Subject: Re: [RAM] Tunnelling Route Reduction Protocol

From: [email-masked] (Noel Chiappa)
Date: Wed, 22 Aug 2007 10:53:50 -0400 (EDT)

> From: Brian E Carpenter <[email-masked]>

    >> 99.9% of the time, the originator of the packet has already had to do
    >> a DNS lookup or some other lookup to map a name to an IP address.

    > Wouldn't that be 49.95%? Half of all first packets tend to be responses
    > such as SYN/ACK that involve no DNS lookup. For a server handling
    > thousands of requests per second, adding a lookup means holding
    > thousands of TCBs in a wait state for the duration of the lookup.

True, but there's an obvious path to take in looking for delay improvments,
which is to 'piggyback' the reverse mapping information on the connection
opening.

(Appending control traffic to user data is a technique with a long history in
the data comm field, one that dates back to the ARPANet, where requests for
the allocation of packet reassembly buffers in destination IMPs were
piggybacked on the initial data fragment...)

    > There are perhaps some interesting DDOS attacks there.

Alas, even with piggybacking on data traffic, there are a host of security
issues. Sigh, TANSTAAFL...

	Noel

_______________________________________________
RAM mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ram

---

From: "William Herrin" <[email-masked]>
Date: Wed, 22 Aug 2007 19:08:07 -0400

> which is to 'piggyback' the reverse mapping information on the connection

Hi Noel,

I considered such an approach. There are several potential problems
but the most serious is authentication. I can generally trust a
response to my own query that followed the authoritative server chain.
Theoretically a man-in-the-middle attack is possible, but
operationally it has proven to be a non-issue. I can never trust data
encoded in a random received packet to give me valid route to a
particular destination without first applying a fairly elaborate
authentication scheme.

Regards,
Bill Herrin

-- 
William D. Herrin                  [email-masked]  [email-masked]
3005 Crane Dr.                        Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004