Masataka Ohta (I) wrote: > The RFC is a complete mess, in various ways. It says flow IDs are > good because it is random, but, at the same time, it says flow > IDs may not be random. I found the rfc is even worse. The most important thing the rfc must have stated (it does not, of course) is: (SRC1, DST1, flow_ID1) of a stateful flow MUST be unique (not used by packets not belonging to the flow) within the Internet, which can be guaranteed only by an end (source or destination), which is a straight forward manifestation of the end to end argument. But, the rfc allow routers (firewalls) change flow IDs to nonzero value. So, if a router changes flow ID of (SRC1, DST1, flow_ID2), from flow_ID2 to flow_ID3, then, there is a possibility that flow_ID1==flow_ID3, which is fatal for the stateful flow, if the modified packets are merged to the stateful flow (certain protection against merging possible but not robust against route changes). Of course, section 6.1 of the rfc on covert channels is abstract nonsense, because covert channels may be created in various ways to carry information, for example, with extension headers (fragmentation boundaries, for example, can be arbitrary), which means firewalls should reject packets with extension headers. Masataka Ohta