►
From YouTube: IETF99-CAPPORT-20170718-1550
Description
CAPPORT meeting session at IETF99
2017/07/18 1550
https://datatracker.ietf.org/meeting/99/proceedings/
A
B
B
B
B
B
B
B
F
G
Tommy
Polly,
Apple
right
I
think
this
list
of
two
is
good
to
the
point
of
like
yes,
oh
yes,
the
discovery
should
not
be
HP.
Redirect,
although
I
imagine
that
we
should
probably
say
that,
for
the
minimum
viable
product
here
that
a
captive
portal
that
is
still
interacted
with
using
HTTP
in
a
standard
way
is
totally
what
should
be
done
and
all
the
extensions
to
doing
something
other
than
that
are
the
extensions
that
we
leave
open.
But
we
should
focus
on
the
HTTP
stuff.
B
B
F
Hi
I'm
Dave
Tolson
and
the
co-author
on
this
was
Kyler
rose.
A
bit
of
a
background
of
this
is
Ladd
before
the
last
IETF.
We
wanted
to
get
some
stuff
moving
in
the
hackathon
and
we
needed
a
framework
to
rally
everyone
around.
So
we
wrote
this
up
with
the
our
understanding
of
what
people
were
talking
about
and
it
seemed
to
be
get
a
lot
of
traction.
So
then
we
got
some
feedback
on
it
and
we've
updated
it
since
then.
So
next
slide
please.
So
these
are
some
of
the
updates.
F
We
got
from
some
feedback,
so
there's
a
version
one
now
it
was.
We've
made
it
so
that
there's
an
emphasis
on
the
devices
voluntarily
participating
in
her
captive
quarterly,
because
some
people
thought
we
were,
you
know,
requiring
devices
to
announce
themselves
and
participate,
and
we
wanted
to
make
that
clear
that
you
could
turn
that
off.
If
you
didn't
want
to
I,
had
it
added
a
section
on
architectural
principles
that,
like
a
mission
statement,
if
you
will
was
mentioning
provisioning
domains,
might
be
relevant.
So
we
added
a
section
on
that.
F
Someone
said
we
should
be
using
RFC
21
19
language,
so
there
you
go,
it
was
it
was
so
yeah,
so
we
tried
to
make
it.
You
know,
use
the
capital
must
and
actually
not.
So
many
must
mostly
should
someone
that
the
IOT
stuff
was
maybe
too
complicated
and
a
bit
of
distraction,
so
we've
taken
it
out
for
now
at
least
not
too
forever,
but
just
to
try
to
make
things
simpler
and
in
the
urn
our
picture.
F
We
separated
the
API
from
functionally
from
the
web
server
though
they
may
not
necessarily
be
separate,
but
we
functionally
open
apart
and
generally
trying
to
clean
up
language
next
slide,
please
so
these
are.
These.
Are
the
principles
I've
paraphrased
these
they're
a
bit
more
wordy
in
the
document,
but
we
sort
of
said
you
know
we
don't
want
the
solution
to
be
require
man-in-the-middle
of
DNS
or
HTTP.
You.
D
F
F
We
wanted
to
be
able
to
notify
users
of
things
like
you
know,
BitTorrent
and
voice,
and
you
know
users
who
didn't
happen
to
be
just
doing
HTTP
in
the
clear
to
know
that
they
were
captive
and
we
also
thought
we
want
to
make
this
explicit
captivity.
So
currently,
captive
portal
being
detected
by
you
know
a
well-known
a
request
to
a
well-known
URL,
and
you
know
what
the
answer
is
supposed
to
be
and
if
you
get
something
different,
you
infer
that
your
captive.
We
wanted.
F
F
F
We've
got
provisioning
service,
which
is
think
of
that,
as
you
know,
DHCP
or
router
advertisements
to
tell
the
user
how
to
talk
to
the
captive
portal.
We've
got
the
actual
captive
portal
API,
which
can
be
queried,
or
you
know
a
my
captive.
What
are
the
parameters
of
my
captivity,
which
also
could
be
a
cat
part?
Api
could
be
provisioning,
domains
solution
could
fit
there.
There's
a
web
server,
which
is
where
the
user
is
given.
F
The
human
user
is
given
the
experience
of
understanding
why
they're
there
and
what
they
have
to
do
to
get
out
of
the
portal
the
go
get
out
of
captivity
and
then
there's
enforcement,
which
is
the
thing
that
actually
you
know,
blocks
your
packets
and
possibly
responds
to
to
to
them.
And
it's
it's
the
thing:
that's
keeping
actually
keeping
your
packets
from
reaching
the
external
network.
F
Hopefully,
that's
all
easily
understood
next
slide
so
on
the
enforcement
point.
Currently,
devices
in
in
this
function
will
have
rules,
set
up
to
block
most
traffic,
trying
to
access
the
internet
and
will
have
specifically
allow
traffic
to
the
web
portal,
possibly
to
some
partner
sites,
possibly
to
some
advertisers
and
for
certain.
Otherwise,
if
it's
like
port
80
HTTP
might
change
it
to
a
redirect
message
or
to
you
know,
just
a
JavaScript
or
something
change
it
in
in
some
creative
way
or
modifying
DNS
to
try
to
get.
F
When
you
go
to
a
your
favorite
web
page,
it
will
send
you
to
the
portal
instead,
and
this
is
where
we're
proposing
the
new
ICMP
messages
be
coming
from,
which
is
what
David
Bird
is
going
to
talk
about
anyway.
We
think
that
this,
the
newer,
newer
approach
of
the
ICMP
really
is
an
improvement
to
just
reacting
to
port
80
HTTP,
but
you
know
admitting
that,
for
the
backwards
compatibility
issues
for
the
incremental
migration
that
you
know,
port
80
modification
may
need
to
continue
for
some
time.
F
So
we're
we're
saying
we
should
not
be
modifying
DNS
in
the
future.
The
DNS
sack
is
one
of
the
reasons
that
it's
gonna
stop
working
any,
and
actually
there
were
some
questions
about
to
what
extent
this
is
currently
used.
Apparently,
some
IETF
errs
we're
noticing
their
DNS
SEC
being
modified
in
some
places.
B
B
F
An
interesting
point,
though,
we
might
be
able
to
say
that
you
know
the
the
recommended
way
is
perhaps
a
particular
kind
of
port
80,
saying
right
and
and
say
you
know,
if
you're
doing
dns,
maybe
you
should
look
at
this
other
way
which
achieves
the
same
thing.
I,
don't
know
if
we
could
would
say
anything
like
that
or
not,
but
we
might
know
take
a
note
on
that.
A
next
slide,
please.
Okay,
now
a
little
bit
about
that
the
API.
F
G
Maybe,
like
I
think
we
can
make
strong
recommendations
in
terms
of
what
a
client
should
do
in
interacting
with
legacy
portals
and
I.
Imagine
that
we
will
likely
have
clients
move
to
new
protocols
before
we
see
large
deployment
of
portals,
and
so
it's
more
gonna
be
a
problem
of
how
to
clients
fall
back
to
old
portals.
Then
new
portals,
yeah.
F
One
tricky
thing
about
that
might
be,
it
might
be
hard
to
get
Apple
to.
Currently
we
see
like
Apple
device
is
going
to
apple.com
/a,
my
captive
or
something
and
Google
device
is
going
to
something
else,
and
it
may
not
actually
be
one
that
we
can
tell
them
all
to
use
that
they
will
be
willing
to
use.
F
Okay,
so
so
this
is
so
yeah,
so
the
the
idea
of
this
API
is
this
would
be
that
the
URL
I
have.
This
would
be
delivered
in
DHCP
or
router
advertisements
and
it's
a
place
that
a
device
can
go
at
any
time
and
say:
okay,
I'm
a
my
captive.
What
do
I
need
to
get
out?
You
know
I'm
just
waving
my
hands
here.
I,
don't
want
to
define
this
exactly,
but
I
did
say
it
should
be
idempotent,
which
means
that
the
device
can
do
multiple
gets
on
this
whenever
it
wants
to
find
out.
F
What's
going
on
and
and
and
not
have
you
know
strange
side-effects
every
time
we
go
it
basically
for
the
so
for
the
most
basic
behavior
I
think
coming
back
to
the
minimum
feature
set.
Is
you
know
a
my
captive
and
an
interface
to
go
to
the
web
application
to
to
find
out
more
and
some
of
the
advanced
things
that
we
can
talk
about
for
the
future,
maybe
to
understand
how
much
how
many
bytes
I
have
left,
how
much
time
I
have
left?
F
And
you
know
people
were
talking
about
financial
transactions
and
things
like
that
which,
but
I
don't
want
to
go
there
right
now
anyway.
We
think
this
this
way
of
delivering
notification
of
my
captive
and
what
URL
to
go
to
for
the
web
page
is
an
improvement
over
the
man-in-the-middle
modification
of
the
age
ep2
to
find
out
what
URL
I
should
go
to
and
this
this
api.
I
note
that
the
provisioning
domains
might
be
this
api.
F
You
could
fill
this
need
next
page,
please
and
I
don't
want
to
explain
provisioning
domains
exactly,
but
the
role
there's.
No.
There
was
a
bit
of
confusion
for
a
while
is
that
Ivan
we
added
provisioning
domains
to
our
draft
and
then
the
next
day
the
provisioning
drange
draft
removes
the
catholics
portal
example,
but
I
think,
and
and
then
in
the
hackathon,
the
provisioning
domains
did
captive
portals
so.
F
So
I
I
think
the
provisioning
the
main
street
boys
support
me
because
they're
here,
I
I
don't
pretend
to
understand
the
details
of
the
authentication
of
the
provisioning
domains,
but
I
thought
it
was
interesting
that
there
was
an
attempt
to
to
to
defy
to
say
you
know
you
are
this
request.
You
did
can
be
authenticated
in
some
way
to
try
to
build
some
trust
now,
some
of
the
rights
it
so
to
avoid
masquerading
hotspots
right.
So
you
know
the
fake
airport,
Wi-Fi
and
then
wardriving
type
stuff.
F
So
some
of
the
things
I
don't
want
to
really
start
this
conversation.
Now
this
is
one
of
the
rat
holes,
but
these
are
some
of
the
questions
that
that
I
heard
and
that
we
can,
you
know
for
future
discussion.
You
know
is
whether
this
is
to
special
case
for
provisioning
domains.
You
know
some
or
whether
this
API
is
even
required.
F
Some
people
are
saying
that
it,
this
API,
isn't
even
required
because
we
can
all
the
devices
should
always
just
you
know,
probe
anyway,
to
see
if
they're
allowed
and
there's
an
issue
of
redundancy
with
RFC
7710,
which
is
the
DHCP
and
router
advertisement
options
for
the
captive
portal
webpage.
So
what
if
provisioning
domains
are
used,
there's
also
dhcp
options
for
those.
So
if
we
go
down
that
path,
we
may
need
to
obsolete
7710.
F
If
we
don't
not
going
to
use
it
so
there's
there's
some
questions
there
about
the
way
I
see
it
is
7710
is
announcing.
Here's
how
to
get
out
of
the
captive
portal
and
provisioning
domains
is
saying:
here's
a
really
generic
way
of
telling
devices
about
stuff
and
one
of
which
is
captive
portal.
So
it
may
be
a
more
general
solution.
Next
slide,
please
yeah,
so
I.
Some
of
my
questions
is
similar
to
Martens.
F
F
Yeah,
so
whether
we
with
a
captive
portal
ICMP,
should
there
be
an
API
or
not?
What
do
the
requirements?
What
about
trust
I
think
that
so
far,
the
what
the
web
interface
does
is
entirely
out
of
scope,
I
I
think
that's
the
right
thing,
which
means
you
know,
we're
not
gonna,
say
anything
at
all
about
the
web.
What
the
webpage
shows
you
or
what
it
asks
for
or
whatever
whether
it's
allowed
to
show
you
ads
or
anything
like
that.
F
So
that's
just
all
we'll
talk
about
is
a
URL
to
go
to
the
web
page
for
a
human
to
participate
and
also
you
know
the
people
want
to
bring
the
Internet
of
Things
devices
back
in
or
not
do
I
want
to
be
able
to
get
a
device
without
a
screen
into
a
network.
You
know
there
are
different
devices.
You
could
talk
about.
Do
I
like
provision
it
with
bluetooth
with
enough
information
to
get
through
the
portal.
F
What
do
I
do
so,
edit,
that's
another
question
of
whether
get
in
there,
but
you
know
I,
think,
based
on
what
Martin's
saying
earlier
on
scope
is
that
we
should
just
not
go
there
right
now,
but
kind
of
have
a
vision
of
where
we
might
put
it
later
next
slide.
Please
and
I
also
wanted
to
talk
about
a
little
bit
about
trust.
We
mentioned
this
in
the
security
sections
of
the
architecture.
F
You
know,
if
you
think
about
existing
mechanisms,
you
do
a
request
to
a
well-known
URL.
You
get
back
something
right.
There's
you
have
very
little
reason
to
to
trust
that,
and
you
have
a
lot
of
reasons
to
suspect
that
there's
some
kind
of
phishing
or
it's
some
kind
of
bad
thing.
So
you
know
currently
it's
you
know
the
browser's
will
sandbox
you
in
this
case,
and
you
know
limit
what
you
can
do
and
not
let
you
do
any
kind
of
you
know:
access
use,
all
the
capabilities
to
the
browser
and
this
this
breaks.
F
What
some
portals
want
to
do
is
they
want
you
to
do
like
maybe
like
Facebook
log
in
or
something
so
the
browser's
might
block
that.
So
then
the
portals
try
to
defeat
the
kappa
portal
detection,
also,
as
the
games
are
played
so
now,
I'm
saying
what
if
we
could
build
trust
so
that
you
know
when,
when
I
attach
my
laptop
to
a
Wi-Fi,
they
can
say
you
know
you
are
attached
to
the
Hilton's
Wi-Fi
and
there's
like
the
little
padlock
in
the
corner
of
your
screen,
and
you
know
that
this
is
actually
the
Hilton's
Wi-Fi.
F
I
C
Not
in
Thompson
taking
out
my
chair
here,
cuz
I
actually
have
spoken
to
folks
at
Mozilla
about
this,
so
so
Firefox
actually
does
the
captive
portal
detection
and
throws
up
the
URL
on
some
platforms
where
the
native
platform
has
failed
to
do
the
detection,
because
it's
being
defeated
or
what-have-you,
and
we
don't
do
any
sandboxing
and
Lorenzo
is
probably
gonna.
Tell
me
all
the
reasons
why
that's
not
why
we
have
a
special
API
and
the
fact
that
you
can
do
it
says
the
things,
but
there's
a
bunch
of
things
there
I.
C
Our
philosophy
here
is
that
it
is
not
particularly
difficult
to
get
someone
on
the
Internet
to
visit
your
website
and
the
basic
underlying
threat
model
that
we
operate
in
the
browser
with
is
basically
that's
that
should
be
safe
to
do.
You
should
be
able
to
show
anyone
any
webpage
and
though
the
pixels
that
are
displayed
on
the
screen
might
be
offensive.
That's
about
the
extent
of
the
harm,
that's
actually
done
to
you,
and
so
there
is
no
actual
need
for
sandboxing
from
that
perspective.
C
Who
expect
that
when
they
make
a
request,
it
just
goes
on
for
the
network
and
on
routing
rules
apply,
and
they
don't
have
any
facility
to
deal
with
the
fact
that
this
needs
to
go
over
a
particular
path,
so
in
principle,
I
think
we're
okay,
but
that
this
is
a
huge
rathole
and
I
think
we
need
to
be
a
little
bit
cautious
about
getting
into
this
too
much.
I
would
like
to
get
an
answer
to
this.
This
problem
that
we
all
agree
on
this
room,
but
I'm
not
sure
whether
or
not
this
is
exactly.
C
J
J
It's
kind
of
funny
cuz
we
own
that
code
and
I,
don't
know
the
answer,
but
my
feeling
is
my
understanding
of
the
concentration.
It's
alright,
it's
hard
to
say
until
you
come
up
with
a
plan
and
then
actually
bet
it
with
all
the
stakeholders.
But
my
understanding
of
the
reason
why
Android
does
does
sandboxing
is
not
security.
It
is
technical.
There's
simply
that
Chrome
just
has
no
exploitive
idea
at
how
to
do
something.
That's
not
the
default
Network
somebody
wrote
that
code.
J
J
Nobody
likes
it,
but
that
that
is
the
reason,
and
it
doesn't
seem
to
be
the
case
that
the
chrome
team
would
be
particularly
willing
to
address
this
problem,
and
so
here
we
are,
but
so
it
also
seems
strange
that
people
would
defeat
this
detection
just
to
do
just
to
get
around
the
sandbox
hang
a
bit
but
I
suppose.
Maybe.
G
Tommy
Polly,
Apple
yeah,
so
I
mean
I.
Think
in
our
case,
the
reason
that
we
have
a
sandbox
captive
web
sheet
probably
started
out
also
like.
Oh,
we
had
to
go
over
the
special
interface,
although
now
we
would
have
the
ability
to
force
Safari
to
go
over
the
captive
portal
if
we
wanted
to
I
what
all
of
it
or
all
of
it
or
only
prick
certain
tabs.
F
J
Held
sway,
like
I,
said,
we
actually
didn't
ask
the
question,
because
the
code
hasn't
been
written
yet,
but
the
argument
that
held
sway
in
first
instance
with
the
security
person
who
was
looking
at
this,
was
the
user
clicked
on
this.
If
the
captive
portal
operated
wanted
to
steal
anything,
they
just
wouldn't
have
put
up
the
portal
done
and
so
he's
like
yeah,
I,
guess,
and
so
so
I
don't
know.
If
that's
worth,
maybe
you
know
if
that's
worth
revisiting,
but
in
our
in
our
cases
it's
a
technical
issue
right
so.
F
B
B
B
J
No,
not
nothing
like
that,
it
just
seems
like
I
think
we
we
should
try
to
have
something.
That's
I
mean
minimum
viable.
Otherwise
we
risk
sort
of
going
off
into
the
weeds,
I,
think
and
and
also
it
has
to
provide
a
clear
advantage
and,
to
my
mind,
the
reduced
interaction
all
that
stuff
sure
it's
very
nice.
The
thing
that
we
can't
have
today,
even
if
there
were
no
arms
race,
is
like
we
don't
know
how
to
react.
The
portal
before
it
expires
so
I
think
you
know.
If
we
improve
one
thing,
then
that's
the
one.
L
Don't
inherently
disagree
with
adopting
this
document.
I
I
have
sort
of
a
concern
that
affects
adopting
a
document,
though,
which
is
I
guess
when
this
group
started
I
thought
it
would
be
sort
of
like
behave,
and
it
would
say
how
to
captain
portals
work
today,
what's
good,
what's
bad
what
are
best
practices
and
then
we
would
get
to
the
point
where
we
said:
okay,
even
the
best
captive
portals
could
do
better
if
they
did
certain
things
now.
L
I
feel
like
we're
saying
this
is
what
we
wish
captive
portals
worked
like
Jenna,
said
and
I'm,
not
really
positive,
a
document
that
says
this
is
what
we
wish
captive
portals
worked
like
in
the
absence
of
implementations
or
protocols,
or
anything
has
value,
and
so
I
and
I.
We
might
have
ended
up
with
an
architecture
in
the
world
that
I
pictured,
but
now
I'm
not
sure
what
we're
gonna
end
up
with,
like
we're
gonna
end
up
with
an
architecture
and
what
you
city
be
great.
G
Tommy
poly,
when
I
got
up
to
say,
which
dovetails
well
into
that,
is
that
so
I,
like
the
document,
I,
think
it's
on
the
right
track.
I
would
like
I
imagine
that
this
will
be
going
in
parallel
as
a
working
group
draft
to
all
of
the
protocol
parts,
and
that
likely
this
document
won't
close
or
go
out
to
last
call
and
be
an
RFC
until
those
ones
are
mostly
finalized,
and
so
what
I'd
like
to
see
for
this
is
essentially
at
the
endgame
of
this.
Whatever
has
been
decided.
G
F
B
L
Also
wondering
if
it
might
make
sense
for
us
to
listen
the
other
presentations
agree
on
a
basic
direction.
We
want
and
then
agree
we're
going
to
adopt
a
modified
version
of
this
document
and
at
least
one
protocol.
A
document
do
you
mean
that
would
make
me
feel
better
mm-hm
and
I
think
Dave's
doing
a
great
job
of
writing
this
salmon.
It's
not
like
this
document
that
I
have
an
issue
with
I.
Don't
want
you
to
think
that
I
just
I
won't
be
offended.
M
M
F
C
N
So
fundamentally,
I
think
you
know.
Notification
should
come
from
the
network,
not
from
an
application,
and
this
is
not
a
foreign
idea.
I
mean
notifications
comes
in
at
work
already,
so
let's
take
a
closer
look
at
the
network
and
at
the
NASS,
and
what
is
it
a
supposed
to
do
when
it
gets
a
packet
so
right
now
it
has
a
few
options
right.
You
can
allow
the
traffic
and
forward
it.
This
is
like
your
wall
garden
resources
DNS.
They
kept
the
portal
itself.
N
Of
course,
there's
the
HTTP
redirect
and
there
could
be
other
things
that
hotspots
do
but
I'm
not
gonna.
You
know
go
into
that
too
deeply
or
I
can
block.
But
what
does
it
do
when
it
blocks
right?
So
he
has.
It
can
easily
silently
drop.
The
packet
return,
an
existing
I
instance.
The
air,
like
this
mission
unreachable,
and
this
really
pretty
bit
or
it
can
do
something
protocol
specific,
look
at
TCP
reset,
but
none
of
these
actually
give
the
Yui
in
the
real
indication
of
what
really
happen
to
that
packet.
N
O
N
So
what
does
this?
So?
The
ICMP
extension
is
meant
to
be
added
to
the
destination
unreachable
packet
today,
and
it
basically
gives
the
the
NASS
ability
to
accurately
inform
the
kept
portal
uee
of
what
really
happened
to
the
packet,
while
also
giving
some
indication
for
legacy
devices
because
for
legacy
devices,
the
the
the
nasa
will
still
have
the
same
three
options:
is
it
forwarded
blocked
or
is
it
you
know,
redirected
so
it'd
be
interesting
to
have
a
formally
defined.
What
the
mast
should
do
in
the
kappa
portal
networks
for
both
cap
port
and
legacy
devices.
N
N
So
I'm
also
proposing
a
new
ICMP
type
altogether,
and
this
ICMP
message
carries
the
same
information
as
the
extension
except
this
icing.
B
message
is
specifically
not
intended
for,
like
C
devices
to
understand,
and
these
cases
I
believe
this
unlocks
are
the
non
float
terminating
notifications,
so
this
might
be
like
location
where
you're
not
captive,
but
you
might
be
at
a
low
tier
of
bandwidth,
so
these
messages
could
basically
notify
the
UE
that
you
might
you
your
suggested
to
visit
sick,
epic
or
no,
the
upgrade
your.
You
know
you
your
session.
N
N
To
go
to
the
catapult,
not
a
requirement,
and
then
you
can
warn
that
a
flow
is
about
to
be
dropped
and
again
this
is
a
basically
you
know
an
indication
that
your
time
is
about
to
run
out
or
your
data.
It's
about
to
run
out,
or
what
have
you
next
Lane,
so
ICMP
allows
for
some
fields.
They
have.
You
know
the
standard.
Ice-Cream
header
has
some
unused
areas
that
every
specific
type
you
know
you
typically
uses
so
I
proposed
some
fields
to
go
in
there.
N
So
one
will
be
the
session
ID,
and
this
is
really
just
meant
to
to
help
the
Yui
group
ICMP
notifications
into
more
or
less
a
single
event,
because
you
will
be
getting
notifications
from
different
resources
that
you're
trying
to
access.
So
it
makes
sense
for
the
UE
to
try
to.
You
know
clog
late
that
into
something
you
know
more
meaningful.
N
N
So,
as
you
as
a
you,
read,
try
as
multiple
resources
on
the
network
and
gets
these
ICMP
messages
if
they
all
have
the
same
such
an
ID,
the
chances
are
they
between
forge
from
the
external
parties,
is
even
more
unlikely
and
then
that
propose
a
flags
field
which
we
can
give
some
extensibility
to
this.
This
protocol,
so
I
have
some
examples
of
some
fields.
That
would
be
useful,
in
my
opinion,
ability
time,
which
is
basically
how
long
this
is.
J
N
So
I
turn
around
and
say
that
you
could
assume
that
you
might
be
being
garaged
with
forged
messages.
If
you,
if
the
session
ID
is,
is
changing
welcome.
So
you
have
more
context,
obviously
in
the
Yui
to
determine.
If
this
packet
was
was
fake
or
not
so
I
mean
you
are
you
have
their
coated
headers
from
the
original
packet.
N
F
You
need
put
it
on
the
mic,
come
to
the
mic,
steve
Dolson
here.
My
understanding
was
that
you
know
potentially,
if
you're
streaming
or
something
you
know,
you
might
get
a
thousand
ICMP
messages
or
whatever
and-
and
you
know
the
session
that
you
might
be
a
way
of
just
filtering
out
them
so
that
you
only
receive
the
message
once
was
that
what
you
were
thinking.
N
J
Don't
need
to
be
on
path
because
everyone
talks
to
the
same
port
on
the
same
IP
address,
and
so
you
just
fake
your
messages
from
that
port.
An
IP
address
and
ephemeral
port
ranges
in
in
in
in
in
coma
noises.
Aren't
that
large,
so
you're
pretty
sure
that
somebody's
gonna
go
to
whatever
you
know:
cookie,
dough,
facebook.com/
and
port
443.
So,
okay.
D
N
F
So
even
if
you
get,
if
someone's
can
send
you
an
ICMP
message
with
the
correct
inner
quoted
packet,
so
your
side
effect
is
just
you're
going
and
asking
the
API
what's
up,
and
it
might
say
you
know
nothing's
up.
That's
why
we
didn't
put
the
URL
in
the
ICMP
message.
That's
so
there's
very
little
impact
to
receiving
one.
G
Tommy
right
I'd,
like
that
clarification
of
saying
that
this
is
being
used
in
conjunction
with
the
other
API
work,
so
I
find
the
the
initial
just
like
you're
blocked.
Icmp
I
find
that
useful
to
especially
the
first
ones,
I'm
concerned
about
growing
complexity
in
the
details
that
we
can
add
into
here,
and
the
extensions
is
especially
if
we
do
have
some
other
way,
which
hopefully
is
a
trusted
HTTP
connection
that
we
can
make
up
to
some
API
portal
that
we
can
interact
with.
That
should
be
able
to
do
all
the
trust
stuff.
G
N
I
can
never
say
that
I
mean
my
concern
with
a
with
the
API,
giving
that
information
is
that
the
API
might
not
be
the
source
of
truth
in
this.
You
know
the
NASS
knows
what's
going
to
happen,
it
knows
what
it's
doing
in
those
wouldn't
change.
What
it's
doing,
no
I
mean
you
all
get
to
smell.
My
last
light
will
show
you,
like
maybe
a
more
complicated
hotspot,
where
I'll
show
you
where
a
one
application
may
not
know
the
whole
truth.
N
Next
slide,
so
I'll
just
quickly
go
over
the
message
types.
So
this
is
just
the
the
new
ICMP
type
and
section
ID
go
into
the
standard,
ICMP
header
coded
message
and
then
the
optional
fields
explain
the
extension
format.
It's
basically
the
same
thing,
but
with
the
RFC
4884
84,
they
specifies
the
amount
of
quoted
headers
and
then
the
extension
object
follows
it
nicely,
and
so
we
put
the
same
information
in
the
extension
header
thanks
Lee,
because
this,
the
cap
port,
I
simpiy,
wouldn't
make
sense
to
be
in
a
destiny
destination,
unreachable
fragmentation
message.
N
N
N
N
Portals
are
broken,
I
mean
we're
talking
about
you
know
13-year
old
web
developers.
Right
I
mean
the
bars
are
becoming
a
wisp.
Is
you
have
an
AP
and
a
venue
right,
I
mean,
and
you
have
a
service
company
that
you
might
want
to
hire
and
I
was
also
going
to
suggest
that
we
don't
assume
a
single
vendor
so
I
the
NASA
missions
could
actually
be
split
up
between
multiple
systems,
so
you
might
have
a
Nass
sort
of
router
doing
the
time
database
calculations,
but
you
might
have
a
completely
different
system
doing
your
rate
limiting.
N
J
N
J
Then
but
then
we
need
security
Crysta
to
Tommy's
point
right,
then
we
need
it
to
be
solid
and
robust
and
and
you've
got
these
forging
attacks
was
like
if
some,
if
somebody,
if
some
web
developer
who's,
not
an
expert
in
networking
setup,
it
has
an
access
point
in
a
venue,
as
you
said,
and
forgets
to
disallow
crosstalk,
then
I
can
get.
Eric's
phone
was
like.
Oh
look,
Eric
and
I'm,
just
like
bombard
him
with
ICMP
messages
and
but.
J
J
Cause
a
notification
to
be
pls
displayed
on
somebody
screen.
Then
there
has
to
be
security
right,
that's
not!
Okay,
if
it
just
if
it
just
tickles.
If
it
just
says
the
device
go
check
the
API,
then
that's
fine,
but
like
saying
then
well,
we
have
the
API
won't
know.
What's
going
on
cuz
any
of
that
work
what's
going
on,
then
that
seems
like
a
recipe
for
disaster,
because
we
will
just
like
thrash
between
these
two
sources
of
information.
I
was
like.
Oh,
let's
do
a
query:
oh
nice
and
Pio.
Let's
do
a
query!
G
Tommy,
yes,
building
off
of
that
I,
don't
I
see
your
point,
but
I
don't
have
a
ton
of
sympathy
for
the
network
configuration
here
in
the
complexity,
because
in
a
captive
portal
today,
the
way
that
it
works
is
that
there
is
a
web
server.
That
is
redirect
my
traffic.
That
knows
all
the
information,
presumably
about
the
fact
that
I'm
blocked
I
can
interact
with
it
at
a
high
level.
It
will
tell
me
how
much
time
I
have
left
I
type
in
my
credentials.
It
lets
me
through,
like
they
already
have
so
sometimes
the
captive
web.
G
N
Okay,
so
example
overly
complicated
hotspot.
So
let's
say
we
have
a
venue.
You
know
this
could
be
a
hotel,
it
could
be
a
coffee
shop,
it
could
be,
you
know,
someone's
house,
they
have
an
access
point.
So
typically
an
access
point,
commercial-grade
ones
anyway,
will
have
features
such
that
you
can
have
a
hotspot
completely
internal
or
you
can
put
one
or
more
of
these
systems
remotely.
N
So
like
a
lot
of
access
points,
well,
you
know,
Cisco,
you
know
Lucas
HP
they'll,
let
you
do
everything
internally,
you
local
users,
local
web
pages,
local
images
on
the
AP.
As
you
get
a
little
more
advanced.
You
start,
you
know
putting
your
systems
more
remotely
by
even
higher
hotspot
service
provider
like
hotspot
sources.
Comm,
who
provides
the
portal
provides
radius,
might
provide
you
with
billing
processing
and
maybe
some
vouchering,
and
they
might
even
hook
you
up
with
some
roaming
partners
like
Boingo
or
I,
pass
the
VIN.
N
You
might
have
their
own
roaming
partners
in
marketing
partners
of
their
own,
that
this
guy
doesn't
know
how,
because
the
AP
actually
lets
them,
configure
multiple
radius
servers
based
on
the
realm.
So
this
portal
couldn't
be
a
static
web
page
that
simply
redirect
your
authenticated
the
portal
or
this
guy's
radius,
to
have
known
nothing
about
that
session.
N
N
C
Right,
mom
Thompson,
so
this
is
very
much
hats
off
one
of
the
pieces
of
feedback
that
I
got
about
this
particular
piece
of
work
is
the
in
addition
to
the
fact
that
there
are
far
too
many
bits,
and
there
are
too
many
messages
and
whatever
else,
and
perhaps
even
to
the
point
that
why
do
we
even
need
a
bit
at
all
if
the
destination
is
unreachable?
Maybe
that's
a
good
good
enough
Google
that
signal
in
some
place.
C
Setting
that
aside,
if
you
have
the
ability
to
provide
this
signal,
you
provide
the
network
provider
with
the
ability
to
create
discriminatory
services,
and
that
opens
up
a
huge
can
of
ones
and
it
doesn't
sound
like
it's
a
lot.
But
if
you
can
say
that
I'm
gonna
make
your
captive.
If
you
go
to
Apple
comm,
but
not
if
you
go
to
Google
comm.
Suddenly
we
have
a
problem.
That's.
C
This
is
this.
This
is
the
caution
and,
and
and-
and
you
know,
chair
head
back
on
again,
if
that's
where
we
go,
we're
not
prepared
for
that,
we're
not
doing
that.
That's
not
in
our
Charter.
If
we
start
down
that
path,
we've
failed,
it
is
not
forbidden,
nothing
is
forbidden,
but
but
we
should.
We
should
really
be
very,
very
careful
when
we
start
talking
about
these
things,
because
if
it
changes
the
the
balance
of
power
between
users
and
the
networks
that
they
interact
with
in
a.
C
C
N
C
We
also
have
social
effects
and
downstream
effects
on
on
users
and
services
on
the
network,
who
may
be
detrimental
affected
by
by
these
practices,
and
you
may
not
subscribe
to
a
particular
philosophy
on
this
or
not
I
think
that's
irrelevant.
The
question
is:
if
we
embark
down
this
path,
we
have
the
responsibility
of
considering
those
things
are.
C
F
Dave
Bilson,
so
I
can
see
where
you
might
go
with
that
is
you
know
if
we
structured
the
if
we
actually
went
this
far
to
define
the
API
between
the
enforcement
point
on
the
back
end,
where
you
could
structure
it
so
that
the
only
thing
you
can
say
is
on
and
off,
and
we
don't
give
like
a
lot
of
fine-grained
access
control.
So
if
we
designed,
if
we
design
Nate
with
it,
isn't
currently
in
scope,
but
if
we
design
that
API
we
could
have
some
input
into
in
into
that.
B
G
Hello,
everyone,
I'm
Tommy
I'm,
one
of
the
co-authors,
on
the
PBV
draft,
which
is
actually
draft
in
into
area,
although
it's
related
to
this
parasol.
So
here
is
my
co-author.
Next
slide,
Oh
David,
just
sorry
he's
always
here
all
right,
so
just
a
quick
review
of
what
pvd's
are
because,
as
has
already
been
mentioned,
they
are
more
general.
They
come
from
myth.
They
come
from
multiple
interfaces,
so
a
PVD
is
just
a
consistent
set
of
network
properties
that
either
is
implicit.
G
So,
in
the
draft,
an
explicit
PVD
is
advertised
as
an
fqdn
identifier
through
a
router
advertisement,
and
that
is
the
only
way
it
works,
and
the
point
of
that
is
to
identify
that
the
network
knows
that
it
is
essentially
giving
you
a
provisioning
domain
if
I
receive
multiple
arrays
with
multiple
PPD
IDs
in
them.
I
am
now
aware
that
the
network
thinks
it
is
providing
multiple
up
links
that
I
could
use
independently.
G
The
draft
also
specifies
that
you
can
use
a
JSON
API
based
on
the
PvdA
ID,
to
talk
to
some
resource
to
get
more
information
about
the
PVD.
That
is
an
optional
part
and
the
RA
signals
if
there
is
anything
more
to
be
set,
and
so
in
the
original
draft
there
were
captive
portal
properties
directly
in
this
JSON
to
clarify
why
they
were
removed
in
the
update.
G
Imagine
that
if
we
decide
to
go
this
route,
which
I
think
does
fit
well
for
two
portals,
it
would
make
sense
to
either
just
in
the
API
document
say:
here's
how
we
put
the
captive
portal
API
within
the
PVD
or
as
like
a
separate
thing,
or
have
a
separate
like
pvd's,
for
captive
portals
application
draft
to
explain
how
you're,
using
the
main
one
okay
next
slide.
Please
alright!
G
So
what
I
wanted
to
do,
because
there
was
some
discussion
on
the
list-
was
just
kind
of
go
over
the
workflows
that
we
would
imagine
for
the
various
options
for
discovering
captive
portals
so
actually,
first
back
and
specifically,
it
separated
out
into
discovery
and
interaction.
I
think
that's
a
very
important
distinction,
so
most
of
the
interaction
parts
are
going
to
be
on
what
we
consider
to
be
the
API
and
so
in
this
model.
G
The
way
we're
thinking
of
it
is
that
there's
your
wrapping
discovery
phase
and
that
is
very
separate
and
we're
trying
to
solve
that
problem
with
Phoebe's
next
slide.
Okay,
so
here
is
roughly
what
I
consider
to
be
the
status
quo.
Two
cases
the
world
when
I
am
on
a
captive,
Network
I
received
a
TP
or
I,
receive
an
RA
I,
pretty
much
always
send
out
a
probe
to
captive
dot-com
or
your
Google
site
I
get
redirected.
The
redirect
is
the
moment
of
discovery.
I
then
interact
with
captive
portal.
G
I
do
something
to
make
the
portal
happy,
and
that
is
the
interaction
API
and
then
it's
complete
and
then
from
then
on.
The
user
requests
just
go
through
and
when
we're
not
in
a
captive
portal,
it
begins
looking
very
much
the
same,
because
I
have
D
SPF
an
RA
and
then
I
still
send
my
probe,
because
I
have
no
way
to
know
that
this
is
captive
or
not.
The
probe
just
goes
through
and
then
I'm
fine.
So
that's
status
quo,
not
great!
So
please
write
so
problems.
G
We
do
the
probe
all
the
time,
it's
not
too
bad,
but
it's
clergy
and
now
we're
just
essentially
advertising.
You
know
hello,
I'm,
an
Apple
device,
I'm
talking
to
captain
Tom
every
time,
I
join
a
network,
that's
fun
there.
You
have
no
updates
about
captivity
changes.
We
all
know
that's
a
problem.
It
relies
on
redirects
and
man
in
the
middling
and
there's
no
support
for
these
future
non
browser.
Clients
which
are
not
in
scope
right
now,
but
we
do
want
to
get
them
eventually.
So
next
slide,
alright.
G
So
as
far
as
I'm
aware
I'm,
not
aware
of
any
deployments
of
our
Cee
7/7
n,
yet,
but
here's
roughly
how
I
imagine
it
would
work
is
that
you
get
your
deed,
spiro
RA,
with
the
captive
portal.
Uri
in
it,
you
request
that
captive
portal,
you
interact,
just
as
you
did
before,
so
in
that
case,
the
actual
exchange
as
far
as
the
packets
from
the
clients
perspective
stays
exactly
the
same.
G
The
only
difference
is
that
my
moment
of
aha
I'm
on
a
captive
portal
came
a
step
earlier,
but
I
still
have
to
do
essentially
the
same
number
of
interactions
as
I
did
before
and
when
I
don't
have
captivity.
I
still
have
to
probe,
because
I
may
be
on
an
old
network
and
there's
nothing
essentially
there's
nothing
in
that
option.
That
tells
me
I'm
not
captive.
So
next
slide
overlay
right.
So
the
good
thing
is
yeah.
G
You
still
need
to
probe,
because
you
may
not
have
a
new
captive
portal
implementation
and
there's
no
way
to
support
a
non
browser
clients
so
we're
just
slightly
better
than
we
were
before
next
slide,
all
right.
So
here's
trying
to
capture
roughly
what
we
have
when
we
have
the
ICMP
and
sorry
if
I
misrepresent
some
of
the
stuff,
but
there's
just
my
impression
going
through
it,
essentially
we're
at
the
same
place,
but
we
get
more
network
updates.
G
7710
alone
does
not
really
allow
you
to
have
an
API
or
discover
that
API
all
right
so
now
getting
to
how
we
imagine
things
would
work
with
PV
DS,
and
this
is
of
course
open
to
design,
and
so
this
would
may
lead
to
like
a
document
of
how
to
apply
PV
DS
to
cabin
froze.
So
here's
a
scenario
in
which
I
am
NOT
on
a
captive
network,
but
the
cap,
but
the
network
does
have
some
PVD
information,
so
let's
say
I'm
on
some
enterprise
network
or
home
network.
That
tells
me,
oh
yeah.
G
You
have
cool
properties
about
your
link.
In
that
case,
this
is
the
generic
PVD
I
receive
in
my
RA,
a
PVD
ID,
you
can
say:
oh
yeah
I
have
support
for
a
PVD,
API
right,
cool
I'm
gonna.
Do
a
request
to
this
to
find
out
my
extra
information
and
then
I
learned
that
it's
a
cellular
network
with
a
certain
data
plan.
Great
next
slide
right,
so
the
good
thing
is
I
didn't
do
a
captive
probe.
I
did
still
do
some
sort
of
HB
request,
though,
and
I
can
get
other
network
properties.
So
that's
nice,
I.
G
G
I
would
like
to
make
that
a
must
in
the
PVD
document
that
you
must
not
have
a
captive
portal
to
essentially
say
I,
don't
need
to
do
a
probe
and
that,
from
that
point
on,
our
clients
will
essentially,
if
they
ever
get
redirected,
we're
going
to
assume
that
someone
is
just
messing
with
you
like
you're,
just
being
man-in-the-middle
attacked
and
that's
not
a
and
like
say
you're,
not
gonna,
get
a
captive
web
portal.
We're
just
gonna
say
this
is
an
evil
Network
and
we
draw
people.
G
G
G
L
L
Network
does
support
pvd's
and
it
hands
you
an
ID
mm-hmm
and
it's
wide
open,
awesome.
Great.
The
network
does
support
pvd's
in
a
hand,
your
PvP
ID
and
it's
a
captive
portal,
and
this
point
you
have
to
somehow
not
send
any
traffic
until
you
actually
go.
Look
up
the
PVD
URL
and
find
out
if
it's
a
captive
portal
and
do
stuff,
or
else
you're
going
to
get
these
redirects,
which
you're
going
to
disregard
and
consider
that
some
sort
of
an
attack
is
happening.
L
G
I
mean
I.
Think
if
you
receive
the
PVD,
are
a
option
and
it
says
I
have
extra
information.
The
client
behavior
should
be
that
I'm
going
to
fetch
this
information
before
I
join
the
network
because
I
don't
know
what
this
like.
This
isn't.
Essentially,
we
will
join
the
network,
but
I
would
not
promote
that
network
to
be
the
primary
Internet
routing
interface
until
I
know
what
it
is,
because
maybe
it's
a
walled
garden.
Maybe
it
says:
I'm
your
game,
controller,
Wi-Fi,
network
yeah,.
G
L
E
G
J
No
I
I
like
to
think
long
term
as
well,
but
yeah,
so
the
good
news
is
I
think
we
don't
need
to
depend
for
on
these.
So
for
this
approach,
but
I
don't
think
we
need
to
depend
on
on
this
dream
ever
being
realized
because
I
think
realistically,
until
we
get
to
HTTPS
Everywhere,
there's
gonna
be
the
you're
doing.
J
This
is
gonna
I,
think
it's
gonna
create
the
wrong
incentives
and
and
I
am
NOT
I'm,
not
in
a
hurry
to
explore
the
implications
on
on
user
experience
of
where
this
incentives
leads,
I,
guess
I,
guess
I
had
one
question
which
I
think
you
answered
your
initial
implementation
basically
waits
for
this
to
complete,
but
I.
Don't
know
that
you
would
want
to
do
it
because
you
know
if
somebody
forgot
to
you
know,
configure
the
server
or
whatever
we
maybe
don't
want
to
spin
there
for
a
while.
Well.
G
N
Can
be
evil,
I
was
I
was
confused
on
the
floats.
Do
you
get
the
PVD
ID
and
it
says,
there's
extra
information
you
go
into
that
you're.
All
that
PVD
never
and
it
says,
there's
no
captive
portal.
Then
you
sit,
your
teeth
are
out
there,
but
weather
is
so
if
they
lied.
Yes
right,
you
well,
how
did
you
know
they
lied?
You
probe
well.
G
G
Q
G
Not
and
you're,
assuming
this
is
a
good
case,
so
I
think
that's
something
that
we
need
to
do
a
more
in-depth
analysis
on
here.
In
this
case,
the
connection
to
this
extra
information
server
is
an
HTTP
connection
that
we're
creating.
That
would
ideally
we'd
be
checking
that
it
has
the
certificate
for
the
PPA
D.
It
claims,
which
is
not
a
perfect
solution,
but
it's
a
start
as
far
as
what's
in
the
RA
I
guess,
they're
the
people
giving
us
all
their
addresses
anyway.
Pierre
can
comment.
Okay,.
P
Co-Author,
yes,
every
green
quarter,
OC
donor,
hiding
in
the
back
of
the
room
as
a
security
guy.
So
what
we
do
as
well
into
the
JSON
from
blob
that
we
send
back,
we
send
the
prey
fixes
that
are
allowed
into
the
array.
So
if
you
extract
all
the
other
types
Bao
out
of
a
/
48,
for
instance,
you
will
find
it
slash
48
into
the
JSON,
so
it
kind
of
avoid
people
cheating
with
you.
P
You
cannot
drop
the
JSON
file
from
an
existing
PVD
and
apply
it
on
a
network
vis,
not
one
of
yours
and
now
as
well.
The
server
to
avoid
ntp
on
PT,
prefix
translation
that
could
bypass
this
restriction.
The
server
serving
the
JSON
file
of
a
TLS
mass
check
that
is
serving
the
request
for
the
JSON
is
coming
from
one
with
network
as
well
lost
on
somebody
doing
network
prefix
translation.
So
it's
not
perfect,
but
it's
raised
the
bar
high
enough
I
think.
But
it's
not
perfect.
B
G
Sure,
but
there's
so
I
consider
user
initiated
traffic
to
be
useful
request
that
in
the
good
case,
if
someone
is
browsing
to
a
server
that
they
want
to
go
there,
that
those
aren't
wasted
packets,
wasted
probes.
So
in
the
case
in
which
it
says,
there's
no
other
information.
The
only
request
I'm
doing
our
real
queries
rather
than
and.
R
Chef
is
tell
one
of
your
co-star
as
well.
I
just
wanted
to
add
to
Eric's
comments
that
it's
in
ipv6.
It
generally
admitted
that
the
RA,
although
it's
not
secured,
it's,
not
cryptic
it's
not.
There
is
no
security
on
yari,
it
is
trusted,
and
if
you,
if
you
don't
want
to
trust
the
array,
well,
you
don't
have
connectivity
at
all
and
if
you
believe
that
the
array
is
not
secure
and
that's
a
problem,
well
guess
what
there
are
many
things
that
are
worse,
that
you
can
do
so.
J
G
So,
essentially,
the
way
it
works.
If
you
do
have
there
they're,
essentially
two
ways
that
you
could
build
captive
into
pvd's:
either
you
have
the
you
got
the
PVD
ID.
You
request
that
you
get
the
PVD
JSON
that
tells
you
oh
there's
a
captive
URI.
Then
you
interact
with
that.
You
can
go
back
and
forth,
it
can
add,
potentially
a
step,
or
else
next
slide.
G
It
at
least
give
us
a
explicit
hint,
that's
good
the
it
can
bootstrap
your
system,
level
interactions,
so
I
think.
The
main
point
is
that
this
opens
up
possibilities
for
something
other
than
just
going
to
the
HTTP
page
and
again.
Separating
the
discovery
from
the
interaction
is
very
important
here.
All
right,
I
think
that
it
yes
right
so
lying
pvd's,
we've
already
covered
that
you
can
read
through
this
I
think.
Essentially,
people
can
lie,
but
in
the
good
case
we
want
a
smooth,
predictable
set
of
interactions.
I
G
Have
heuristics
around
like
not
reprogram
captive
portal
I.
Imagine
some
of
that
would
say
the
same.
For
example,
if
I
received
the
RA
have
the
same
Peabody
ID
had
the
same.
Like
there's
a
looks
like
a
generation
count
in
there.
We
assume
that
yeah,
nothing
changed.
Okay,
so
that
should
just
be
as
simple
as
just
getting
your
RA
again.
You
wouldn't
have
to
refocus
so
you
do
this
yeah,
okay
right,
you
said
you
were
doing
this
with
the
capital
program
already.
So,
okay,
yes,
exactly
and
also
as
far
as
like.
Where
is
this
server
located?
G
I
know
you
had
brought
up
concerns
like?
Is
it
way
back
and
not
at
all,
related
to
the
NASS
I
think
for
the
broad
cases,
this
PVD
information
can
be
stored,
a
lot
of
different
ways,
but
for
the
case
of
if
you
are
a
captive
portal,
it
should
be
served
from
the
same
place
roughly
that
you
have
your
captive
for
the
web
page
today
and
that
you
would
have
the
captive
portal
API.
It's
just
the
same
thing.
That's
serving
this
up.
N
G
So
I'm
in
I
mean
so
we're
still
we're.
Still.
You
know
learning
about
this
in
the
demos
that
we
did
yes,
I
was
presenting.
Essentially
the
idea
would
be
like
you
can
join
this
network.
As
says
here
are
the
different
sub
networks.
You
can
join
this
one's
a
captive
portal.
Here's
the
fqdn
that
it
presented.
Do
you
want
to
join
this,
so
it
should
be
usable?
Yes,
yep
slide.
G
Yes,
it
must
have
yes
right.
So,
as
far
as
how
you
express
the
captive
portal
in
the
PVD
extended
information,
we
could
just
provide
here's.
The
URI
go.
Do
what
you
always
did.
We
could
provide
a
URI
of
a
separate
captive,
API
server,
I.
Think
that's
a
potentially
too
many
interactions
going
on
or
you
could
essentially
extend
the
API.
That's
already
existing
to
to
say
yes,
continue
inter
activates,
interacting
with
me
for
your
captives,.
G
S
S
Url
there,
your
old
retrieval
through
DHCP
option
or
ipv6
RA,
remains
that's
the
7710
stuff.
The
status
API
remains
the
session
identifiers
remain,
but
it
assumes
that
the
network
access
requirements
are
going
to
be
fulfilled
through
an
interactive
website,
so
the
API
has
become
very,
very
straightforward
and
simple.
S
We
can
request
a
list
of
networks
that
we
wants
to
know
about
and
provide
session
token'
to
get
back
the
responsive
details
about
the
networks,
whether
we're
permitted,
but
when
the
session
expires,
how
many
bytes
we
have
remaining
and
our
session
token'
back
again,
as
I
said,
we
removed
the
network,
access
conditions,
aspects
and
details.
The
terms
and
conditions
for
now
are
removed
in
the
latest
draft.
The
pass
code
was
removed
in
the
latest
draft,
and
so
questions
to
everyone
is
reducing
the
api's
as
a
general
idea.
S
T
You're
fine
chair
had
both
on
and
off
I'm
in
favor
of
of
the
production
of
the
API.
I
do
have
a
question
about,
but
maybe
it's
for
later
you
have
a
few
more
slides
about
what
the
expanded
definition
of
networks.
What
the
non
default
networks
might
mean
to
you
in
your
conception.
It
could
be
after
you
know,
know.
S
So
this
had
been
part
of
my
my
presentation
last
time
in
Chicago.
The
idea
with
the
networks
is:
that's
you,
you
might
have
a
you,
might
have
a
walled
garden
or
or
or
something
along
lines.
You
might
have
a
network
access
server
that
allows
you
access
to
local
resources
without
any
authentication.
But
then
you
need
to
provide
some
sort
of
captive
portal
authentication
to
get
out
to
the
Internet
in
general
and
you
might
have
just
different
different
networks
that
have
different
privilege
levels
that
would
be
defined
here.
So
these.
S
S
T
G
Tommy,
so
yes,
reduction
is
good.
I,
like
the
shortening
of
it.
I
mean
adding
more
stuff
in
later,
I
think
is
great,
but
in
terms
of
the
Minimum
Viable
Product
getting
the
short
one.
First,
we
can
always
add
extensions
as
to
the
nested
networks
here.
I
think
that
definitely
overlaps
with
the
PVV
stuff.
D
G
I
agree
that
it's
a
very
interesting
use
case
and
that's
part
of
what
we
were
doing
at
the
hackathon
I
think
it's
probably
it
probably
makes
more
sense
to
have
that,
be
something
that's
notified
more
at
the
kind
of
our
a
network
level,
and
then
we
can
fetch
the
information
from
separate
queries,
mm-hm
right.
So
essentially
in
this
model
you
know
we
get
three
Ras
I
do
three
different
JSON
API
is
tonight
captive
portals
and
this
one
says:
I'm
a
walled
garden.
G
C
U
C
S
C
S
S
C
D
S
D
C
S
S
Thought
about
mention
getting
up
and
standing
when
Dave
was
talking
and
I
said.
Do
it
here,
my
my
original
documents
talked
about
having
the
URI
URL
for
given
through
the
RA
or
DHCP,
and
have
that
be
a
single
URL
for
all
of
your
interaction
with
connective
portal.
If
you
post
and
get
JSON
data
types
you're
using
the
API,
if
you're
you,
if
you
posting,
get
HTML,
then
you're
going
through
the
traditional,
the
traditional
one,
so
be
more
more
conventionalized
than
so.
C
I'm,
actually
imagining
a
deployment
where
you
have
the
thing
that
does
this
that
understands
that
most
most
clients
coming
to
it
will
probably
be
you
know,
sort
of
forced
into
it
by
virtue
of
hacking,
the
port
80,
and
so
it
will
understand
how
to
redirect
to
something
else
that
has
all
the
HTML
and
user
interaction
and
all
those
sorts
of
other
things
and
can
do
the
demultiplexing
stuff.
But
you
would
actually
have
a
separate
endpoint
that
had
the
HTML
and
you
would
want
to
keep
the
two
responsibilities
as
separable
as
possible.
C
This
would
have
to
be
able
to
understand
the
request
for
something
that
didn't
have
the
right
except
header
in
it,
because
of
that's
the
limitation
that
we
have
in
7710
I.
Don't
think
we
actually
need
the
same
limitation
in
PVD
so
having
having
that
there
would
be,
would
be
useful,
I
think,
and
it
would
save
a
reiterate
that.
L
If
you
have
it,
oh
and
you
have
it
here,
and
you
assume
that
this
URI
is
some
different
URI.
Where
do
you
get
this
URI?
Like
I
mean
we?
What
the
current
spec
says,
you're
gonna
get
from
like
7710
or
whatever
a
URI,
and
if
you
go
to
it
with
JSON,
you
get
this
and
then
but
then
you're
saying
it.
You
would
be
sent
now,
a
user
who
did
77,
10
and
didn't
do
this
as
being
now
sent
to
the
wrong
place.
C
Maybe
I
wasn't
clear
so
somebody's
17,
you
get
one
euro
and
you
go
there
and
if
it's
a
legacy
client,
it's
actually
a
web
browser
ends
up
here.
They
will
put
you
know,
except
HTML
and
all
the
usual
stuff
that
browsers
do,
and
the
point
is
that
maybe
you
don't
want
to
actually
have
all
the
HTML
machinery
at
the
endpoint.
That's
providing
this
URL.
You
would
just
redirect
to
the
thing
that
has
the
HTML
for
that
client
and
for
the
API
client.
You
would
serve
the
API
from
this.
From
this
point.
U
C
And
if
you
wanted
to
host
them
in
exactly
the
same
location
and
actually
do
all
the
stuff
all
on
the
one
URL
which
is
kind
of
kind
of
icky,
because
you
don't
you
don't
get
caching,
cymatics
and
all
sorts
of
other
things
it
gets,
it
gets
messy.
You
could
point
the
interactive
URL
back
at
itself.
If
you
really
wanted
to
it
becomes
a
deployment
choice
and
you
get
that
little
bit
of
extra
flexibility.
That's
all.
T
S
J
J
Think
it's
in
real
in
reality
will
want
to
be
able
to
evolve
this
differently,
and
this
is
gonna
be
highly
tailored
to
whichever
cookie
the
network
sniffed
when
you
did
in
a
clear
text
request
and
what
your
MAC
address
was
and
all
that
stuff,
so
I
would
expect
that
you
know
that
one
of
the
difficulties
with
with
actually
putting
the
the
captive
parameters
and
the
PVD
is
that
those
change
every
time
in
the
face
of
the
moon
changes
right.
It's,
like
you,
know,
here's
how
many
seconds
you
have
left
or,
like.
J
Oh
look,
you
know
you
opt
it
into
this
other
business
deal
so
now
you
have
another
because
you
cash
in
a
voucher
at
the
you
know
at
the
at
the
at
the
register
and
so
I
think
having
like
this
is
essentially
an
Oracle
right
was
the
PVD
is
kind
of
optimized
for
static
information
and
I.
Think
in
reality,
if
we
were
to
invoke
that
the
the
mystical
you
know,
what
was
it
thirteen
year
olds
I
forget
what
like
web
developer,
I.
J
G
Right
so
to
reiterate
kind
of
from
the
last
night:
I
had
the
options
you
have
or
if
you
did
want
to
combine
PBS
with
this
is
either
you
get
your
kind
of
static
PVD,
and
then
it
just
points
you
to
this
and
you
can
switch
over
and
do
that
one
or
you
could
I
mean
I,
think
it's
perfectly
legitimate
to
say
that
the
PVD
for
a
captive
portal
is
a
very
dynamic
thing
right
so
that
it
could
be.
Essentially,
if
you
don't
care
about
any
other
information,
you
could
just
reduce
them
into
the
same
thing.
G
S
Open
issues
Dave
Dolson
had
given
a
review
that
I
was,
did
not
incorporate
in
his
Davis
a
way
of
working.
It
had
more
explicit
session
creation
and
deletion
and
again
talking
about
the
the
URLs
involved
and,
as
I
said,
I
left
it
I
left
the
session
creation
and
deletion
to
be
explicit,
be
implicit
rather
than
explicit.
It
also
sounds
like
we
it's
between
the
PV
DS
and
the
simplification
I'm,
not
sure
we
actually
need
a
session
anymore.
So
this
might.
This
might
be
no
longer
relevant
yeah.
J
Any
any
thoughts
on
on
how
to
update
this
information
on
demand
with
the
with
the
PVD
mobile.
It's
either.
If
we
either,
if
you
stash
the
information,
the
PVD
or
if
you
stash
your
redirect
role
in
your
own,
the
PVD,
you
can
Rev
the
sequence
number
or
as
this
it
seems
like
you
know
it's
well,
you
have
to
count
you.
You
have
to
figure
out
how
many
bytes
you
had
and
then
you
have
to
count.
You
better
bet.
J
You
better
hope
if
you're
counting
match
to
what
the
network
counting
was,
and
nobody
like
decided
that
their
account
account
IP,
headers
or
Mac
Anna's
differently
and
so
on,
and
so
I
guess
yeah.
So
it
seems
like
it
would
be
useful
if
we
could
update
this
and
if
we,
if
we
I
suppose,
if
we
have
an
ICMP
message
that
says,
go
check
again,
then
we
can
use
that
yeah.
S
J
And
whatever
it
wants,
but
I
mean
how
often
would
you
do
that?
Would
you
take
that
as
a
promise
and
say:
ok,
I'm
gonna
check
at
the
90
percent
mark.
Would
you
do
that?
You
could
do
it
at
half,
but
I
mean
if
you
hadn't
up
then,
but
then
you're
kind
of
committing
to
what
you
say
here,
which
kinda
means
which
might
mean
that
your
your
promises
here
have
to
be
a
lot
less
sort
of
they
have
to
be
a
lot
more
forward-thinking
and
that
you
might
be
able
to
make
fewer
promises.
J
F
I
was
initially
reacting
to
the
idea
of
post
for
doing
this
as
that,
because
I
was
thinking
get
you
know
because
it's
idempotent
just
get
what's
there
you
know
possibly,
and
also
you
know,
I
took
sort
of
you
know
restful
approach
where
you
know
for
different
operations
you
want
to
do
it
would
give
you
the
you
know,
point
you
to
the
URLs
to
do
those
operations,
so
I,
maybe
I
would
mind
if
people
took
a
go
back
and
find
that
email
and
take
a
look
in
terms
of
style.
Of
that.
B
S
Yeah,
the
the
the
comments
were
made
at
a
point
where
I
was
still
trying
to
suggest
that
we
should
do
network
requirements
and
satisfactions
via
this
API.
So
at
that
point
the
the
post
was
required
because
you
were
actually
submitting
information
in
at
this
point
with
with
just
there
just
being
a
status
status.
Retrieval
I
think
the
nine
potent
get
API
is
entirely
useful
or
entirely
the
right
idea.
Dear.
N
Bird
I
just
wanted
to
reiterate
the
the
fact
that
this
information
could
eventually
be
wrong
or
miscalculated
with
a
Miss
aligned
with
an
ass.
So
like
this,
a
CoA
is
might
come
from
multiple
various
servers,
maybe
even
a
local
event
that
triggered
an
idle
timeout
or
something
there
could
have
been
multiple
sessions
from
the
same
Mac
or
from
the
same
accounts.
They're
building
against
the
same
data
so
like
you
might
be
reporting
their
individual
uses,
but
the
various
servers
really
the
counting
servers,
really
the
one
that's
accumulating,
all
their
usage
and
their
information.
So
I.