Subject: RE: [Mobike] New issue 16: No packets from other end?

From: <[email-masked]>
Date: Wed, 13 Oct 2004 12:17:48 +0300

Mohan Parthasarathy writes:
> >
> > - Since we don't have full connectivity, A's "mobility and 
> >   multihoming control module" would like to find the best 
> >   working (Ai,Bj) before the current one stops working.
> > 
> As Jari pointed out, currently we don't know of a protocol 
> that the multihoming control module could use.

We don't need a protocol (between hosts A and B) to have 
such a control module. A local API would be quite 
sufficient for many cases.

> > - In general, lower-layer mechanisms cannot tell whether pair
> >   (Ai,Bj) provides connectivity between the IKEv2 endpoints:
> >   only an IKEv2 message exchange can tell that.
> > 
> Do you mean to say only IKEv2 can discover whether the path
> works or not in a secure way ? i.e even if there is a protocol
> discovered tomorrow that is not secure, it may not be sufficient.
> Is that what you are trying to say ? Because you said "only IKEv2
> message can tell that" ?

Security is one aspect of it, but that was not I meant.

What I meant was that if we have (or do not have) connectivity 
between some other protocol endpoints on A and B (say, ICMP with 
Echo Request/Reply), that doesn't automatically mean that we have 
(or do not have) connectivity between the IKEv2 endpoints (and by
endpoints, I mean the IKEv2 software, not the host).

Best regards,
Pasi
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: <[email-masked]>
Date: Wed, 13 Oct 2004 12:33:14 +0300

Thanks, Tero; this was exactly what I meant, but your
explanation is certainly much more understandable :-)

Best regards,
Pasi

> -----Original Message-----
> From: ext Tero Kivinen <[email-masked]>
> Sent: Wednesday, October 13, 2004 11:29 AM
> To: Vijay Devarapalli
> Cc: Eronen Pasi (Nokia-NRC/Helsinki); [email-masked];
> [email-masked]
> Subject: Re: [Mobike] New issue 16: No packets from other end?
> 
> 
> Vijay Devarapalli writes:
> > totally disagree with this particular statement. assuming the IP
> > stack is the lower layer (with might include MIP6/MULTI6), why
> > would MOBIKE be able to figure out something the IP stack couldnt?
> 
> Because MOBIKE is the only one that can really say if there is
> connection that is good enough for him. For the IP point of view the
> connection between two IP-addresses might work even when there is NAT
> between, which eats all UDP port 500/4500 packets. For MOBIKE point of
> view the connection is broken. 
> 
> > UDP is a transport protocol on top of IP, right?
> 
> yes. And TCP is over IP, and even when TCP works it does not give us
> any indication that UDP will really work. Also even if UDP for port x
> works, it does not say anything whether UDP on port y will work. This
> is because of firewalls, nats and similar things. Also sending one
> ICMP message might make IP layer to think that the connection is
> broken, and we propably do not want to allow that easy DoS attacks.
> 
> I think MOBIKE should get use and try to get as much information from
> outside as possible, but in the end it still needs to test the
> possible address pairs by itself to get positive feedback that the
> address pair works.
> 
> The other layers can give lots all kind of hints, and most likely it
> can give quite reliable negative feedback, i.e. it can say that this
> address cannot work anymore as the interface used was removed from the
> machine, or the DHCP server gave me new address etc. We can belive
> some of that information but it might also give information saying
> this IP-address is not working, as I got ICMP host unreachable back
> to my ICMP ping message, and we propably should not belive that
> information. 
> -- 
> [email-masked]