From: Michael Dillon <michael@memra.com>
They aren't legitimate if the sole purpose of the method is to create
traffic; that would be fraud. A webcrawler would be fine if it was for a
search engine but not if you just ran it and discarded the data.
Are you telling me that your model requires examination of the content
of packets, and auditing the "legitimate" internal practices of the
hosts?
Are you telling me that I should not duplicate packets, as that would be
"fraud"?
Are you telling me that I should not fill my pipe with duplicate Acks,
as that would be "fraud"?
Michael, go home, take the weekend off, and in your spare time, re-read
RFCs 1 to 1123. Take special note that duplication of packets is
permitted, even encouraged.
Your model does not correspond to the Internet.
WSimpson@UMich.edu
Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32
No. I'm saying that if you generate spurious traffic with the
*INTENT* of creating a revenue stream to you then you are probably
committing fraud. If the duplicate acks are created by a program that
serves no other useful purpose then it would be just as fraudluent as if
you were to set up a 900 number, don a bicycle messenger's outfit, and
visit downtown offices asking to use the phone for a momemnt and then
calling your 900 number.
Warning you cannot configure your router with this post....
Michael Dillon wrote:
> Are you telling me that I should not fill my pipe with duplicate Acks,
> as that would be "fraud"?
No. I'm saying that if you generate spurious traffic with the
*INTENT* of creating a revenue stream to you then you are probably
committing fraud. If the duplicate acks are created by a program that
serves no other useful purpose then it would be just as fraudluent as if
you were to set up a 900 number, don a bicycle messenger's outfit, and
visit downtown offices asking to use the phone for a momemnt and then
calling your 900 number.
First, if TCP-INTERECPT code were modified to scale... The next router
would intercept and "rate limit" the ACKS to only succesfully
completed
connections, as is true with SYN's, as well. SYN PATH, and ACK PATH
would be part of the RSVP END-TO-END CDR records... And a SYN would
not be the billable unit, completed SYN-PATHS would be. ACKS would not
be either, only completed ACK-PATHS. Flow shifts
would generate "Convergence" CDR records..
to handle that connectionless attitude.. 
Also, RSVP today implies a genuine "commitment rate"...
Perhaps *commodity* TCP flows could create
0K CIR RSVP's, and just track actual utilization..
BTW: Fraudulent ACK's would be lacking valid SYN's, as well as
DSO/seconds...
No one to bill.....
And a quick trip to "Disney Land".....
But, *PHEW*, *would* we be *forced* to
control BOGON IP's.....:}
IOPS tightly secured model *everywhere*!