ipsec October 2009 archive
Main Archive Page > Month Archives  > ipsec archives
ipsec: Re: [IPsec] WG last call: draft-ietf-ipsecme-esp-null-heu

Re: [IPsec] WG last call: draft-ietf-ipsecme-esp-null-heuristics-01

From: Nicolas Williams <Nicolas.Williams_at_nospam>
Date: Tue Oct 13 2009 - 18:54:58 GMT
To: Yaron Sheffer <yaronf@checkpoint.com>


On Tue, Oct 13, 2009 at 01:34:24PM -0500, Nicolas Williams wrote:
> Done.

One more comment:

  • State keeping by intermediate nodes is described as an optimization, however: a) I'm not sure that that necessarily follows, since state keeping and cache index lookups are not free, and anyways, b) in some cases, particularly where the next header is TCP or UDP, state keeping appears to be a requirement for establishing confidence in heuristics results.

   (b) is the key issue. Some advice on state cache sizing may be    useful. E.g., if an entry is dropped out of the cache due to cache    pressure, how costly will that be in terms of additional inspection    effort for future packets for that flow, and in terms of resulting    future cache pressure?

Nico -- _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec