Re: Traffic selectors, fragments, ICMP messages and security policy problems

[Mark Duffy <mduffy@quarrytech.com>]

At 09:02 PM 2/24/2004 +0200, Tero Kivinen wrote:
...
>I think we should add text to rfc2401bis saying that
>
>If port selectors are used then all data associated with data flow
>MUST be sent to the SA associated with that stream. This all data
>includes normal packets, ICMP messages related to the data flow and
>fragments (first and non-first) of packets. Responder MUST accept all
>data stream related data from SA associated with that stream."

IMO mandating such behavior, with the implied buffering and state-saving it 
requires, would place a substantial obstacle to the availability of high 
speed, high capacity implementations.

--Mark