Subject: RE: draft-vasilenko-6man-nd-mitm-protection - block level

From: Vasilenko Eduard <[email-masked]>
Date: Tue, 17 Nov 2020 11:46:15 +0000

Hi Jen, Hi Igor,
NC (MAC) override attempt is the clear evidence that Intruder is present.
Moreover, we do not know who was 1st. Intruder could catch legal host at the reload and claim its IP address.

My current approach is to convert all MIMT cases to DoS cases (block both). Pay attention: only real MITM attacks, no any "false positives". 
It is possible to ask: but what about DoS? It is bad too.
Yes, it is very valid question.

Then what we could do?
We could say that the 1st address owner is always right (like in SAVI).
But then Intruder could catch server (or VM) in the reload and claim it's IP address. All company users would show credentials to the Intruder.
We would convert DoS back into MITM. Just probability would be less than original MIMT, because now Intruder needs to wait for host to reload.

I believe that the leakage of information is more serious breach than DoS. Hence, I propose to block both.
The problem of stolen application IP address is valid only for server. Hence, XiPeng is proposing to use static NC in all server segments (for all servers and VMs). Then it is possible to honor 1st comer.
You see: we do not have too much options.

Conclusion: It is trade-off. If there are more people that prefer "low probable MITM" against "high probable DoS" - I could change draft logic to release "low probably MITM" to live.
Reminder: now we have "high probably MITM". Intruder could impersonate any server/application as soon as it would find a way to break into any other host on this link.

PS: Pay attention that ND has many ways for DoS. One more, one less - not much important.
Eduard