RE: draft-ietf-opsec-infrastructure-security-01 - InfrastructureHiding

["Fergie" <fergdawg@netzero.net>]

-- "Barry Greene \(bgreene\)" <bgreene@cisco.com> wrote:
 
>> Speaking of BCP38, I do hope you all saw this:
>> 
>>  
>> http://www.ripe.net/ripe/maillists/archives/spoofing-tf/2007/m
>> sg00000.html
>
>Speaking of BCP38++, read through the document. You can see the reasons
>why "source checks" on the ingress of a SP's network need to go beyond
>the IP address. DSCP and MAC are both known checks.

Indeed -- I believe that is mentioned in:

 http://tools.ietf.org/id/draft-baker-sava-simple-00.txt

...although, I think Fred has a different version eslewhere
(I can't find the URL right now). 

In any event, while I think that MAC-level/IP address bindings
are fine tools for source-address validation mechanisms at the
layer 2 'first-hop', I think it might be out scope for SAVA.

But are probably just fine for ietf-opsec stuff. :-)

Also, any marking on a packet, such as DSCP bits, don't have
solid transitive value, IMO -- they can be arbitrarily remarked.

- ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/