Subject: [nemo] Closing Issue 23

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 02 Dec 2003 18:06:35 -0800

hi Souhwan,

heres some text to be added to the Security Considerations section
to prevent tunneling threats you identified in your draft.

    The Mobile Router has to perform ingress filtering on packets
    received from the Mobile Network to ensure that nodes in the Mobile
    Network do not use the bi-directional tunnel to launch IP spoofing
    attacks.  In particular the Mobile Router SHOULD check that the IP
    source address in the packets received from the nodes in the Mobile
    Network belongs to the Mobile Network Prefix and is not the same as
    one of the addresses used by the Mobile Router.  In case the Mobile
    Router receives a IP-in-IP tunneled packet from a node in the Mobile
    Network and the Mobile Router has to forward the decapsulated packet,
    it SHOULD perform the above mentioned checks on the source address of
    the inner packet.

what do you think about this?

Vijay