From opsec-bounces@ietf.org Sat Nov 1 16:22:55 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BC45A3A6866; Sat, 1 Nov 2008 16:22:55 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04AD23A6866 for ; Sat, 1 Nov 2008 16:22:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eb8Rh+DXh+t5 for ; Sat, 1 Nov 2008 16:22:50 -0700 (PDT) Received: from omzesmtp01a.verizonbusiness.com (omzesmtp01a.verizonbusiness.com [199.249.25.195]) by core3.amsl.com (Postfix) with ESMTP id 503363A67E4 for ; Sat, 1 Nov 2008 16:22:50 -0700 (PDT) Received: from pmismtp04.wcomnet.com ([166.37.158.164]) by firewall.verizonbusiness.com (Sun Java(tm) System Messaging Server 6.3-5.02 (built Oct 12 2007; 32bit)) with ESMTP id <0K9O00M4KGXZE300@firewall.verizonbusiness.com> for opsec@ietf.org; Sat, 01 Nov 2008 23:22:48 +0000 (GMT) Received: from pmismtp04.wcomnet.com ([127.0.0.1]) by pmismtp04.mcilink.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005)) with SMTP id <0K9O009MZGXZBO@pmismtp04.mcilink.com> for opsec@ietf.org; Sat, 01 Nov 2008 23:22:47 +0000 (GMT) Received: from ASHSRV142.mcilink.com ([153.39.68.168]) by pmismtp04.mcilink.com (iPlanet Messaging Server 5.2 HotFix 2.08 (built Sep 22 2005)) with ESMTP id <0K9O00B2AGXZAO@pmismtp04.mcilink.com> for opsec@ietf.org; Sat, 01 Nov 2008 23:22:47 +0000 (GMT) Received: from ASHEVS004.mcilink.com ([153.39.69.133]) by ASHSRV142.mcilink.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 01 Nov 2008 23:22:47 +0000 Date: Sat, 01 Nov 2008 23:22:05 +0000 From: "Langer, Anthony J" To: opsec@ietf.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message Thread-topic: non malicious icmp - growing probability of encountering with mpls vpns Thread-index: Ack8eKdlSX5IAzuoQCmxfQ++V1mHKQ== X-MS-Has-Attach: X-MS-TNEF-Correlator: X-OriginalArrivalTime: 01 Nov 2008 23:22:47.0799 (UTC) FILETIME=[C05F6870:01C93C78] Subject: [OPSEC] non malicious icmp - growing probability of encountering with mpls vpns X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1086924071==" Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org This is a multi-part message in MIME format. --===============1086924071== Content-type: multipart/alternative; boundary="----_=_NextPart_001_01C93C78.A7DDDE71" Content-class: urn:content-classes:message This is a multi-part message in MIME format. ------_=_NextPart_001_01C93C78.A7DDDE71 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Per the request of Ron Bonica (note email thread below), please note responses from the front line Service Provider Operations technician regarding the below excellent drafts: =20 draft-ietf-opsec-icmp-filtering-00 and draft-gont-opsec-ip-security-01: =20 =20 Consideration of non malicious ICMP attacks in MPLS VPN Service Provider space: =20 Historically peering with the Service provider has been limited to layer 2 Frame Relay and ATM. ICMP was handled 100% by the customer's cpu cycles. With the proliferation of MPLS VPN's the service provider's CPU resources can now be impacted by non malicious ICMP from the from the Customer Edge router (CE) to the Service Provider Edge router (PE). =20 A good example of this is upon turn up of a new MPLS VPN connection. The CE focused operations center uses ICMP to drive traffic. This is done to verify that the segment from the CE to PE is running without error and they are getting the bandwidth in the contract. =20 =20 If you take this example and apply it to a DS3 and above PE to CE circuit, then you are well in the zone for a non malicious ICMP attack. =20 Topology and OSI model peering considerations are a key in understanding and targeting potential non malicious ICMP attacks. Anthony Langer =20 ------email thread from Ron Bonica------------- =20 Hi Anthony, =20 There are two very important drafts working in OPSEC right now. They address very elementary stuff and could use review from somebody like you. They are: =20 - draft-ietf-opsec-icmp-filtering-00 - draft-gont-opsec-ip-security-01 =20 Could you take a look and provide comments to the mailing list? =20 Ron =20 =20 Anthony Langer=20 Tier II Global Data Network Operations Email: anthony.langer@verizonbusiness.com Telephone: (919) 377-7141 Vnet: 966-7141 Verizon Business - global capability, personal accountability. =20 =20 ------_=_NextPart_001_01C93C78.A7DDDE71 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Per the request of Ron Bonica (note email thread below), please = note responses from the front line Service Provider Operations technician = regarding the below excellent drafts:

 

draft-ietf-opsec-icmp-filtering-00 and = draft-gont-opsec-ip-security-01:

 

 

Consideration of non malicious ICMP attacks = in MPLS VPN Service Provider space:

 

Historically peering with the Service provider has been limited = to layer 2 Frame Relay and ATM.  ICMP was handled 100% by the = customer’s cpu cycles.  With the proliferation of MPLS VPN’s the service provider’s CPU resources can now be impacted by non malicious ICMP = from the from the Customer Edge router (CE) to the Service Provider Edge = router (PE).

 

A good example of this is upon turn up of a new MPLS VPN = connection.  The CE focused operations center uses ICMP to drive traffic.  This is = done to verify that the segment from the CE to PE is running without error and = they are getting the bandwidth in the contract.  =

 

If you take this example and apply it to a DS3 and above PE to = CE circuit, then you are well in the zone for a non malicious ICMP = attack.

 

Topology and OSI model peering considerations are a key in understanding and targeting potential non malicious ICMP attacks.

Anthony Langer

 

------email thread from Ron = Bonica-------------

 

Hi Anthony,

 

There are two very important drafts working in OPSEC right now. = They address very elementary stuff and could use review from somebody like = you. They are:

 

- = draft-ietf-opsec-icmp-filtering-00

- draft-gont-opsec-ip-security-01

 

Could you take a look and provide comments to the mailing = list?

 

           = ;            =          Ron

 

 

Anthony Langer

Tier II Global Data Network = Operations

Email: = anthony.langer@verizonbusiness.com

Telephone: (919) 377-7141 Vnet: = 966-7141

Verizon Business – global capability, personal = accountability.

 

 

------_=_NextPart_001_01C93C78.A7DDDE71-- --===============1086924071== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec --===============1086924071==-- From opsec-bounces@ietf.org Sat Nov 1 22:33:54 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E6DDE3A67B5; Sat, 1 Nov 2008 22:33:54 -0700 (PDT) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D84773A67FB for ; Sat, 1 Nov 2008 22:33:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.171 X-Spam-Level: X-Spam-Status: No, score=-1.171 tagged_above=-999 required=5 tests=[AWL=-0.542, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1, SARE_RECV_SPEEDY_AR=0.808] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ozs4ueihv7bI for ; Sat, 1 Nov 2008 22:33:53 -0700 (PDT) Received: from smtp1.xmundo.net (unknown [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 239B63A67B5 for ; Sat, 1 Nov 2008 22:33:52 -0700 (PDT) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 514AF6B658B; Sun, 2 Nov 2008 02:33:56 -0300 (ART) Received: from notebook.gont.com.ar (201-254-57-122.speedy.com.ar [201.254.57.122] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.14.1/8.13.8) with ESMTP id mA25XU4I013302; Sun, 2 Nov 2008 03:33:31 -0200 Message-Id: <200811020533.mA25XU4I013302@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 02 Nov 2008 02:23:28 -0300 To: Joel Jaeggli , opsec wg mailing list From: Fernando Gont In-Reply-To: <490A225A.1020504@bogus.com> References: <490A225A.1020504@bogus.com> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sun, 02 Nov 2008 02:33:54 -0300 (ART) Subject: Re: [OPSEC] Currently on deck for Minneapolis X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 06:08 p.m. 30/10/2008, Joel Jaeggli wrote: >draft-gont-opsec-icmp-filtering Minor comment: this one is now draft-ietf-opsec-icmp-filtering (it has become a wg item). Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Nov 17 12:30:14 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 59F9D3A6A69; Mon, 17 Nov 2008 12:30:14 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 12C913A6A56 for ; Mon, 17 Nov 2008 12:30:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y9xuncYv2Mki for ; Mon, 17 Nov 2008 12:30:12 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 13A063A6A69 for ; Mon, 17 Nov 2008 12:30:11 -0800 (PST) Received: from [130.129.95.241] ([130.129.95.241]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id mAHKU8hO024495 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 17 Nov 2008 20:30:09 GMT (envelope-from joelja@bogus.com) Message-ID: <4921D44F.1050800@bogus.com> Date: Mon, 17 Nov 2008 12:30:07 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.16 (X11/20080723) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.7 X-Virus-Scanned: ClamAV 0.93.3/8643/Mon Nov 17 19:40:22 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] Enhanced schedule for Tomorrow... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org IETF 73 opsec agenda When TUESDAY, November 18, 2008 1520-1700 Afternoon Session II Where Duluth meeting room Agenda Bashing (2 Min) Status update (5 Min) Fernando Gont (20 Min) * http://tools.ietf.org/html?draft=draft-gont-opsec-ip-security * http://tools.ietf.org/html?draft=draft-ietf-opsec-icmp-filtering * ICMP filtering: get consensus on the structure of the document (before it's too late!) * discuss having IP security document adopted as an opsec wg item Gaurav Agarwal for Manav Bhatia and Vishwas Manral (20 Min) * draft-ietf-opsec-routing-protocols-crypto-issues * draft-bhatia-manral-igp-crypto-requirements Joel Jaeggli (10 minutes) * draft-kumari-blackhole-urpf-02 Conclusions _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Mon Nov 17 12:36:34 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7A69E3A6A38; Mon, 17 Nov 2008 12:36:34 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 80B153A6A38 for ; Mon, 17 Nov 2008 12:36:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V8jn+uHOGC4w for ; Mon, 17 Nov 2008 12:36:32 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 64E903A69E3 for ; Mon, 17 Nov 2008 12:36:32 -0800 (PST) Received: from [130.129.95.241] ([130.129.95.241]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id mAHKaToT024733 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 17 Nov 2008 20:36:30 GMT (envelope-from joelja@bogus.com) Message-ID: <4921D5CC.7020303@bogus.com> Date: Mon, 17 Nov 2008 12:36:28 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.16 (X11/20080723) MIME-Version: 1.0 To: opsec wg mailing list References: <4921D44F.1050800@bogus.com> In-Reply-To: <4921D44F.1050800@bogus.com> X-Enigmail-Version: 0.95.7 X-Virus-Scanned: ClamAV 0.93.3/8643/Mon Nov 17 19:40:22 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: Re: [OPSEC] Enhanced schedule for Tomorrow... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Oh btw please send changes/additions corrections and any other topics you might be interested bring in front of the group. Joel Jaeggli wrote: > IETF 73 opsec agenda > > When > TUESDAY, November 18, 2008 > 1520-1700 Afternoon Session II > > Where > Duluth meeting room > > Agenda Bashing (2 Min) > > Status update (5 Min) > > Fernando Gont (20 Min) > > * http://tools.ietf.org/html?draft=draft-gont-opsec-ip-security > > * http://tools.ietf.org/html?draft=draft-ietf-opsec-icmp-filtering > > * ICMP filtering: get consensus on the structure of the document > (before it's too late!) > > * discuss having IP security document adopted as an opsec wg item > > Gaurav Agarwal for Manav Bhatia and Vishwas Manral (20 Min) > > * draft-ietf-opsec-routing-protocols-crypto-issues > > * draft-bhatia-manral-igp-crypto-requirements > > Joel Jaeggli (10 minutes) > > * draft-kumari-blackhole-urpf-02 > > Conclusions > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Nov 18 11:58:19 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C17DB28C115; Tue, 18 Nov 2008 11:58:19 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 77C7228C115 for ; Tue, 18 Nov 2008 11:58:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mXkzQ5CwSImg for ; Tue, 18 Nov 2008 11:58:17 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 7F0743A69CF for ; Tue, 18 Nov 2008 11:58:17 -0800 (PST) Received: from [130.129.95.241] ([130.129.95.241]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id mAIJwDsj084986 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 18 Nov 2008 19:58:14 GMT (envelope-from joelja@bogus.com) Message-ID: <49231E53.3000501@bogus.com> Date: Tue, 18 Nov 2008 11:58:11 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.16 (X11/20080723) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.7 X-Virus-Scanned: ClamAV 0.93.3/8647/Tue Nov 18 15:09:15 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] presenting in meeting. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Can anyone who is presenting be sure and show up early in the break. before afternoon session II. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Nov 19 07:56:55 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8ED673A69AF; Wed, 19 Nov 2008 07:56:55 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A61823A6805 for ; Wed, 19 Nov 2008 07:56:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[none] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RSDgEvz3--wf for ; Wed, 19 Nov 2008 07:56:54 -0800 (PST) Received: from gv-out-0910.google.com (gv-out-0910.google.com [216.239.58.186]) by core3.amsl.com (Postfix) with ESMTP id BFA773A69AF for ; Wed, 19 Nov 2008 07:56:53 -0800 (PST) Received: by gv-out-0910.google.com with SMTP id e6so11132gvc.15 for ; Wed, 19 Nov 2008 07:56:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=rRsNw6890bgKqDmRI52pNbfuj9Jq1l3A33D3jJxpIpY=; b=Nkrv2K3OtIjsNDmoteA41i8C+/lJB+jaxef+TNjVcejl/w6Q4j7hYK1rPDTg5Aqhh3 5VcsYSO7gyUEvCAVyGajroC0Pi2perdNxAyaWID84McxR9ycVcRN/II44AW0i3LIIuJP LuMFU3xHshjrn+SOtnYJiMs5vQ7WGVahYNcX8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=QjAIgydmaZRlLt7dav4GS8gyXhypBUEIjRMjEX347NiVbKCFgOugE+O9Aom51PJVQZ dhMsN+Ihg/jyV/5ijlBNcRX8fP61qpmWiuxyFJRFTMYJNCYPm6pRtIB6s9YUgws5//lf GVSmn+LTH4YrQ/JinR1tlhHHDWNzw7nm/gY00= Received: by 10.103.92.8 with SMTP id u8mr429847mul.12.1227110211821; Wed, 19 Nov 2008 07:56:51 -0800 (PST) Received: by 10.103.160.12 with HTTP; Wed, 19 Nov 2008 07:56:51 -0800 (PST) Message-ID: <92c950310811190756p20d1b989n8a6c3a9e08b2dc74@mail.gmail.com> Date: Wed, 19 Nov 2008 21:26:51 +0530 From: "Glen Kent" To: "opsec wg mailing list" MIME-Version: 1.0 Content-Disposition: inline Subject: [OPSEC] Minutes X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Can somebody please post the minutes of the meeting for the benefit of those who were not present there? Glen _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Nov 19 08:01:26 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7B2E13A6B9A; Wed, 19 Nov 2008 08:01:26 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AED553A6B9A for ; Wed, 19 Nov 2008 08:01:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[none] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VgT2jDCeeo3l for ; Wed, 19 Nov 2008 08:01:24 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id D02523A6AB7 for ; Wed, 19 Nov 2008 08:01:23 -0800 (PST) Received: from [130.129.95.241] ([130.129.95.241]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id mAJG1Hqv039602 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 19 Nov 2008 16:01:19 GMT (envelope-from joelja@bogus.com) Message-ID: <4924384C.6080003@bogus.com> Date: Wed, 19 Nov 2008 08:01:16 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.16 (X11/20080723) MIME-Version: 1.0 To: Glen Kent References: <92c950310811190756p20d1b989n8a6c3a9e08b2dc74@mail.gmail.com> In-Reply-To: <92c950310811190756p20d1b989n8a6c3a9e08b2dc74@mail.gmail.com> X-Enigmail-Version: 0.95.7 X-Virus-Scanned: ClamAV 0.93.3/8650/Wed Nov 19 04:59:50 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] Minutes X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I'm working on coalescing the various bits right now... I pasted some of them into the jabber room yesterday where they still are I belive. The recording should actually be up in the archive fairly shortly as well. joelja Glen Kent wrote: > Can somebody please post the minutes of the meeting for the benefit of > those who were not present there? > > Glen > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Nov 20 21:11:36 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4129C3A6A74; Thu, 20 Nov 2008 21:11:36 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BAD703A6A74 for ; Thu, 20 Nov 2008 21:11:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.949 X-Spam-Level: X-Spam-Status: No, score=-1.949 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y8h1pG-oZBK5 for ; Thu, 20 Nov 2008 21:11:35 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id B29D93A6A6D for ; Thu, 20 Nov 2008 21:11:34 -0800 (PST) Received: from [130.129.77.182] ([130.129.77.182]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id mAL5BTSg041823 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 21 Nov 2008 05:11:31 GMT (envelope-from joelja@bogus.com) Message-ID: <49264301.7060902@bogus.com> Date: Thu, 20 Nov 2008 21:11:29 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.16 (X11/20080723) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.7 X-Virus-Scanned: ClamAV 0.93.3/8656/Thu Nov 20 22:12:54 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] housekeeping details part one - Security Assessment of the Internet Protocol version 4 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I wanted to address this while the ideas are still fresh. I don't think we can really call the questions till I can get at least a skeleton of the minutes out and I'm only about halfway done but The major questions regarding: draft-gont-opsec-ip-security-01.txt are: Test consensus on list for accepting ip security document Areas for improvement in the document Need for cross area review BCP vs proposed standard Others? thanks joel _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Nov 21 00:55:30 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 27BF73A67FF; Fri, 21 Nov 2008 00:55:30 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A35673A67FF for ; Fri, 21 Nov 2008 00:55:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DbG5mCcypgsn for ; Fri, 21 Nov 2008 00:55:29 -0800 (PST) Received: from ik-out-1112.google.com (ik-out-1112.google.com [66.249.90.177]) by core3.amsl.com (Postfix) with ESMTP id AA1D23A67F1 for ; Fri, 21 Nov 2008 00:55:28 -0800 (PST) Received: by ik-out-1112.google.com with SMTP id c29so698176ika.5 for ; Fri, 21 Nov 2008 00:55:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=DMYA2cazAaaHNondT5OJdKooy3P13HIlIvZI1uEwehc=; b=w5QuguGnvSginxWNL7s81oDminj//XcDHouZfv8YIZ5LaCDjgZmswmNqeMtDOK5Y0x cmZzCdAweCc9uk4DaZ28DSEZi68CojbE2LokAhl0V0UGmoNZF88MfAOt3AKuIsPMxH1b ZWkxnWnpB53gYzrBRW05HV0zTBBaCiw+7G3Lg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=WMUEnKphg3eG3AFZM6+nmLsdy8qvDvQ9mQU95FVEsZA5FjHuZe/zBF7WVmKobyz6+F 7UIFU3XQq3O5AD9hNus8tSnqQ0FEgfNhQMG4CLRLPzI5cfli3dLKDHr+zksMRmGOa8Xa V6c/MLRutUp3BGicon6dXp7ikY+QwvD5IZWjM= Received: by 10.103.252.17 with SMTP id e17mr37941mus.14.1227257725560; Fri, 21 Nov 2008 00:55:25 -0800 (PST) Received: by 10.103.160.12 with HTTP; Fri, 21 Nov 2008 00:55:25 -0800 (PST) Message-ID: <92c950310811210055x615c8b9xc94d94d566ce0dd4@mail.gmail.com> Date: Fri, 21 Nov 2008 14:25:25 +0530 From: "Glen Kent" To: "opsec wg mailing list" MIME-Version: 1.0 Content-Disposition: inline Subject: [OPSEC] Comments on "Recommendations for filtering ICMP messages" X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi, I like the idea behind the draft, but i don't like the way its been written. Its too verbose and is overly redundant, and actually discourages you to go ahead. I think it is fair to assume that a person interested in reading this draft would have a basic understanding of what ICMP is, and what each of its errors mean. Even if the reader is not aware of the intricacies of each error then that information is easily available and I don't think it needs to be spelled out in this detail here. To cite an example, consider sections 2.1.1 to 2.1.1.2.4. All you need is just *one* paragraph explaining the issues that one can expect if Host and Network Unreachable error messages are filtered and the threats associated with each message. Now why do you need to explain in great detail what each one of these error messages mean? Besides this, why do we need to spend energy on error codes that have been deprecated (codes 6, 8, 9, 10, etc)? Similarly, do routers these days even support sending ICMP codes 11 and 12? I am aware of two major vendors that don't. I lost steam after a few pages and couldn't even complete the draft. I would strongly recommend editing this draft so that it becomes more readable. Glen _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Nov 29 22:06:29 2008 Return-Path: X-Original-To: opsec-archive@optimus.ietf.org Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A2EF33A67F0; Sat, 29 Nov 2008 22:06:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B0D5B3A66B4 for ; Sat, 29 Nov 2008 22:06:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JIRvuafD+MVF for ; Sat, 29 Nov 2008 22:06:25 -0800 (PST) Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.159]) by core3.amsl.com (Postfix) with ESMTP id 625F73A67F0 for ; Sat, 29 Nov 2008 22:06:25 -0800 (PST) Received: by fg-out-1718.google.com with SMTP id d23so1383047fga.41 for ; Sat, 29 Nov 2008 22:06:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=I5x9fjho+J2icFMtekJv6IXhLE4SJiZu9Y6avI04C60=; b=n5fZEN2Rflsl/wT5oLNbs8sB52GpHXEorTiLtjurnsSkyhBYra8B0f9YfW4N9m+iM0 OAZvZNnHevBsezotFq6Prhz9+EftzFhEASdCUm/IKAyHlWbjIktQ4jKbqD+BDvLijkfm aVgTayLx249kqESeNmP/ygVgq99XzUQJVhbEc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=JLF2CVppDrHXRZ+ncS1F8e8SMK7cX4b6x1+ec2TVtLItOm/UNy1WJ5xylAS4ll5wm2 OYIx/NMh8yXboMmBlcEh5j7tzwWsYgn2OKMFYeV9KHwgtEMMVL7t9w9/I2AaMU923tDb 6NIGtliExRvU+iNjwtBSvg+ujQmrYk5VhAjvM= Received: by 10.103.229.12 with SMTP id g12mr3906014mur.16.1228025180885; Sat, 29 Nov 2008 22:06:20 -0800 (PST) Received: by 10.103.160.12 with HTTP; Sat, 29 Nov 2008 22:06:20 -0800 (PST) Message-ID: <92c950310811292206w6eba091egc7fc7b49f4368509@mail.gmail.com> Date: Sun, 30 Nov 2008 11:36:20 +0530 From: "Glen Kent" To: joelja@bogus.com, "opsec wg mailing list" MIME-Version: 1.0 Content-Disposition: inline Subject: Re: [OPSEC] housekeeping details part one - Security Assessment of the Internet Protocol version 4 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi, I read the draft and it is without doubt a good piece of work. However, it makes several implementation specific recommendations, i.e., checks that an implementation must perform before accepting a fragmented packet, rate limiting IP options packets, and it goes on. So, the question is: Is OPSEC the right home for this draft? Are the members here qualified enough to make such recommendations? Isnt what is described here, already done by several vendors (how do you otherwise differentiate between different protocol implementation qualities), etc.? Would an implementation not following one of the recommendations given in this draft be non-compliant (i.e. if its to become a proposed standard)? Glen > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Joel Jaeggli > Sent: Friday, November 21, 2008 10.41 AM > To: opsec wg mailing list > Subject: [OPSEC] housekeeping details part one - Security > Assessment of the Internet Protocol version 4 > > I wanted to address this while the ideas are still fresh. I > don't think > we can really call the questions till I can get at least a skeleton of > the minutes out and I'm only about halfway done but The major > questions > regarding: > > draft-gont-opsec-ip-security-01.txt > > are: > > Test consensus on list for accepting ip security document > > Areas for improvement in the document > > Need for cross area review > > BCP vs proposed standard > > Others? > > thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec