\documentclass[11pt]{article}
\usepackage{times}
%\usepackage{graphics}
\usepackage{i-d}
\usepackage[dvips]{changebar}

\title{Real Time Streaming Protocol (RTSP)}
\author{H. Schulzrinne, A. Rao, R. Lanphier}
\shorttitle{RTSP}
\filename{UNOFFICIAL-rtsp-pre04}
%\filename{ietf-mmusic-rtsp-04}
\wg{MMUSIC WG}
\address{Columbia U./Netscape/Progressive Networks}
\pubdate{\today}
\expires{January 30, 1998}

\newcommand{\motivation}[1]{\begin{quotation}\begin{footnotesize}#1\end{footnotesize}\end{quotation}}

\newcommand{\CS}{$C\rightarrow S$}
\newcommand{\SC}{$S\rightarrow C$}

\begin{document}
\maketitle
\begin{abstract}
The Real Time Streaming Protocol, or RTSP, is an application-level
protocol for control over the delivery of data with real-time
properties.  RTSP provides an extensible framework to enable controlled,
on-demand delivery of real-time data, such as audio and video.  Sources
of data can include both live data feeds and stored clips.  This
protocol is intended to control multiple data delivery sessions, provide
a means for choosing delivery channels such as UDP, multicast UDP and
TCP, and delivery mechanisms based upon RTP (RFC 1889).
\end{abstract}

{\bf This is a snapshot of the current draft which will become the next
version of the ``official'' Internet Draft.}

\tableofcontents

\input{intro}
\input{notation}
\input{parameters}
\input{message}
\input{request}
\input{response}
\input{entity}
\input{connections}
\input{methods}
\input{status}
\input{headers}
\input{caching}
\input{examples}
\input{syntax}

\section{Security Considerations}
\label{sec:security}

The protocol offers the opportunity for a remote-controlled
denial-of-service attack.  

The attacker, using a forged source IP address, can ask for a stream to
be played back to that forged IP address.  Thus, an RTSP server SHOULD
only allow client-specified destinations for RTSP-initiated traffic
flows if the server has verified the client's identity, e.g., using the
RTSP authentication mechanisms.

Since there is no relation between a transport layer connection and an
RTSP session, it is possible for a malicious client to issue requests
with random session identifiers which would affect unsuspecting clients. 
This does not require spoofing of network packet addresses.  The server
SHOULD use a large random session identifier to make this attack more
difficult.

Both problems can be be prevented by appropriate authentication.

Servers SHOULD implement both basic and digest \cite{rfc2069}
authentication. 

In addition, the security considerations outlined in [H15] apply.

\appendix
\input{machine}
\input{rtp}
\input{sdp}
\input{minimal}
\input{open}
\input{changes}

\section{Author Addresses}

\begin{flushleft}
Henning Schulzrinne\\
Dept. of Computer Science\\
Columbia University\\
1214 Amsterdam Avenue\\
New York, NY 10027\\
USA\\
electronic mail: {\sf schulzrinne@cs.columbia.edu}
\end{flushleft}

\begin{flushleft}
Anup Rao\\
Netscape Communications Corp.\\
501 E. Middlefield Road\\
Mountain View, CA 94043\\
USA\\
electronic mail: {\sf anup@netscape.com}
\end{flushleft}

\begin{flushleft}
Robert Lanphier\\
Progressive Networks\\
1111 Third Avenue Suite 2900\\
Seattle, WA 98101\\
USA\\
electronic mail: {\sf robla@prognet.com}
\end{flushleft}

\section{Acknowledgements}

This draft is based on the functionality of the original RTSP draft submitted
in October 96.  It also borrows format and descriptions from HTTP/1.1.

This document has benefited greatly from the comments of all those
participating in the MMUSIC-WG. In addition to those already mentioned,
the following individuals have contributed to this specification:

Rahul Agarwal,
Bruce Butterfield,
Steve Casner,
Francisco Cortes,
Martin Dunsmuir,
Eric Fleischman, 
V. Guruprasad,
Peter Haight,
Mark Handley,
Brad Hefta-Gaub,
John K. Ho,
Philipp Hoschka,
Anders Klemets,
Ruth Lang,
Stephanie Leif,
Eduardo F. Llach,
Rob McCool,
David Oran,
Sujal Patel,
Alagu Periyannan,
Igor Plotnikov,
Pinaki Shah,
Jeff Smith,
Alexander Sokolsky,
Dale Stammen, and
John Francis Stracke.

\bibliographystyle{ieeetr}
\bibliography{string,i-d,rfc-short,net95,net96}

\end{document}
