top | item 40091969

(no title)

zare_st | 1 year ago

Yeah it's a shortsighted plan. How would i set up rules on firewall if I don't know how to distingush the connections?

discuss

order

mlyle|1 year ago

There's two separate ideas here:

* Where to send a frame to get to the other side of the connection

* Whose connection this is.

TCP combined the two, because we didn't have mobile clients or a lot of multihomed systems that would benefit from distinguishing them. Also, every octet in the header counted.

In practice, this means we have to keep building a lot of infrastructure on top of TCP (or parallel to it, in datagram protocols) to handle retries and splitting flows well. In turn, these things are completely opaque to the network and it's difficult to write rules about them.

Whereas if we had different packet fields for "where am I sending this packet right now" and "whose flow does this belong to"? we could write better firewall rules, have less infrastructure built on top of TCP, and have better typical application performance.