Subject: denial of service attack using prefixes with very small Valid Lifetimes

From: "Dusan Mudric" <[email-masked]>
Date: Tue, 2 Feb 2010 12:37:24 -0500

Hi,

Is there a mechanism to protect against a denial of service attack using prefixes with very small Valid Lifetimes? RFC 2462, section 5.5.3 e) talks about it but does not seam to cover the scenario where:

		1) A user defines a small Preferred and Valid Lifetimes (i.e., 10sec and 15sec), and
		2) The initial Router Advertisement message has very small Preferred and Valid Lifetimes for a Prefix, and 
		3) The received Lifetime is equal to Stored Lifetime.

With the small lifetime, address expires quickly and is created soon after. Applications using this address go up and down periodically and get into trouble.

Have this issue already been addressed?

Regards, 

Dušan Mudrić 

Software Architect
Avaya

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 2 Feb 2010 22:07:25 -0500

2010/2/2 Dusan Mudric <[email-masked]>:
> Hi,
>
> Is there a mechanism to protect against a denial of service attack using
> prefixes with very small Valid Lifetimes? RFC 2462, section 5.5.3 e) talks
> about it but does not seam to cover the scenario where:
>

This sounds like privacy addresses, only on a shorter timescale.

>
> With the small lifetime, address expires quickly and is created soon after.
> Applications using this address go up and down periodically and get into
> trouble.

do you mean:
o attack on the router
o client side changes, so the server can't block the user's IP, since
it's changing 'rapidly'
o server side changes, so the server has to track also dns updates
such that the remote users/clients can continue to find the server
reliably

your problem statement is a tad vague.

-chris

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
>

---

From: Mark Smith <[email-masked]>
Date: Wed, 3 Feb 2010 17:19:25 +1030

Hi Dusan,

On Tue, 2 Feb 2010 12:37:24 -0500

> Have this issue already been addressed?

I'm not sure if it has specifically. In general thought, the only
people who should be configuring a router with these types of
parameters would be trusted network administrators on trusted routers.

If an untrusted network administrator is able to change the parameters
on a trusted router, then I think the root problem isn't that they can
maliciously configure parameters of the protocols the trusted router
talks, but that they've got administrative access to the router itself.
Better access control e.g. stronger passwords is the best method to
prevent this.

If it's an untrusted router announcing these parameters, then 

http://tools.ietf.org/id/draft-ietf-v6ops-ra-guard-04.txt

is addressing that threat.

Regards,
Mark.

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 3 Feb 2010 10:34:50 -0500

Hi Dusan,
   It is not clear to me where the denial of service occurs. This is 
just a configuration error on the router (to have such small lifetimes).

NOTE: RFC2462 has been obsoleted by RFC4862.

Cheers
Suresh

On 10-02-02 12:37 PM, Dusan Mudric wrote:
> prefixes with very small Valid Lifetimes? RFC 2462, section 5.5.3 e) 
> talks about it but does not seam to cover the scenario where:
> 
>             2) The initial Router Advertisement message has very small
>             Preferred and Valid Lifetimes for a Prefix, and
> 
> With the small lifetime, address expires quickly and is created soon 
> after. Applications using this address go up and down periodically and 
> get into trouble.
> 
> Dušan Mudric'

---

From: Bob Hinden <[email-masked]>
Date: Wed, 3 Feb 2010 10:24:05 -0800

On Feb 3, 2010, at 7:34 AM, Suresh Krishnan wrote:

> Hi Dusan,
>  It is not clear to me where the denial of service occurs. This is just a configuration error on the router (to have such small lifetimes).

That is my thought as well.  

Bob