On Iau, 2003-07-10 at 01:04, David Boyes wrote:
> I think a good case can be made that it's a waste of cycles to encrypt
> something that never leaves the box. If someone does manage to tap that,
> then you have way bigger problems than data transfer security.
Depends if ARP is used on your virtual links or you have routing
daemons. I have to achieve one thing - redirection of data.
That means I can
o Spoof DNS and make you connect to the wrong site
(DNS is not secure)
o USe ARP faking or ICMP to redirect traffic
o Join in OSPF/RIP/etc routing protocols to
nominate myself as the router you want.
Your bigger risk is not people tapping the data (I'd hope!) but people
persuading your data to go elsewhere, or even misrouting it by accident.
Encryption is good - there are cases where the CPU cycles matter or
where the crypto is expensive for some boxes and you have to make hard
choices sure..
