Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

[Tero Kivinen <kivinen at iki.fi>]

Dragan Grebovich writes:
> I looked for some traffic stats in a real, large enterprise network and
> I found that UDP comprises 25-30% vs. TCP 70-75% of all traffic.  The
> stats were measured on multiple places in the network, and multiple
> samples were taken over the past 6 weeks.  Also, there is a slow but
> consistent growth of UDP traffic over the past couple of years, pointing
> to a long term trend.

Can you provide information what kind of UDP traffic that was? I would
except DNS, and different voip protocols, but what else? 

> IMHO heuristics would require more frequent inspections than just the
> first few packets in a flow, and would require more heuristics rules on
> a per app basis, instead of relying on fixed TCP immutable fields.

For heuristics it is enough to do just to inspect first few packets.
After we have found out the parameters, then we just use them. The
deep inspection that is using the results of the heuristics (i.e. to
find the actual protocol data) will of course need to inspect every
packet.
-- 
kivinen at iki.fi