I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. A nit: in the first paragraph of section 2, the second sentence is outdated and should be deleted. In paragraph 3 of section 4.2, given that there is no change to the TWAMP-test packet format, I assume we use the exact TWAMP-test packet format as defined RFC5357, so that the SID is not carried in the test packets. My question is that how the reflector just whether a TWAMP-test packet belongs to the same session/SID or not. Since per definition the testing message does not include SID, how to differentiate the testing message of different testing sessions after multiple testing started? This is not obvious and the text should be improved to make it clear how this works. B. R. Tina http://tinatsou.weebly.com/contact.html