North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: moving to IPv6

  • From: John Curran
  • Date: Mon Nov 03 13:56:03 1997 
At 01:23 PM 11/3/97 -0500, Thomas Narten wrote:
>Fundamentally, security likes the idea that it trusts no one other
>than the originator of data and the ultimate destination of data. That
>means no one in between should be able to examine the data, much less
>modify any of it.  That includes NATs rewritting addresses. IPSec (and
>DNSSEC) do not allow addresses to be rewritten in packets. Full Stop.

Not to be contentious, but there are valid reasons why 
"addresses" should be very visible to the network and 
potentially subject to modification.   Just offhand, 
the ability to prevent malacious attacks and hunt down
fraud are valid reasons on their own for visibility 
for network operations. 

I agree 100% when it comes to payload, but network
addresses serve the network as much as the packet. 
To the extent that we start deploying networks with
more functionality (such as mail relaying and web
caching), then the same logic applies to DNS names.

/John