Subject: Re: [MSEC] Re: I-D ACTION : Simple Multicast Receiver Access Control

From: "Michael Germony" <[email-masked]>
Date: Wed, 28 Nov 2001 13:46:04 -0500

Ghassan and Haixiang,

According to my understanding of the DHCP RFC, the only way that a client would loose its IP address after it reboots is if during the time it rebooted the DHCP server issued the same IP address to another client (likely only in extremely small or busy scopes) OR if the duration of the reboot exceeded 50% of the lease time defined in the scope. Otherwise it will get the same address issued. The only other possible way that it would get a different DHCP address is if the DHCP server's scope cache was flushed.

Either way, wouldn't the reboot presumably cause the token to be released?

Regards,
Michael Germony
Web Architecture Services
[email-masked]

>>> "Haixiang He" <[email-masked]> 11/28/01 10:37AM >>>

>
>
> I mean if the host obtains an access token for an IP address A1, then if
> this host reboots and uses DHCP,  its new address, A2, would be
> different from A1. Consequently it will not be capable to join another
> groups. And, since the access token, is used to prevent another host
> *outside* the same network to use the same access token. You do't care
> about hosts *inside* the network. For this reason, the use of prefix ( a
> prefix could represent the set of addresses used by DHCP, if it is used)
> can resolve the problem of dynamic configuration of hosts.

I did not think about this scenario in greater details. The problem with using
prefix is that it does not work well with switch network such as switch ethernet.
In switch network, two hosts connecting two different ports may have the same
prefix.

And also we did not try to apply this solution for mobile node at this time.

Haixiang

> Ghassan

_______________________________________________
msec mailing list
[email-masked] 
http://www.pairlist.net/mailman/listinfo/msec

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: [email-masked]
Date: Wed, 28 Nov 2001 15:36:07 -0500

simple... that's true.

Is someone can resend me this draft ? Erased it by mistake...

Regards,

David

                    "Haixiang He"                                                                                        
                    <haixiang@nortelnetw       To:     [email-masked]                                              
                    orks.com>                  cc:     Michael Germony <[email-masked]>,                         
                    Sent by:                    [email-masked], "Haixiang He" <[email-masked]>,  
                    msec-admin@securemul        [email-masked], [email-masked]                 
                    ticast.org                 Subject:     Re: [MSEC] Re: I-D ACTION : Simple Multicast Receiver Access 
                                                Control                                                                  
                                                                                                                         
                    11/28/2001 02:35 PM                                                                                  

>
>
> Any relationship between the token and the ip address ?
>

I was trying to make sure that other illegal hosts cannot reuse the same
token. One way to achieve this goal is to put the
host IP address in the Access Token. This solution is simple in my view and
also does not require router to maintain other
information.

Haixiang