[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Proposed changes to ESP (andf a little AH too)
Ted,
Even for transport mode ESP, the proposed swap of fields only
exposes the packet counters, nothing else that was not expose before. The
SPIs are equally visible in both cases, as are the soure and destination
addresses and the IP packet IDs. Together, these pieces of data provide me
with enough info to do a good job of TA, exclusive of the counter info.
So, I'm not sure that I understand why you feel that the exposure of the
packet counters represents much of an aid to traffic analysis.
Steve
Follow-Ups:
References: