Re: addresses and IKEv2

[Tero Kivinen <kivinen@ssh.fi>]

andrew.krywaniuk@alcatel.com ("Andrew Krywaniuk") writes:
> Yes, this is an important case. Currently we perform this check during SA
> establishment. Doing it via a user mode callback could be a much more
> expensive proposition, especially if someone got their hands on a captured
> packet and started replaying it from thousands of different IPs.

Note, that only first of those packets is valid, all others fail the
replay check, and are discarded, thus the callback would be called
only once for all those replayed packet. 
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/