Re: [tsvwg] [port-srv-reg] draft-ietf-tsvwg-iana-ports-02

[Joe Touch <touch at ISI.EDU>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fernando Gont wrote:
> Joe Touch wrote:
> 
>> It'd be useful to consider whether there are actually 15K connections
>> and thus a real problem, 
> 
> file sharing (p2p) applications tend to create lots of connections.
> Although I wouldn't go as far as 15K (at least for *my* client systems).
> When it comes to e.g., a busy web-proxy server and similar systems, I
> guess the number of ongoing connections increases quite a bit.

If these are persistent connections between two IP addresses for the
same service, it begs the question of whether the connections should be
persistent.

>> or whether the hosts are incompletely
>> implementing port reuse checks that prevent a port from being used for
>> different IP addresses simultaneously. 
> 
> Unfortunately, you need to do this. See the API section in the CPNI TCP
> document (i.e., connection stealing).
> 
> If we had socket(),bind(), and listen() combined in a single system call
> (and that was the only way to do things), then I'd agree that we could
> implement the checks you refer to.

I'm talking about a system that declares port 49999 "in use" for all IP
addresses when it's in use for one, just to save the space and/or
computation of keeping more detailed state. I wasn't referring to the
checks that are required as a result of the lack of a single OS call to
setup a connection.

>> Again, though, making the
>> space even 4x larger has only a 4x impact on current issues - that's not
>> all that much, IMO.
> 
> Not all that much... but certainly better than 1x.

A X increase in BW results in an X^2 increase in vulnerability, as
explained in RFC4953. A X increase in ports would result in an X
increase in resistance, which isn't going to keep up. I.e., this is a
small and fixed one-time increase that simply won't have enough of an
impact to justify changes in how we assign or use ports. There are other
good reasons (allowing endpoints to determine port use, removing the
need for an index, etc.), but not this.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkrcR6sACgkQE5f5cImnZrs/iQCguPBezBn1SeDtz80HQX+pqCbh
srwAoMn0tJN5qQOoYTYa0LY+wy6pCgN2
=vaXt
-----END PGP SIGNATURE-----