Subject: Re: Source addresses, DDoS prevention and ingress filtering

From: Thierry Ernst <[email-masked]>
Date: Thu, 19 Apr 2001 18:30:11 +0200

> Glenn Morrow wrote:
> 
> Thanks for bringing up your draft. I have read it. Have they made it a
> WG draft in the MIP WG - if not - why not? Politics or is there
> something technical? Was there ever a hmmm on it?

Hi Glenn,

Looks like it's time to push for it to become a working group item ...  
It's not yet a working group item because nobody explicitly asked for
it, neither I (but a few people have raised the question).    I first
need to find some time to revise my draft (prior to July) and then I
think it would be the right time to claim it should be a Mobile IP WG
draft...

Thanks for your support anyway,
Thierry.

> -----Original Message-----
> From: Thierry Ernst [mailto:[email-masked]]
> Sent: Thursday, April 19, 2001 4:14 AM
> Cc: [email-masked]'; [email-masked]'
> Subject: Re: Source addresses, DDoS prevention and ingress filtering
> 
> Hi all,
> 
> About this issue regarding nodes behind a MR, I would like to tell
> interested people that we (MOTOROLA Labs and INRIA) have started to
> tackle the problems associated with this issue in my draft  "Mobile
> Networks Support in Mobile IPv6" that I presented to the Mobile IP
> working group last year
> (http://www.inrialpes.fr/planete/people/ernst/Documents/draft-ernst-mobileip-v6-network.txt)
> 
> The draft needs revisions following the recent discussions in the
> Mobile
> IP and Seamoby WG.  I  will submit a revision prior to next IETF
> meeting.   The current version only addresses some of the issues.  In
> fact, there are many issues to address, and I think the right place to
> 
> discuss it is the Mobile IP WG.
> 
> In my draft, I propose that mobility of the mobile network be hidden
> to
> nodes behind the MR (the MR operates Mobile IPv6).  in this case the
> source address will always be an address topologically correct with
> respect of the MR's network prefix on its home link, but not with
> respect to the point of attachment of the MR.   In face of ingress
> filtering, the solution is to tunnel the packet from the MR.
> 
> Thierry.
> 
--
* mailto:[email-masked]  Tel +33 (0) 4 76 61 52 69 
* INRIA Rhone-Alpes Projet PLANETE       (fax 52 52) 
* and MOTOROLA Labs Paris
* http://www.inrialpes.fr/planete/people/ernst/Welcome.html
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Glenn Morrow" <[email-masked]>
Date: Thu, 19 Apr 2001 11:08:37 -0500

Thierry,

Thanks for bringing up your draft. I have read it. Have they made it a WG
draft in the MIP WG - if not - why not? Politics or is there something
technical? Was there ever a hmmm on it?

-----Original Message-----
From: Thierry Ernst [mailto:[email-masked]]
Sent: Thursday, April 19, 2001 4:14 AM
Cc: [email-masked]'; [email-masked]'
Subject: Re: Source addresses, DDoS prevention and ingress filtering

Hi all,

(http://www.inrialpes.fr/planete/people/ernst/Documents/draft-ernst-mobileip
-v6-network.txt)

The draft needs revisions following the recent discussions in the Mobile

In my draft, I propose that mobility of the mobile network be hidden to

Thierry.

> Oh, I see what you were concerned about. It seems to me that an MR
> will have to tunnel or subnet translate unless it is on it's home
> subnet.
> 
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Wednesday, April 18, 2001 9:49 AM
> To: Morrow, Glenn [RICH2:C330:EXCH]
> Cc: Michael Thomas; Thomas Eklund; [email-masked]';
> [email-masked]'
> Subject: RE: Source addresses, DDoS prevention and ingress filtering
> 
> Glenn Morrow writes:
>  > If the node behind the MR obtained its home address from the  the
> mobile
>  > router's subnet, then the MN will use this as the source i.e. the
> MN's home
>  > subnet is the MR's subnet.
> 
>    Right, but when the MR's upstream router does an
>    RPF check... it will drop the SN's packets.
> 
>  > Either way (tunneling or subnet translation), the topological
> correctness is
>  > still maintained.
> 
>    Well, that's sort of the problem. The SN doesn't
>    know that it's putting topologically incorrect
>    source address in the IP header.
> 
>                   Mike