Subject: Re: MPLS and IS-IS

From: "J. Noel Chiappa" <[email-masked]>
Date: Wed, 17 May 2000 16:19:35 -0400

> From: Andrew Partan <[email-masked]>

    > One main difference is security - its difficult to send a forged ISIS
    > packet across the Internet to attack someone.

All LS protocols (i.e. including both IS-IS and OSPF) are inherently much
harder to mess with than Destinvation Vector protocols, for the simple reason
that they advertise links, not routes, and before a link can be declared up,
you have to hear from both ends of it.

Although I suppose the way external routes are imported doesn't follow this
rule... Still, it's a lot trickier to mess an LS protocol up - you have to
get into a topology map database exchange protocol, not just send someone a
bogus routing table entry directly.

Also, I know that OSPF had authentication, and it was extendable (i.e. you
could add new methods); my knowledge in this area is out-of-date, and I'm not
sure which methods have been added since it was first defined.

	Noel

PS: My memory is clearly failing. The FSU IETF was in '90, not '85 - ten
years ago, 15 years, whatever, it was still a long time ago! :-)

---

From: Philip Chen <[email-masked]>
Date: Wed, 17 May 2000 16:59:08 -0400

> sure which methods have been added since it was first defined.

I beleive IS-IS also have an extendable authentication mechanism. This also is
not unique to link state protocols. RIP has authentication too.