4 ms·
I agree that switches shouldn't care about TCP or UDP ports. That is a job for a firewall. However, that does not mean it is a good idea to have variable length
by rocqua 9y ago
I agree that switches shouldn't care about TCP or UDP ports. That is a job for a firewall.
However, that does not mean it is a good idea to have variable length headers in IPv6. In fact it seems like a singularly bad idea to me.
Regarding firewalls, I imagine it still sucks a firewall cannot judge each IP-packet separately but needs to deal with possible fragmented packets. Then again, that is the cost of being a firewall. You need to function at the application level and yet decide on the IP-packet level.
- colmmacc 9y agoSwitches use L4 ports to implement flow-switching. When multiple paths for a packet are available, it is convenient (it leads to less re-ordering) if the related packets from the same flow all choose the same path.
- avasylev 9y agoIt's not just convenience for anycast addresses, with multiple pathes and anycast if your round robin packets across different routes, you may end up receiving them in two different locations (ok for UDP, but TCP broken completely). Anycast is widely deployed now and imho ECMP support is now considered "standard". I'm not sure what are other alternative solution to ECMP that don't require looking into TCP headers.
- Avernar 9y agoI don't see an issue with extension headers in IPv6. The RFCs have rules on who should look at what header and what to do when an unrecognized one is encountered. Most firewalls I've dealt with have some option to defragment the inbound packet at the firewall so that the rest of the rules can be processed properly and to protect nodes from malicious fragments.