Subject: RE: [Diffserv] questions regarding ipsec and diffserv

From: "Greene, Jeremy" <[email-masked]>
Date: Thu, 3 May 2001 13:50:16 -0400

O.k., well I'll nit back :)

The sentence did not state nor, I think, imply that a MF classifier was
limited to the header. In fact, I think it's point is that a (useful) MF
classifier often can classify on more than the header(s). At least that was
the intent. And therefore the whole point of why ipsec's hiding of the IP
header is such a minor issue (or conversely, why not hiding it won't buy
much at all).

Jeremy

> -----Original Message-----
> From: Kathleen Nichols [mailto:[email-masked]]
> Sent: Thursday, May 03, 2001 1:48 PM
> To: Greene, Jeremy
> Cc: [email-masked]
> Subject: Re: [Diffserv] questions regarding ipsec and diffserv
> 
> 
> "Greene, Jeremy" wrote:
> > 
> ...
> > But if the isp does want to do MF classification (highly 
> managed service),
> > it's not clear that just seeing the header buys much of 
> anything because: 1)
> > it may not be enough (app classification) and 2) the header 
> itself can be
> > modified producing the incorrect dscp.
> > 
> ...
> I feel compelled to weigh in here on a nit. Something that seems
> to be a continuing them is an assumption that an MF classifier is
> a 5-tuple classifier. This is just not true. I initially used that
> term in the "strawman" diffserv draft that was superseded by drafts
> that became RFC2474 & 2475 and the original notion was preserved in
> the definition in RFC 2475:
> 
>  MF Classifier             a multi-field (MF) classifier which selects
>                              packets based on the content of some
>                              arbitrary number of header fields;
>                              typically some combination of source
>                              address, destination address, DS field,
>                              protocol ID, source port and destination
>                              port.
> 
> Notice that this says "typically" and then lists *six* fields.
> 
> So saying an MF classifier "may not be enough" just means you have the
> wrong MF classifier.
> 
> 	nit-picking (but this stuff tends to work its way into the
> 		common consciousness since it's more fun to read
> 		email than RFCs),
> 
> 		Kathie
> 

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.html

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 03 May 2001 14:45:41 -0500

Kathie is correct of course, but nevertheless I would expect a very large
subset of MF classifiers not to peek further than the transport header.
It's evident that if the applications PDU is encrypted, then no classifier
can make use of it, and there is no more to be said on the subject. 

The point here, and this is what Susie's writeup could say, is that IPSEC
ESP obscures the transport header (and TLS doesn't), so if you want e2e 
encryption *and* a fully-fledged diffserv model, IPSEC isn't the answer 
(as it stands).

   Brian