Subject: RE: PI, routeable PI,

From: Margaret Wasserman <[email-masked]>
Date: Tue, 12 Aug 2003 16:03:28 -0400

Hi Michel,

At 12:09 PM 8/12/2003 -0700, Michel Py wrote:
>- Whatever we can say about it, the network administrator gets to pick
>what becomes of the Hinden/Haberman draft, globally routable PI _or_
>private address. The prefix can't serve both purposes at the same time
>for reasons explained 20 times on this list already.

You may think you've explained this 20 times, but I still don't
agree with it...

If you don't pay your ISP to route _your_ Hinden/Haberman prefix,
it won't be routed.  Voila!  Private addressing.  Why do you care
about whether someone else's prefix is globally routed?

Margaret

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Andrew White <[email-masked]>
Date: Wed, 13 Aug 2003 16:33:54 +1000

Possibly naive, but I'm not convinced that leaking local addresses for PI
purposes is that big a problem.

Assumptions (as specified by H/H draft):

(1) Most (all compliant) trunk routers will not route local packets.  Most
(all compliant) border routers will not route local packets.  Some internal
routers will not route local packets (depending on configuration).

(2) Routing protocols in the above are coded to ignore local address ranges
and not update routing tables.  In general, only local routers will accept
updates for local addresses (and only if not disabled).

Now, if I pay my ISP to switch off the filters, what does it gain me?  Not
much, unless I'm routing to someone else who also has their filters disabled
via a path that has the filters disabled.  Thus, the only people exposing
themselves to routing table explosion are those who disable the filters.

Or have I missed something in the economics of the situation?

Side point: application level leakage (either via mis-configured DNS or
naive address referral) is exactly the same problem as you get if you allow
a 'global' address to leak across a filter.  If you provide a filtered
address to a device outside the filter it won't work.  How quickly you
detect this depends on whether your router returns an error or just silently
discards the packet.

-- 
Andrew White