability impact if blocked" are NOT "sections". >> This would avoid section numbers having a fifth level of nesting >> (e.g., 1.2.3.4.5)... but might be good for referencing a specific >> part of this draft. >> >> Any other comments are welcome. >> >> The draft is available at the ID repository, but we have also put it >> online (and in different fancy formats) at: >> http://www.gont.com.ar/drafts/icmp-filtering/index.html >> >> Thanks! >> >> Kind regards, >> >> -- >> Fernando Gont >> e-mail: fernando@gont.com.ar || fgont@acm.org >> PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 >> >> >> >> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > -- After you'd known Christine for any length of time, you found yourself fighting a desire to look into her ear to see if you could spot daylight coming the other way. -- (Terry Pratchett, Maskerade)t _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed May 7 08:38:47 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 307D73A6853; Wed, 7 May 2008 08:38:47 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 152923A69D7 for ; Wed, 7 May 2008 08:38:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_91=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ZHbtmiUovU9 for ; Wed, 7 May 2008 08:38:44 -0700 (PDT) Received: from sudnp799.qwest.com (sudnp799.qwest.com [155.70.32.99]) by core3.amsl.com (Postfix) with ESMTP id 1E5113A6853 for ; Wed, 7 May 2008 08:38:44 -0700 (PDT) Received: from suomp61i.qintra.com (suomp61i.qintra.com [151.117.69.28]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m47FcPEY011838; Wed, 7 May 2008 09:38:25 -0600 (MDT) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp61i.qintra.com (8.14.0/8.14.0) with ESMTP id m47FcJ7S027236; Wed, 7 May 2008 10:38:20 -0500 (CDT) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Wed, 7 May 2008 09:38:19 -0600 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 7 May 2008 09:38:18 -0600 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] New I-D on ICMP filtering thread-index: AciwV6OlPb+BbcLpRCWKAOJjv/RmZQAAGs1g References: <200803302248.m2UMmhSn014472@venus.xmundo.net><48214D92.7060403@bogus.com> Importance: normal Priority: normal From: "Smith, Donald" To: "Warren Kumari" , "Joel Jaeggli" X-OriginalArrivalTime: 07 May 2008 15:38:19.0691 (UTC) FILETIME=[602817B0:01C8B058] Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Fernando, good work! I agree this should be accepted as a working group document. RM=for(1) {manage_risk(identify_risk(product[i++]) && (identify_threat[product[i++]))} Donald.Smith@qwest.com giac > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Warren Kumari > Sent: Wednesday, May 07, 2008 9:25 AM > To: Joel Jaeggli > Cc: opsec wg mailing list > Subject: Re: [OPSEC] New I-D on ICMP filtering > > > On May 7, 2008, at 2:34 AM, Joel Jaeggli wrote: > > > I think, given the commentary over the last month that this is worth > > accepting as a working group document. > > Yes, I fully agree... > > > I think it's pretty clear that > > there were some comments regarding the structure but > relatively little > > regarding the content, which is consistent with what we discussed > > prior > > to IETF 71. > > > > Yup. > > > joelja > > > > Fernando Gont wrote: > >> Folks, > >> > >> After quite some time of discussing this subject on the > list, we have > >> finally published a (very drafty) internet draft on ICMP filtering. > >> Our draft borrows its structure from the wiki George Jones had > >> started on the subject. > >> > >> We have spent an extraordinary amount of time digging into > the specs, > >> in the hope of being able to include pointers to the relevant RFCs > >> where each of the ICMP messages are defined (part of this > work should > >> be credited to Carlos Pignataro). > >> > >> So far, we have included all this information in our > draft, and have > >> already started populating the "uses", "security threats" and > >> "Operational implications if blocked" subsections corresponding to > >> each of the ICMP messages. > >> > >> We'd like to receive feedback on the structure of the > draft. That is, > >> whether you are happy with the current structure of the draft (so > >> that we continue moving in this direction), or whether some changes > >> would be needed for you to feel happier about it. Among > the possible > >> changes could be: > >> > >> * Discuss request/response messages in the same section, > rather than > >> having subsections for each of them. I think the current structure > >> (having a subsection for each type/code) is good, but... > >> > >> * Changing the structure of the draft actually, the xml tag in the > >> xml source) so that "Uses", "Threats" and > >> "Operational/interoperability impact if blocked" are NOT > "sections". > >> This would avoid section numbers having a fifth level of nesting > >> (e.g., 1.2.3.4.5)... but might be good for referencing a specific > >> part of this draft. > >> > >> Any other comments are welcome. > >> > >> The draft is available at the ID repository, but we have > also put it > >> online (and in different fancy formats) at: > >> http://www.gont.com.ar/drafts/icmp-filtering/index.html > >> > >> Thanks! > >> > >> Kind regards, > >> > >> -- > >> Fernando Gont > >> e-mail: fernando@gont.com.ar || fgont@acm.org > >> PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 > >> > >> > >> > >> > >> _______________________________________________ > >> OPSEC mailing list > >> OPSEC@ietf.org > >> https://www.ietf.org/mailman/listinfo/opsec > >> > > > > _______________________________________________ > > OPSEC mailing list > > OPSEC@ietf.org > > https://www.ietf.org/mailman/listinfo/opsec > > > > -- > After you'd known Christine for any length of time, you found > yourself > fighting a desire to look into her ear to see if you could spot > daylight coming the other way. > > -- (Terry Pratchett, Maskerade)t > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed May 7 20:49:38 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F00723A6E4E; Wed, 7 May 2008 20:49:37 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4C6433A6C93 for ; Wed, 7 May 2008 20:49:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lfo0QtIRyCph for ; Wed, 7 May 2008 20:49:35 -0700 (PDT) Received: from iridium.nac.net (iridium.nac.net [209.123.118.212]) by core3.amsl.com (Postfix) with ESMTP id 7E1C73A67F6 for ; Wed, 7 May 2008 20:49:35 -0700 (PDT) Received: from webmail.nac.net (localhost.nac.net [127.0.0.1]) by iridium.nac.net (8.13.4/8.13.4) with ESMTP id m483nTXl061322; Wed, 7 May 2008 23:49:29 -0400 (EDT) (envelope-from rfgraveman@nac.net) Received: from 88.43.53.20 (SquirrelMail authenticated user rfgraveman) by webmail.nac.net with HTTP; Wed, 7 May 2008 23:49:29 -0400 (EDT) Message-ID: <55894.88.43.53.20.1210218569.squirrel@webmail.nac.net> In-Reply-To: References: <200803302248.m2UMmhSn014472@venus.xmundo.net> <48214D92.7060403@bogus.com> Date: Wed, 7 May 2008 23:49:29 -0400 (EDT) From: rfgraveman@nac.net To: "opsec wg mailing list" User-Agent: SquirrelMail/1.4.10a MIME-Version: 1.0 X-Priority: 3 (Normal) Importance: Normal Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org This is most welcomed and well worth the WG's acceptance. Doing ICMPv6 too is great. One suggestion: I believe that additional ICMPv6 messages beyond the base spec have been defined, e.g., for mobility. Perhaps consult the IANA assignments for a current list. Richard Graveman _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu May 8 09:04:32 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CF63428C9E5; Thu, 8 May 2008 09:04:32 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A40D028C94B for ; Thu, 8 May 2008 09:04:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ycy4BsxoU5-Q for ; Thu, 8 May 2008 09:04:27 -0700 (PDT) Received: from sudnp799.qwest.com (sudnp799.qwest.com [155.70.32.99]) by core3.amsl.com (Postfix) with ESMTP id 2C21F28CB07 for ; Thu, 8 May 2008 08:47:34 -0700 (PDT) Received: from sudnp796.qintra.com (sudnp796.qintra.com [151.116.2.212]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m48FlU6B001530; Thu, 8 May 2008 09:47:30 -0600 (MDT) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by sudnp796.qintra.com (8.14.0/8.14.0) with ESMTP id m48FlOBR029168; Thu, 8 May 2008 09:47:24 -0600 (MDT) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Thu, 8 May 2008 09:47:24 -0600 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Date: Thu, 8 May 2008 09:47:23 -0600 Message-ID: In-Reply-To: <55894.88.43.53.20.1210218569.squirrel@webmail.nac.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] New I-D on ICMP filtering Importance: normal thread-index: Aciwvos1pmg9VrP+RQizFRybXattkgAY/dxg Priority: normal References: <200803302248.m2UMmhSn014472@venus.xmundo.net><48214D92.7060403@bogus.com> <55894.88.43.53.20.1210218569.squirrel@webmail.nac.net> From: "Smith, Donald" To: , "opsec wg mailing list" X-OriginalArrivalTime: 08 May 2008 15:47:24.0942 (UTC) FILETIME=[CF908AE0:01C8B122] Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org ICMPv6 is covered within this document. I don't know if it covers any new mobility related ICMPv6 messages. RM=for(1) {manage_risk(identify_risk(product[i++]) && (identify_threat[product[i++]))} Donald.Smith@qwest.com giac > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of rfgraveman@nac.net > Sent: Wednesday, May 07, 2008 9:49 PM > To: opsec wg mailing list > Subject: Re: [OPSEC] New I-D on ICMP filtering > > This is most welcomed and well worth the WG's acceptance. > > Doing ICMPv6 too is great. One suggestion: I believe that > additional ICMPv6 messages beyond the base spec have been defined, > e.g., for mobility. Perhaps consult the IANA assignments for > a current list. > > Richard Graveman > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu May 8 09:17:48 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E22628CCD8; Thu, 8 May 2008 09:17:48 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 91C6B3A7246 for ; Thu, 8 May 2008 08:33:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.556 X-Spam-Level: X-Spam-Status: No, score=-2.556 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DATE_IN_PAST_03_06=0.044, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lL5jRHwW5fbX for ; Thu, 8 May 2008 08:33:25 -0700 (PDT) Received: from sequoia.muada.com (unknown [IPv6:2001:1af8:2:5::2]) by core3.amsl.com (Postfix) with ESMTP id 39A6C28C889 for ; Thu, 8 May 2008 06:26:26 -0700 (PDT) Received: from [IPv6:2001:720:410:1001:21b:63ff:fe92:9fbb] ([IPv6:2001:720:410:1001:21b:63ff:fe92:9fbb]) (authenticated bits=0) by sequoia.muada.com (8.13.3/8.13.3) with ESMTP id m489OHig051986 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Thu, 8 May 2008 11:24:17 +0200 (CEST) (envelope-from iljitsch@muada.com) Message-Id: <1A7291F3-532F-4596-8E25-0082DC9A9660@muada.com> From: Iljitsch van Beijnum To: Joel Jaeggli In-Reply-To: <4822B173.3070001@bogus.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Thu, 8 May 2008 11:24:17 +0200 References: <200805062253.m46MrwS1025720@mail.r-bonomi.com> <4821020A.7050003@fsr.com> <20080507134507.GA23142@gsp.org> <48220209.8000407@fsr.com> <482206FE.3030000@rancid.berkeley.edu> <6536F6AA-0810-4255-8116-510FBB9D24A4@muada.com> <87iqxp2scc.fsf@obelix.mork.no> <4822B173.3070001@bogus.com> X-Mailer: Apple Mail (2.919.2) X-Mailman-Approved-At: Thu, 08 May 2008 09:17:46 -0700 Cc: guillermo@gont.com.ar, opsec@ietf.org, NANOG list Subject: Re: [OPSEC] [NANOG] Microsoft.com PMTUD black hole? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 8 mei 2008, at 9:53, Joel Jaeggli wrote: > Oddly enough there is a draft on the subject of icmp filtering > recomendations is making the rounds. > http://tools.ietf.org/wg/opsec/draft-gont-opsec-icmp-filtering-00.txt > The opsec working group (opsec@ietf.org) and the authors would > appreciate feedback from operators on the subject. Speaking as someone who isn't interested in reading an explanation of what happens when the message is filtered for every ICMP message known to man, I find this a completely useless document: I can't find the recommendations. Either they're there but impossible to find by looking at the table of contents or searching for "recommend", or they're not there in which case the title is EXTREMELY misleading. Also: 2.1.1.5.4. Operational/interoperability impact if blocked Filtering this error message breaks the Path-MTU Discovery mechansim described in [RFC1191]. This is completely insufficient because it doesn't mention that 99% of all TCP traffic on today's internet uses PMTUD and filtering these messages leads to broken connectivity towards destinations that have an MTU lower than the source (lower than 1500 in practice). Please spell check and five levels of numbering is considered bad style. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu May 8 10:20:21 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1526828C14E; Thu, 8 May 2008 10:20:21 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20F493A6991 for ; Thu, 8 May 2008 10:20:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ix6r-CJHVMFt for ; Thu, 8 May 2008 10:20:18 -0700 (PDT) Received: from suomp64i.qwest.com (suomp64i.qwest.com [155.70.16.237]) by core3.amsl.com (Postfix) with ESMTP id 7841C28C221 for ; Thu, 8 May 2008 10:20:14 -0700 (PDT) Received: from suomp60i.qintra.com (suomp60i.qintra.com [151.117.69.27]) by suomp64i.qwest.com (8.14.0/8.14.0) with ESMTP id m48HJmMB024575; Thu, 8 May 2008 12:19:49 -0500 (CDT) Received: from ITDENE2KSM01.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp60i.qintra.com (8.14.0/8.14.0) with ESMTP id m48HJgO2027388; Thu, 8 May 2008 12:19:43 -0500 (CDT) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM01.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Thu, 8 May 2008 11:19:43 -0600 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Date: Thu, 8 May 2008 11:19:41 -0600 Message-ID: In-Reply-To: <1A7291F3-532F-4596-8E25-0082DC9A9660@muada.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] [NANOG] Microsoft.com PMTUD black hole? thread-index: AcixKDXGfWSqrylQT+KpKsdnxwek4QABl3nw Importance: normal Priority: normal References: <200805062253.m46MrwS1025720@mail.r-bonomi.com> <4821020A.7050003@fsr.com><20080507134507.GA23142@gsp.org> <48220209.8000407@fsr.com><482206FE.3030000@rancid.berkeley.edu> <6536F6AA-0810-4255-8116-510FBB9D24A4@muada.com><87iqxp2scc.fsf@obelix.mork.no> <4822B173.3070001@bogus.com> <1A7291F3-532F-4596-8E25-0082DC9A9660@muada.com> From: "Smith, Donald" To: "Iljitsch van Beijnum" , "Joel Jaeggli" X-OriginalArrivalTime: 08 May 2008 17:19:43.0336 (UTC) FILETIME=[B4B46680:01C8B12F] Cc: guillermo@gont.com.ar, opsec@ietf.org, NANOG list Subject: Re: [OPSEC] [NANOG] Microsoft.com PMTUD black hole? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org A few comments on your comments below. RM=for(1) {manage_risk(identify_risk(product[i++]) && (identify_threat[product[i++]))} Donald.Smith@qwest.com giac > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Iljitsch van Beijnum > Sent: Thursday, May 08, 2008 3:24 AM > To: Joel Jaeggli > Cc: guillermo@gont.com.ar; opsec@ietf.org; NANOG list > Subject: Re: [OPSEC] [NANOG] Microsoft.com PMTUD black hole? > > On 8 mei 2008, at 9:53, Joel Jaeggli wrote: > > > Oddly enough there is a draft on the subject of icmp filtering > > recomendations is making the rounds. > > > > http://tools.ietf.org/wg/opsec/draft-gont-opsec-icmp-filtering-00.txt > > > The opsec working group (opsec@ietf.org) and the authors would > > appreciate feedback from operators on the subject. > > Speaking as someone who isn't interested in reading an > explanation of > what happens when the message is filtered for every ICMP > message known > to man, I find this a completely useless document: I can't find the > recommendations. Either they're there but impossible to find by > looking at the table of contents or searching for "recommend", or > they're not there in which case the title is EXTREMELY misleading. I believe a table of what to filter where was recommended. I hope that table includes filtering and ratelimiting from, through, and to. However blindly accepting recommendations without understanding the possibly ramifications such filtering can have on your network is not wise. > > Also: > > 2.1.1.5.4. Operational/interoperability impact if blocked Filtering > this error message breaks the Path-MTU Discovery mechansim described > in [RFC1191]. > > This is completely insufficient because it doesn't mention > that 99% of > all TCP traffic on today's internet uses PMTUD and filtering these > messages leads to broken connectivity towards destinations that have > an MTU lower than the source (lower than 1500 in practice). I suspect your statistics. I don't believe the number is anywhere near 99% but haven't seen a study that would support any actual % numbers of traffic that relies on PMTUD. If your aware of such a study/research I would be interested in reviewing the results. Again filtering THROUGH a device is probably not advisable filtering TO your device might be advisable. > > Please spell check and five levels of numbering is considered > bad style. > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat May 10 08:44:12 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0B993A683C; Sat, 10 May 2008 08:44:12 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3844C3A683C for ; Sat, 10 May 2008 08:44:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RaPI9SULyf6H for ; Sat, 10 May 2008 08:44:09 -0700 (PDT) Received: from iridium.nac.net (iridium.nac.net [209.123.118.212]) by core3.amsl.com (Postfix) with ESMTP id 263ED3A6825 for ; Sat, 10 May 2008 08:44:05 -0700 (PDT) Received: from webmail.nac.net (localhost.nac.net [127.0.0.1]) by iridium.nac.net (8.13.4/8.13.4) with ESMTP id m4AEennG090829; Sat, 10 May 2008 10:40:49 -0400 (EDT) (envelope-from rfgraveman@nac.net) Received: from 72.68.68.208 (SquirrelMail authenticated user rfgraveman) by webmail.nac.net with HTTP; Sat, 10 May 2008 10:40:49 -0400 (EDT) Message-ID: <50143.72.68.68.208.1210430449.squirrel@webmail.nac.net> In-Reply-To: References: <200803302248.m2UMmhSn014472@venus.xmundo.net><48214D92.7060403@bogus.com> <55894.88.43.53.20.1210218569.squirrel@webmail.nac.net> Date: Sat, 10 May 2008 10:40:49 -0400 (EDT) From: rfgraveman@nac.net To: "Smith, Donald" User-Agent: SquirrelMail/1.4.10a MIME-Version: 1.0 X-Priority: 3 (Normal) Importance: Normal Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org > > ICMPv6 is covered within this document. > I don't know if it covers any new mobility related ICMPv6 messages. > Right; my suggestion was to consult http://www.iana.org/assignments/icmpv6-parameters for a complete list of currently assigned types. Richard > Donald.Smith@qwest.com giac > >> -----Original Message----- >> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] >> On Behalf Of rfgraveman@nac.net >> Sent: Wednesday, May 07, 2008 9:49 PM >> To: opsec wg mailing list >> Subject: Re: [OPSEC] New I-D on ICMP filtering >> >> This is most welcomed and well worth the WG's acceptance. >> >> Doing ICMPv6 too is great. One suggestion: I believe that >> additional ICMPv6 messages beyond the base spec have been defined, >> e.g., for mobility. Perhaps consult the IANA assignments for >> a current list. >> >> Richard Graveman >> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > > > This communication is the property of Qwest and may contain confidential > or > privileged information. Unauthorized use of this communication is strictly > prohibited and may be unlawful. If you have received this communication > in error, please immediately notify the sender by reply e-mail and destroy > all copies of the communication and any attachments. > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat May 10 11:05:28 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E953D3A6808; Sat, 10 May 2008 11:05:27 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 010BA3A6949 for ; Sat, 10 May 2008 11:05:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ODfGGBhqEmZc for ; Sat, 10 May 2008 11:05:20 -0700 (PDT) Received: from ag-out-0708.google.com (ag-out-0708.google.com [72.14.246.250]) by core3.amsl.com (Postfix) with ESMTP id E89133A6970 for ; Sat, 10 May 2008 11:05:14 -0700 (PDT) Received: by ag-out-0708.google.com with SMTP id 26so1343242agb.12 for ; Sat, 10 May 2008 11:05:12 -0700 (PDT) Received: by 10.70.70.12 with SMTP id s12mr7519430wxa.11.1210426944164; Sat, 10 May 2008 06:42:24 -0700 (PDT) Received: from ?192.168.1.2? ( [24.125.2.79]) by mx.google.com with ESMTPS id h10sm7257009wxd.2.2008.05.10.06.42.22 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sat, 10 May 2008 06:42:22 -0700 (PDT) Message-ID: <4825A63D.8000703@gmail.com> Date: Sat, 10 May 2008 09:42:21 -0400 From: George Jones User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: opsec wg mailing list Subject: [OPSEC] Cymru ICMP gudance X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org FYI, to those looking at ICMP filtering http://www.cymru.com/Documents/icmp-messages.html ---George _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue May 13 08:46:10 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A5B13A6C3C; Tue, 13 May 2008 08:46:10 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D1323A6C3C for ; Tue, 13 May 2008 08:46:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0f1NFqIWCRCS for ; Tue, 13 May 2008 08:46:08 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id F03813A6C3A for ; Tue, 13 May 2008 08:45:58 -0700 (PDT) Received: from [192.103.16.227] ([192.103.16.227]) (authenticated bits=0) by nagasaki.bogus.com (8.14.2/8.14.2) with ESMTP id m4DFjm9q089479 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 13 May 2008 15:45:49 GMT (envelope-from joelja@bogus.com) Message-ID: <4829B79D.7060709@bogus.com> Date: Tue, 13 May 2008 08:45:33 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/7110/Tue May 13 14:12:33 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] Source Address Verification (savi) draft-mcpherson-savi-threat-scope-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org http://tools.ietf.org/html/draft-mcpherson-savi-threat-scope-00.txt Anyone care to comment? _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue May 13 12:08:02 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93E833A695A; Tue, 13 May 2008 12:08:02 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 44A553A693F; Tue, 13 May 2008 12:08:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.497 X-Spam-Level: X-Spam-Status: No, score=-2.497 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id COMeHceft6BO; Tue, 13 May 2008 12:07:57 -0700 (PDT) Received: from co300216-co-outbound.avaya.com (co300216-co-outbound.net.avaya.com [198.152.13.100]) by core3.amsl.com (Postfix) with ESMTP id EBA3A3A6995; Tue, 13 May 2008 12:07:53 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.27,480,1204520400"; d="scan'208";a="126423977" Received: from unknown (HELO nj300815-nj-erheast.avaya.com) ([198.152.6.5]) by co300216-co-outbound.avaya.com with ESMTP; 13 May 2008 15:06:05 -0400 X-IronPort-AV: E=Sophos;i="4.27,480,1204520400"; d="scan'208";a="194577830" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.10]) by nj300815-nj-erheast-out.avaya.com with ESMTP; 13 May 2008 15:06:04 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 13 May 2008 21:06:12 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: WG Review: Source Address Validation Improvements (SAVI) Thread-Index: Aci1K8dW4yxk8BkwTqKv2NazjaEkKwAAIUrA From: "Romascanu, Dan (Dan)" To: , "opsec wg mailing list" , "dns directorate" , Subject: [OPSEC] FW: WG Review: Source Address Validation Improvements (SAVI) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----Original Message----- From: ietf-announce-bounces@ietf.org [mailto:ietf-announce-bounces@ietf.org] On Behalf Of IESG Secretary Sent: Tuesday, May 13, 2008 10:00 PM To: ietf-announce@ietf.org Cc: sava@nrc.tsinghua.edu.cn Subject: WG Review: Source Address Validation Improvements (SAVI) A new IETF working group has been proposed in the Internet Area. The IESG has not made any determination as yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by May 20, 2008. Source Address Validation Improvements (SAVI) --------------------------------------------------- Current Status: Proposed Working Group Last modified: 2008-05-09 Co-chairs TBD Internet Area Directors: Jari Arkko Mark Townsley Internet Area Advisor: Jari Arkko Mailing Lists: General Discussion: sava@nrc.tsinghua.edu.cn To Subscribe: http://mail.nrc.tsinghua.edu.cn/cgi-bin/mailman/listinfo/sava Mailing List Archive: http://mail.nrc.tsinghua.edu.cn/pipermail/sava/ While ingress filtering [RFC 2827, BCP 38] provides a way to validate IP source addresses at an aggregated level, there is not yet a standardized mechanism for IP source address validation at a finer granularity. Having a finer granularity would be helpful in a number of situations, including filtering traffic from customer interfaces implemented as ports in a layer 3 aware bridge or a router, general improvements in filtering accuracy in enterprise networks, etc. Depending on the situation, there may be a requirement for blocking spoofed packets or merely logging packets that appear to be spoofed. Partial solutions exist to prevent nodes from spoofing the IP source address of another node in the same IP link (e.g., the "IP source guard"), but are proprietary. The purpose of the proposed "Source Address Validation Improvements" working group is to standardize mechanisms that prevent nodes attached to the same IP link from spoofing each other's IP addresses. The scope of the WG is as follows: - The working group considers only solutions implemented on systems located on the same IP link as a to-be-verified node. The goal of the working group is the LAN environment and solutions running in routers or layer 3 aware Ethernet bridges. - Both IPv4 and IPv6 need to be covered. - The first goal of the working group is on unicast traffic, but using the same mechanisms to police multicast traffic is also within the scope. - All address assignment mechanisms need to be supported, including stateless, stateful, and manual configuration; as well as privacy and cryptographically generated addresses. - Solutions are preferably based on observing user traffic, or on observing or using existing signaling protocols. Examples of protocols that can be useful to observe/use are ARP, Neighbor Discovery, DHCP, and DHCP Prefix Delegation protocols. Observing addresses in IP headers can also be useful. The gathered information is used to determine what IP source addresses in packets are appropriate. Where automatic operation is impossible or would lead to sub-optimal validation results, solutions may require manual configuration. - Interdomain scenarios (across Autonomous Systems) that require information from routing protocols like BGP are out of scope. Nevertheless, solution may observe routing protocol signaling to detect that a device is a router. - Tracking other protocols is not within the scope of the WG. - No changes to hosts are allowed. - The WG is prohibited from creating its own protocols or extensions/modifications of current protocols. These limitations in the scope may be relaxed through later rechartering. For instance, solutions tailored for PPP links and specific environments such as DSL may be added later, or solutions involving co-operation of the nodes on the link may be developed once the baseline solutions have been completed. In order to reach a result that is widely usable and unlikely to disturb existing network practices, the working group needs to take into account - nodes that use static addresses, - nodes with multiple IP addresses on the same interface, - nodes that use multiple link-layer addresses on the same interface, - nodes that have multiple interfaces to the same link, - attachment of another bridge at a bridge port, - presence of routers, NATs, and other similar devices on the same link, including their distinction from hosts with multiple interfaces or hosts with multiple IP addresses on a single interface, - use of SEcure Neighbor Discovery in some networks, - nodes that move to another port on the same link, and - hosts with anycast addresses. However, should such wide applicability turn out to be impossible, the working group will document the limitations of the solutions in due manner. In particular, it is likely that anycast addressing and nodes that employ multiple interfaces for load balancing at link layer are indistinguishable from an actual spoofing attack. There may also be a difference in the applicability between blocking and merely logging spoofed packets. In any case, the solutions may require to be explicitly turned on for each network or interface where they are applicable. For background information, the working group will also develop a threats analysis document that describes what threats the solutions from the WG protect against. This document also contrasts SAVI to existing solutions. Milestones: Jun 08 WG approval Jul 08 First WG draft on threats document Oct 08 First WG draft on IPv4 solution Oct 08 First WG draft on IPv6 solution Oct 08 Submit document on threats to IESG for Informational RFC Mar 09 Submit IPv4 solution to IESG for Proposed Standard May 09 Submit IPv6 solution to IESG for Proposed Standard _______________________________________________ IETF-Announce mailing list IETF-Announce@ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue May 13 16:37:10 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A7F6D3A69B7; Tue, 13 May 2008 16:37:10 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 26BB63A6922 for ; Tue, 13 May 2008 16:37:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oIT3bErmw9PA for ; Tue, 13 May 2008 16:37:08 -0700 (PDT) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id 6330F3A69A5 for ; Tue, 13 May 2008 16:37:08 -0700 (PDT) Received: by dog.tcb.net (Postfix, from userid 0) id A330E268028; Tue, 13 May 2008 13:50:17 -0600 (MDT) Received: from [192.168.1.103] (VDSL-151-118-146-11.DNVR.QWEST.NET [151.118.146.11]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; Tue, 13 May 2008 13:50:17 -0600 (MDT) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=151.118.146.11; client-port=59783; syn-fingerprint=65535:55:1:64:M1316,N,W3,N,N,T,S; data-bytes=0 Message-Id: From: Danny McPherson To: Joel Jaeggli In-Reply-To: <4829B79D.7060709@bogus.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 13 May 2008 13:50:02 -0600 References: <4829B79D.7060709@bogus.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] Source Address Verification (savi) draft-mcpherson-savi-threat-scope-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On May 13, 2008, at 9:45 AM, Joel Jaeggli wrote: > http://tools.ietf.org/html/draft-mcpherson-savi-threat-scope-00.txt > > Anyone care to comment? I'll comment.. That was posted prematurely _during the last IETF, mainly to document the MITM attack and that being a primary driver for SAVI work, and that I-D needs a ton of work. Comments welcome, Pekka and others have provided some good feedback already I need to incorporate. -danny /hand waving _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat May 17 19:50:03 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EDC53A6D05; Sat, 17 May 2008 19:50:03 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6CA163A6D06 for ; Sat, 17 May 2008 19:49:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.808 X-Spam-Level: X-Spam-Status: No, score=0.808 tagged_above=-999 required=5 tests=[SARE_RECV_SPEEDY_AR=0.808] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NBBTOS4BWvdw for ; Sat, 17 May 2008 19:49:58 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 9AEF23A6D05 for ; Sat, 17 May 2008 19:49:57 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id C0ACE5A8CEF; Sat, 17 May 2008 23:50:01 -0300 (ART) Received: from notebook.gont.com.ar (201-254-50-15.speedy.com.ar [201.254.50.15] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.14.1/8.13.8) with ESMTP id m4I2neNO022072; Sat, 17 May 2008 23:49:42 -0300 Message-Id: <200805180249.m4I2neNO022072@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sat, 17 May 2008 23:46:40 -0300 To: Joel Jaeggli From: Fernando Gont In-Reply-To: <48214D92.7060403@bogus.com> References: <200803302248.m2UMmhSn014472@venus.xmundo.net> <48214D92.7060403@bogus.com> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sat, 17 May 2008 23:50:00 -0300 (ART) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 03:34 a.m. 07/05/2008, Joel Jaeggli wrote: >I think, given the commentary over the last month that this is worth >accepting as a working group document. I think it's pretty clear >that there were some comments regarding the structure but relatively >little regarding the content, which is consistent with what we >discussed prior to IETF 71. [catching-up with e-mail... sorry for the delay in my response] Should we resubmit the draft as draft-ietf? Thanks! Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun May 18 01:28:53 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C14A3A6D6A; Sun, 18 May 2008 01:28:53 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDDBC3A6A3D for ; Sun, 18 May 2008 01:28:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.6 X-Spam-Level: X-Spam-Status: No, score=0.6 tagged_above=-999 required=5 tests=[J_CHICKENPOX_35=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ObfdMMF+zOh4 for ; Sun, 18 May 2008 01:28:44 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 061E73A67B5 for ; Sun, 18 May 2008 01:26:17 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 5FCB85A8AA9; Sun, 18 May 2008 05:26:16 -0300 (ART) Received: from notebook.gont.com.ar (157-129-17-190.fibertel.com.ar [190.17.129.157]) (authenticated bits=0) by venus.xmundo.net (8.14.1/8.13.8) with ESMTP id m4I8Q83I015296; Sun, 18 May 2008 05:26:09 -0300 Message-Id: <200805180826.m4I8Q83I015296@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 18 May 2008 05:20:57 -0300 To: "Smith, Donald" , "Fernando Gont" , "Ron Bonica" From: Fernando Gont In-Reply-To: References: <200803302248.m2UMmhSn014472@venus.xmundo.net> <47F24DA0.1090209@juniper.net> <200804012132.m31LWeiB028762@venus.xmundo.net> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sun, 18 May 2008 05:26:14 -0300 (ART) Cc: opsec wg mailing list Subject: Re: [OPSEC] New I-D on ICMP filtering X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hello, Donald, Thanks so much for your detailed feedback! I beg your pardon for the delay in my response. You'll find my comments inline.... >Operational impact if blocked is a bit vauge. >I think there are 6 kinds of "blocking" recommendations we could be >making. > >Blocked towards your device (network element or host). >Blocked through your device. >Blocked from your device. > >Ratelimited towards your device. >Ratelimited through your device. >Ratelimited from your device. I understand what you mean. However, the "operational impact if blocked" could encompass all these cases. If blocking a message breaks something (e.g., blocking "frag needed" breaks PMTUD), then the implications of all the possible six recommendations you mention would be straightforward. I mean, IMHO, there would be no need to include a discussion for what would happen for each of the six approaches you mention. >Somewhere around 2.1.3.1 (redirect datagrams for the network ) >many of the types/codes areas are not filled in. >I would be willing to assist there if your interested. Yes, please do. (This revision of the doc was kinda a "draft of a draft"... most of all meant as a starting point to agree on the structure of the document) >These comments are based on the 4/16/2008 version. > >2.1.1.1.1 "router can not forward a packet because it has no routes" >Does not include the concept of BGP triggered blackhole. In that case >the router does have a route but the route leads to /dev/null. A lookup >in the cef or forwarding table usually results in 0 being returned so it >is a route but it is a null route:) Agreed. Will add some text about this. If you have any text that I could cut&paste into the doc, that would be even better. :-) >2.1.1.6.1 >Many ISPs block or ignore source route. As do many enterprises. Most of >those that are blocking or ignoring are also not sending source route >failed icmp error msgs. Do they send any ICMP error messages in response? >2.1.1.7 destination netwokr unknown (code 6) (Deprecated). >Since this is deprecated do we need to make any suggestions? >Is it still acted upon? I think we should. While these messages may be deprecated, you may stil encounter one of them, thus you should still decide waht to do if that happens. >2.1.1.10.3 Threats >"May reveal filtering policies" seems to be the same as network mapping >or prehaps it should be network policy mapping. >I would like to see the same text used if possible through the document. Agreed. Will do. >2.1.1.14.3 Threats >Negative scan, reflective attacks, possibly blind resets? Agreed for negative scan and reflective attacks. As for blind resets, this is already noted in the draft. >2.1.1.15.3 Threats >Network policy mapping from the inside of the network? >I am not sure that is very valid. You could map the policy of an ISPs >edge. Not sure what you mean.... >2.1.4.1.4 Impact: >I agree it breaks traceroute. I don't think it leads to long delays.... If you're trying to establish a TCP conenction using some specific IP destination address, and there's a routing loop somewhere en-route, you'll probably get one of these ICMP soft errors, which could have provided a hint to abort the conenction request and try some of the other IP addresses returned by the DNS. P.S.: As you will have noted, I responded to only those comments to which I had anything to add. (That is, unless stated otherwise, the response is "will do" :-) ). Thanks! -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun May 18 03:15:47 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B34B3A69E7; Sun, 18 May 2008 03:15:47 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D3F93A68C9 for ; Sun, 18 May 2008 03:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.3 X-Spam-Level: X-Spam-Status: No, score=0.3 tagged_above=-999 required=5 tests=[AWL=0.300] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eroe2lrxxM5X for ; Sun, 18 May 2008 03:15:44 -0700 (PDT) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 5F6733A6886 for ; Sun, 18 May 2008 03:15:43 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 489515A8C04; Sun, 18 May 2008 07:15:43 -0300 (ART) Received: from notebook.gont.com.ar (157-129-17-190.fibertel.com.ar [190.17.129.157]) (authenticated bits=0) by venus.xmundo.net (8.14.1/8.13.8) with ESMTP id m4IAFV1B024077; Sun, 18 May 2008 07:15:35 -0300 Message-Id: <200805181015.m4IAFV1B024077@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 18 May 2008 07:12:49 -0300 To: opsec wg mailing list From: Fernando Gont Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sun, 18 May 2008 07:15:42 -0300 (ART) Cc: Guillermo Gont Subject: [OPSEC] Proposed changes for the ICMP filtering I-D X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hello, folks, We are working on a revision of the ICMP filtering draft (http://www.gont.com.ar/drafts/icmp-filtering/draft-gont-opsec-icmp-filtering-00.txt). We'd like to get some input on a few issues relevant to the document structure: 1) Reducing the amount of text about message specifications One of the comments we got on the was that the document provides too many details wrt to the specification of messages. We're planning to reduce the amount of text by simply providing pointers to the specs, without any discussion of the referenced text. For example, the current text in Section 2.1.1.1.1: " Defined in [RFC0792]. Section 4.3.3.1 of [RFC1812] states that if a router cannot forward a packet because it has no routes at all (including no default route) to the destination specified in the packet, then the router MUST generate a Destination Unreachable, Code 0 (Network Unreachable) ICMP message. Section 3.2.2.1 of [RFC1122] states that this message may result from a routing transient, and MUST therefore be interpreted as only a hint, not proof, that the specified destination is unreachable. For example, it MUST NOT be used as proof of a dead gateway. Section 4.2.3.9 of [RFC1122] states that this message indicates a soft error, and therefore TCP MUST NOT abort the connection, and SHOULD make the information available to the application." would become something like: " Specified in [RFC0792], Section 4.3.3.1 of [RFC1812], Section 3.2.2.1 of [RFC1122], and Section 4.2.3.9 of [RFC1122]" We could even completely remove section numbers... although I'd prefer not to (documents like RFC1122 and RFC1812 are simply too large for a loose reference to them being useful). 2) Providing advice on ICMP filtering at end-systems We had originally thought about the draft discussing ICMP filtering in forwarding devices, and not in end-systems. However, some feedback from Donald Smith somehow raised the question (in my head, if you want :-) ) on whether the doc should provide advice on ICMP filtering when ICMP messages are destined to or originated at the router itself. That is, we might provide advice on what to do with ICMP messages at a finer granularity: ICMP messages originating at the device, messages that go through the device, and messages destined to the the device. We'd like to know what's the opinion of the wg about this. 3) "Operational/Interoperability implications if blocked" The current text discusses what you may break if you filter each of the ICMP type/codes. Donald pointed out that this might be a little bit vague. I personally think that this section could be kept "as is". My rationale is that if blocking a message breaks something (e.g., blocking "frag needed" breaks PMTUD), then the implications of rate-limiting, and filtering message to/from/through a router are straightforward. However, input from the wg on this issue would be welcome, so that we agree on the basic structure of the document before committing too many cycles in a wrong direction. 4) Informational vs. BCP The current version of the doc is meant for the Informational track. While talking with Carlos Pignataro, we realized that "BCP" might be a more appropriate track for this draft. We'd like input on this one, too. :-) Thanks! Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed May 21 13:16:24 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 580ED3A6B9D; Wed, 21 May 2008 13:16:24 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 464463A6B98 for ; Wed, 21 May 2008 13:16:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hhU608lV-dZH for ; Wed, 21 May 2008 13:16:22 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 2D7C63A6BAE for ; Wed, 21 May 2008 13:16:21 -0700 (PDT) Received: from [10.203.2.9] (137-200.104-92.cust.bluewin.ch [92.104.200.137]) (authenticated bits=0) by nagasaki.bogus.com (8.14.2/8.14.2) with ESMTP id m4LKGL6p096556 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 21 May 2008 20:16:24 GMT (envelope-from joelja@bogus.com) Message-ID: <48348315.9080907@bogus.com> Date: Wed, 21 May 2008 13:16:21 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/7198/Wed May 21 14:42:57 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] Should we schedule a meeting at 72? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org My own personal opinion on the subject is somewhat ambivalent. Pekka raised some questions as to the fate of outstanding expired drafts, Fernando has a draft. SAVI was proposed as a working group. Are there other things that people would like to bring up? joelja _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From owner-opsec@psg.com Thu May 22 04:12:13 2008 Return-Path: X-Original-To: ietfarch-opsec-archive-cahC7ahG@core3.amsl.com Delivered-To: ietfarch-opsec-archive-cahC7ahG@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 70C103A6BAD for ; Thu, 22 May 2008 04:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.437 X-Spam-Level: X-Spam-Status: No, score=-4.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sr7+uDKkdQzO for ; Thu, 22 May 2008 04:12:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 675383A6A55 for ; Thu, 22 May 2008 04:11:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Jz8WR-000LvL-4H for opsec-data@psg.com; Thu, 22 May 2008 10:59:47 +0000 Received: from [129.83.20.191] (helo=smtp-bedford.mitre.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Jz8Vx-000LqP-84 for opsec@ops.ietf.org; Thu, 22 May 2008 10:59:32 +0000 Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m4MAxGnS024705 for ; Thu, 22 May 2008 06:59:16 -0400 Received: from imcfe2.MITRE.ORG (imcfe2.mitre.org [129.83.29.4]) by smtp-bedford.mitre.org (8.13.1/8.13.1) with ESMTP id m4MAxGJ7024702 for ; Thu, 22 May 2008 06:59:16 -0400 Received: from [127.0.0.1] ([129.83.10.1]) by imcfe2.MITRE.ORG with Microsoft SMTPSVC(6.0.3790.1830); Thu, 22 May 2008 06:59:16 -0400 Message-ID: <48355203.40701@mitre.org> Date: Thu, 22 May 2008 06:59:15 -0400 From: George M Jones User-Agent: Thunderbird 2.0.0.14 (X11/20080505) MIME-Version: 1.0 To: opsec@ops.ietf.org Subject: Final notice: this list has moved to opsec@ietf.org Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms050506060102040308090709" X-OriginalArrivalTime: 22 May 2008 10:59:16.0074 (UTC) FILETIME=[E06124A0:01C8BBFA] Sender: owner-opsec@psg.com Precedence: bulk This is a cryptographically signed message in MIME format. --------------ms050506060102040308090709 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit This list (opsec@ops.ietf.org) has moved to opsec@ietf.org. You should (be) subscribe(ed) to that list if you want to participate in working group discussions. See https://www.ietf.org/mailman/listinfo/opsec I am about to completely disable this list, leaving only the archives http://www.ops.ietf.org/lists/opsec/ Thanks to Randy for hosting this for all these years and thanks to all who participated. ---George Jones --------------ms050506060102040308090709 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIKtDCC A2IwggJKoAMCAQICAhr0MA0GCSqGSIb3DQEBBQUAMF0xEjAQBgNVBAoTCW1pdHJlLm9yZzEe MBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MScwJQYDVQQDEx5NSVRSRSBDb3Jwb3Jh dGlvbiBQcmltYXJ5IENBLTEwHhcNMDgwNTE1MTMyODAzWhcNMDkxMTA2MTMyODAzWjBVMRIw EAYDVQQKEwltaXRyZS5vcmcxDzANBgNVBAsTBnBlb3BsZTEXMBUGCgmSJomT8ixkAQETB2dt am9uZXMxFTATBgNVBAMTDEpvbmVzIEdlb3JnZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC gYEAvvuK5LMBKD9+aoiB+pXKUU0vYzdpIwI8J0K8zNnVCxpHMoGVP+5MbpefUAIzN0HV3eoj oT/RGhuXbGvXjEVa8XhgvGwT4J15tZHZECJCy4M0zDKBFNHe7WDQAGXSx38saKJIT+Vjy83E IwdNfZXBmTYe0Dr3MFENZdJfmrb2FfECAwEAAaOBtzCBtDAOBgNVHQ8BAf8EBAMCBeAwHQYD VR0OBBYEFEHpRTtfNhGgSg1Km/0x+R0p0IYTMB8GA1UdIwQYMBaAFIe0D0iNYjNCwS1RGkge wp67CrGtMEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly93d3cubWl0cmUub3JnL3RlY2gvbWlp L3BraS9jYTFfbWl0cmVfb3JnLmNybDAcBgNVHREEFTATgRFnbWpvbmVzQG1pdHJlLm9yZzAN BgkqhkiG9w0BAQUFAAOCAQEATbD7vI6JMnlhAbFYbVNb5Yu0kMW1tnpX77i1yMJ5BJBgh6Rl F89ELFjoPhrgeN0udKmrLd+2a/E0C1w6JhuXkgDuqqtePjOFM4j8wLiJjk+uBldLnZycQ8XC wOROWQ/5y11Fwk067fJi1fA6Vuw28O3iG84GI4KqjArd7BOektNswXwxM5SC4qUmcguiQp7D mMiD1hd0IEZyLwBBjdQ2YN2sU6ynOOsMkfHXRZnyd2Abrry3xesetG5sm/6jO2TQNL31XQM8 F7VzdvNxCxlnUiRRu1vXHMBS+aNffrY4b6+UBPLKPbzSrMHTa3800Bs49/o67205Mx9nrZKf ITpWIjCCA2IwggJKoAMCAQICAhr0MA0GCSqGSIb3DQEBBQUAMF0xEjAQBgNVBAoTCW1pdHJl Lm9yZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MScwJQYDVQQDEx5NSVRSRSBD b3Jwb3JhdGlvbiBQcmltYXJ5IENBLTEwHhcNMDgwNTE1MTMyODAzWhcNMDkxMTA2MTMyODAz WjBVMRIwEAYDVQQKEwltaXRyZS5vcmcxDzANBgNVBAsTBnBlb3BsZTEXMBUGCgmSJomT8ixk AQETB2dtam9uZXMxFTATBgNVBAMTDEpvbmVzIEdlb3JnZTCBnzANBgkqhkiG9w0BAQEFAAOB jQAwgYkCgYEAvvuK5LMBKD9+aoiB+pXKUU0vYzdpIwI8J0K8zNnVCxpHMoGVP+5MbpefUAIz N0HV3eojoT/RGhuXbGvXjEVa8XhgvGwT4J15tZHZECJCy4M0zDKBFNHe7WDQAGXSx38saKJI T+Vjy83EIwdNfZXBmTYe0Dr3MFENZdJfmrb2FfECAwEAAaOBtzCBtDAOBgNVHQ8BAf8EBAMC BeAwHQYDVR0OBBYEFEHpRTtfNhGgSg1Km/0x+R0p0IYTMB8GA1UdIwQYMBaAFIe0D0iNYjNC wS1RGkgewp67CrGtMEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly93d3cubWl0cmUub3JnL3Rl Y2gvbWlpL3BraS9jYTFfbWl0cmVfb3JnLmNybDAcBgNVHREEFTATgRFnbWpvbmVzQG1pdHJl Lm9yZzANBgkqhkiG9w0BAQUFAAOCAQEATbD7vI6JMnlhAbFYbVNb5Yu0kMW1tnpX77i1yMJ5 BJBgh6RlF89ELFjoPhrgeN0udKmrLd+2a/E0C1w6JhuXkgDuqqtePjOFM4j8wLiJjk+uBldL nZycQ8XCwOROWQ/5y11Fwk067fJi1fA6Vuw28O3iG84GI4KqjArd7BOektNswXwxM5SC4qUm cguiQp7DmMiD1hd0IEZyLwBBjdQ2YN2sU6ynOOsMkfHXRZnyd2Abrry3xesetG5sm/6jO2TQ NL31XQM8F7VzdvNxCxlnUiRRu1vXHMBS+aNffrY4b6+UBPLKPbzSrMHTa3800Bs49/o67205 Mx9nrZKfITpWIjCCA+QwggLMoAMCAQICAQUwDQYJKoZIhvcNAQEFBQAwWjESMBAGA1UEChMJ bWl0cmUub3JnMR4wHAYDVQQLExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJDAiBgNVBAMTG01J VFJFIENvcnBvcmF0aW9uIFJvb3QgQ0EtMTAeFw0wNjA2MDMxNzEzMjJaFw0xMjA2MDMxNzEz MjJaMF0xEjAQBgNVBAoTCW1pdHJlLm9yZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9y aXR5MScwJQYDVQQDEx5NSVRSRSBDb3Jwb3JhdGlvbiBQcmltYXJ5IENBLTEwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI8HtWXRCCqBC3S7xDZ25Gzt5lQ+eGV+Uo8U8xcYb6 KoakiZizqd9sU+yfSrwWqSUWyb9QRXYklDdztKvB+up70KsJtUWHvrU7Fkjt+dRaJRqw0/Yg 0bX1oB+tDwigmwAS0bMd4hpxL4zkI3gLTJ9QLoKkFlNz1mV2MtRq28mvjTsrWL7taetGwxUq EgJ+CaI79eJVH1h5fLN5GoWsvLpi0kIm4l3RBF/Aq0pGl6TmhTrsjOvsKUcO08mztQ5OMxgF LZ9PPO0L7DA5Onr4DdlsTKa5BwBlHCYaSNUF7ZHwyJfbpHTYiKDP73TdkAv/pum/HQOeSuVH ZQWvUoEZ8GqZAgMBAAGjgbEwga4wEgYDVR0TAQH/BAgwBgEB/wIBAjAOBgNVHQ8BAf8EBAMC AYYwHQYDVR0OBBYEFIe0D0iNYjNCwS1RGkgewp67CrGtMB8GA1UdIwQYMBaAFMdwUQDYTf7k AdRolsU9n5qX/nQvMEgGA1UdHwRBMD8wPaA7oDmGN2h0dHA6Ly93d3cubWl0cmUub3JnL3Rl Y2gvbWlpL3BraS9yb290Y2ExX21pdHJlX29yZy5jcmwwDQYJKoZIhvcNAQEFBQADggEBAE1u buuuKezdIgI9u15f2pI3X5EkKWqLH+nDcgB7u7rQsrRX2NVn0TZr5zQxmJKiN1zBTmtfEjY4 jbDAh/rBUGjvqMg5z4iJBGUL5Xxhq0aaiJuo//xYM/OW539ZADOSOtTae6Hwp3Ikb6fWQf/r vvYtutrYIiTya7wXKl5oHk/a4gnN0T48ajzZmLJTrzS6SIn3IXpSYRe5yIHvu0ZAFHEyXp4/ MisCtCd/jxKYGEUPldgutq546IbsT4DMP32KDUzpYdzFZe2ncMitWoT8NmvXjo0loJaqD02g TXhyakSWWelYu0ueflQFgn5AKjOZt7VIlc47KdnRXEycZ2Hs2qAxggK1MIICsQIBATBjMF0x EjAQBgNVBAoTCW1pdHJlLm9yZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MScw JQYDVQQDEx5NSVRSRSBDb3Jwb3JhdGlvbiBQcmltYXJ5IENBLTECAhr0MAkGBSsOAwIaBQCg ggGoMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA4MDUyMjEw NTkxNVowIwYJKoZIhvcNAQkEMRYEFAhj0uiVvSOi6g6lJRgEcOKXozC2MF8GCSqGSIb3DQEJ DzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG 9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDByBgkrBgEEAYI3EAQxZTBjMF0xEjAQ BgNVBAoTCW1pdHJlLm9yZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MScwJQYD VQQDEx5NSVRSRSBDb3Jwb3JhdGlvbiBQcmltYXJ5IENBLTECAhr0MHQGCyqGSIb3DQEJEAIL MWWgYzBdMRIwEAYDVQQKEwltaXRyZS5vcmcxHjAcBgNVBAsTFUNlcnRpZmljYXRlIEF1dGhv cml0eTEnMCUGA1UEAxMeTUlUUkUgQ29ycG9yYXRpb24gUHJpbWFyeSBDQS0xAgIa9DANBgkq hkiG9w0BAQEFAASBgGlbutLnmJzqFrqwP732eO3PYv/LfrpPojwcuqD8Dvw7qjF8iDcXQzIg KfpO+QHD+mpEVIVhQx92w7eEmnzGSS8IgEz3O4rJ3o3lT7v58KH01WayOehc3KTabL5UVB1C bE2sXJr38qrMnfx+0tTUdhGZTKH0XWDtLDMuQ2rkYXhaAAAAAAAA --------------ms050506060102040308090709-- From opsec-bounces@ietf.org Thu May 22 15:26:04 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D12E83A6B63; Thu, 22 May 2008 15:26:04 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0A1B3A6B54 for ; Thu, 22 May 2008 15:26:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4AUcmcUZRBZl for ; Thu, 22 May 2008 15:26:03 -0700 (PDT) Received: from exprod7og105.obsmtp.com (exprod7og105.obsmtp.com [64.18.2.163]) by core3.amsl.com (Postfix) with ESMTP id CC3413A6B4E for ; Thu, 22 May 2008 15:26:01 -0700 (PDT) Received: from source ([66.129.224.36]) by exprod7ob105.postini.com ([64.18.6.12]) with SMTP; Thu, 22 May 2008 15:20:32 PDT Received: from proton.jnpr.net ([10.10.2.37]) by gamma.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Thu, 22 May 2008 15:16:36 -0700 Received: from [172.23.1.66] ([172.23.1.66] RDNS failed) by proton.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Thu, 22 May 2008 18:16:35 -0400 Message-ID: <4835F0BF.6010104@juniper.net> Date: Thu, 22 May 2008 18:16:31 -0400 From: Ron Bonica User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Joel Jaeggli References: <48348315.9080907@bogus.com> In-Reply-To: <48348315.9080907@bogus.com> X-Enigmail-Version: 0.93.0.0 X-OriginalArrivalTime: 22 May 2008 22:16:35.0599 (UTC) FILETIME=[7F6C89F0:01C8BC59] Cc: opsec wg mailing list Subject: Re: [OPSEC] Should we schedule a meeting at 72? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Folks, Give that we didn't meet in Philadelphia, I think that we should get together in Dublin, even if only to discuss Fernando's draft. Maybe we could schedule a one-hour meeting slot. Ron Joel Jaeggli wrote: > My own personal opinion on the subject is somewhat ambivalent. Pekka > raised some questions as to the fate of outstanding expired drafts, > Fernando has a draft. SAVI was proposed as a working group. > > Are there other things that people would like to bring up? > > joelja > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri May 23 07:28:04 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3140E28C29F; Fri, 23 May 2008 07:28:04 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E829728C29F for ; Fri, 23 May 2008 07:28:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RUukhYtNbGxQ for ; Fri, 23 May 2008 07:28:02 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id EC3D128C29E for ; Fri, 23 May 2008 07:28:01 -0700 (PDT) Received: from [10.40.111.236] ([194.209.131.192]) (authenticated bits=0) by nagasaki.bogus.com (8.14.2/8.14.2) with ESMTP id m4NERucD004220 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 23 May 2008 14:27:59 GMT (envelope-from joelja@bogus.com) Message-ID: <4836D466.2010406@bogus.com> Date: Fri, 23 May 2008 07:27:50 -0700 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.12 (X11/20080226) MIME-Version: 1.0 To: Ron Bonica References: <48348315.9080907@bogus.com> <4835F0BF.6010104@juniper.net> In-Reply-To: <4835F0BF.6010104@juniper.net> X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/7221/Fri May 23 11:56:17 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] Should we schedule a meeting at 72? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Ron Bonica wrote: > Folks, > > Give that we didn't meet in Philadelphia, I think that we should get > together in Dublin, even if only to discuss Fernando's draft. Maybe we > could schedule a one-hour meeting slot. I have requested a 1 hour slot. > Ron > > > Joel Jaeggli wrote: >> My own personal opinion on the subject is somewhat ambivalent. Pekka >> raised some questions as to the fate of outstanding expired drafts, >> Fernando has a draft. SAVI was proposed as a working group. >> >> Are there other things that people would like to bring up? >> >> joelja >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec