Subject: [Ipsec] ESP usage at IETF65

From: Michael Richardson <[email-masked]>
Date: Mon, 13 Nov 2006 14:56:22 -0500

The 67 Attendees list dug up a paper on wireless at IETF65
     http://www1.cs.columbia.edu/~andreaf/downloads/ietf_measures.pdf

ESP is third ranked protocol, at 10% of clients using it.

That is to say, 10% of IETF attendees are using IPsec, vs 5% using SSH.

The second one is "UDP" --- and I'd be curious to know if there are
systems using UDP-encap even when they have a public IP.  Or, as my
colleagued suggested: it's Skype/SIP/etc.

- -- 
]            Bear: "Me, I'm just the shape of a bear."          |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Tue, 14 Nov 2006 02:41:43 -0500

I might have been one of the UDP users.  My VPN client defaults
to UDP for NAT traversal (right answer, in a hotel, there's usually
a NAT between me and the Internet), and has to be explicitly
told to use native ESP.  I don't always tell it to do so ...

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> -----Original Message-----
> From: Michael Richardson [mailto:[email-masked]] 
> Sent: Monday, November 13, 2006 2:56 PM
> To: [email-masked]; [email-masked]
> Subject: [Ipsec] ESP usage at IETF65
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> ] [email-masked]      
> http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (GNU/Linux)
> Comment: Finger me for keys
> 
> iQEVAwUBRVjN44CLcPvd0N1lAQIHEwgAtG360bCkxyNkmlBWPS9bvmJNlKrt9Cg3
> 8OQtY4T1tJEn/LN+iLOo+kga2ka+ob66wpXzLlhpyEfUog1zg6rFNKCt0bsvkfyy
> PIH/f9XGn5p7UZh8JPU0IFOn4clYQsJRa8PJdKYDaIwlK22RW36GQpC9C267Fy7r
> E963GZjA2EiXXmyVf3+1cWXZyTbUEfWabVcNEpTWO+qzsbGAYlVIHMeiN+n/uqMk
> NzK8V0BqgvwyUSEAilK4TcdEXT2ZTTB7/bNT8bcZA4WOJV3dTFyLJBwAyXhmBHXx
> 4ZWglFoYFlme3J//becTzevewK+QsFYTIHzfWALgHfK85BPa/k8fsg==
> =IW5b
> -----END PGP SIGNATURE-----
>

---

From: Michael Richardson <[email-masked]>
Date: Tue, 14 Nov 2006 20:04:27 -0500

>>>>> "Black" == Black David <[email-masked]> writes:
    Black> I might have been one of the UDP users.  My VPN client
    Black> defaults to UDP for NAT traversal (right answer, in a hotel,
    Black> there's usually a NAT between me and the Internet), and has
    Black> to be explicitly told to use native ESP.  I don't always tell
    Black> it to do so ...

  I find this weird.

  IKE is well able to determine when there is a NAT inline... the only
times that I've had to force UDP, I also have to tell IKE to use another
port other than 500. (Port-53... for instance)

  UDP-ESP traffic should be recognizable either from port-4500, or
possibly from looking for 4-bytes of zeroes in the payload for the IKE
non-ESP stuff.

  Anyway, I posted to celeberate our success.

- --