Subject: [IPsec] ESP's use of dummy packets?

From: Joy Latten <[email-masked]>
Date: Tue, 13 Nov 2007 10:31:43 -0600

RFC 4303 introduces the use of dummy packets within ESP.
Section 2.6 states,
   A transmitter MUST be capable of generating dummy packets marked 
   with this value in the next protocol field, and a receiver MUST 
   be prepared to discard such packets, without indicating an error.

However, it is not clear to me whether an IPsec/ESP implementation MUST
use this feature. That is, it MUST send out dummy packets at random
intervals or in a way to shape the traffic. I interpreted the above 
statement to mean that an implementation must only have the capability. 

Further clarification if I have misinterpreted would be greatly appreciated.

regards,
Joy

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Nov 2007 12:15:24 -0500

>Further clarification if I have misinterpreted would be greatly appreciated.

Like most IETF standards, IPsec specifies capabilities of conformant 
implementations. It does not mandate that a user enable all of the 
features that MUST be present in an implementation. So, no, an 
implementation should not be sending dummy packets unless the user 
(or sys admin) instructs it to do so via appropriate config controls.

Steve

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Nov 2007 10:08:44 -0500

> statement to mean that an implementation must only have the capability. 

   That's correct.
   You had better be able to discard them if the other end sends them, though.
Which means you'll have to test that. Which means that you'll have to find a 
way to generate them in your lab... so it means that you'll wind up having to 
implement it anyway.