[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Phase 1 KB lifetime
On Wed, 19 Jan 2000, Ben McCann wrote:
> 1. How should an IPSEC station notify a peer that it received an invalid
> SPI in an _IPSEC_ packet (AH, ESP, or IPCOMP)?
The first question is whether any notification should be attempted, given
the potential for denial-of-service attacks. (Note that RFCs 2402 and
2406 specifically deny that you are required to attempt any sort of
notification at all... so an interoperable implementation cannot depend
on getting them anyway.)
Henry Spencer
henry@spsystems.net
References: