Subject: Re: [Diffserv] EF RFC and loss

From: [email-masked]
Date: Thu, 28 Oct 1999 17:07:27 +0200

Grenville,

I'm sure of course that you anticipated my next question:

How do you distinguish between the so-called "congestive losses"  and other negligible (yet genuine)
packet losses due to buffer overflow that aren't?

manu

[email-masked] wrote:
     [..]
> Your reply indicates to me that, even under proper operating conditions, it
> should not but it may and can genuinely happen that a packet is lost.
> So why should this rare event trigger the "notion of attack or serious
> misconfiguration"
> as stated in the RFC.

Because _congestive_ losses when using EF _are_ a consequence of
misconfiguration (e.g. ingress shaping to lax, or queue servicing
interval insufficient, or someone assigned EF to the 2nd queue of a
priority scheduler and it is getting starved) or attack (which
results in the nett arrival rate exceeding the queue service rate).

Of course IP systems are rarely perfect, so packet loss is always
theoretically possible along an EF path (e.g. cosmic bit errors),
but congestive loss should not be part of the loss scenario when
the system is running properly.

cheers,
gja
________________________________________________________________________
Grenville Armitage                            http://mh005.infi.net/~gja
Bell Labs Research, Lucent Technologies

---

From: Grenville Armitage <[email-masked]>
Date: Thu, 28 Oct 1999 08:31:05 -0700

> packet losses due to buffer overflow that aren't?

I dont. A buffer overflow is a congestive loss. By definition
it is a condition worthy of error logging if it occurs on a
'properly configured' EF path.

Note that a packet loss may occur from reasons unrelated to
overflow of the queue assigned to the EF PHB. The RFC is
not commenting on how you should interpret 'loss' in general,
only how to reasonably interpret overflow of the EF queue.

cheers,
gja

---

From: "Albert Manfredi" <[email-masked]>
Date: Thu, 28 Oct 1999 11:47:21 -0400

----- Original Message -----
From: <[email-masked]
> packet losses due to buffer overflow that aren't?

I don't think you can, at unless maybe the future explicit
congestion notification gives a clue. But here's the quote from RFC
2598:

"Thus these drops SHOULD be noted (e.g., via SNMP traps) as possible
security violations or serious misconfiguration. Similarly, since
the aggregate EF traffic rate is constrained at every interior node,
the EF queue should never overflow so if it does the drops SHOULD be
noted as possible attacks or serious misconfiguration."

All this is saying is that as a security measure, these features
_can_ be implemented in the diffserv domain. If overflows are truly
to be virtually impossible, without something being broken or
someone trying deliberately to break something, then these warnings
are suggested in the event of such behavior.

Bert
[email-masked]