Subject: RE: globally unique site local addresses

From: "Michel Py" <[email-masked]>
Date: Sat, 23 Nov 2002 18:31:06 -0800

Margaret,

>> Michel Py wrote:
>> There is room for both models at the same, and "good
>> enough" is not going to be good enough for everybody.

> Margaret Wasserman wrote:
> I would need to see a very compelling case for why two
> types of globally-unique/provider-independent addressing
> are needed before I would like to see two models.

Reaching consensus. Pekka's model has generated some positive comments.

> Margaret Wasserman wrote:
> I think that one of the benefits of globally-unique/
> provider-independent addresses over site-locals is that
> it is possible to tell (when one is leaked in any of the
> possible ways exactly where the address came from...
> This would, of course, work best if the addresses were
> actually unique, rather than mostly-unique.

Agreed, identifying the source of the leak also requires that these
addresses are registered somewhere (which is the model I proposed) and
not randomly generated.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Mark Smith <[email-masked]>
Date: 24 Nov 2002 14:16:30 +1100

> addresses are registered somewhere (which is the model I proposed) and

I don't think it necessarily requires registration - usually a
traceroute toward the leaked route will give a good indication where it
is coming from.

Alternatively, origin AS numbers are also a good hint.

Maybe leaked routes in the Internet eg 10/8 aren't so much that common,
it's just that they are very prominent when they occur, because you know
that you shouldn't be seeing them.

Mark.

---

From: Margaret Wasserman <[email-masked]>
Date: Sun, 24 Nov 2002 03:25:46 -0500

>traceroute toward the leaked route will give a good indication where it

This assumes that the only type of leaking that you are concerned
about is route leaking.

It would also be good, in many cases, to be able to understand who
owns an address that is leaked by other means (i.e. network management
protocols).

Margaret

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Wed, 27 Nov 2002 13:49:47 +0100

> that you shouldn't be seeing them.

I thought that they where leaked more or less every week...at least 
that is my experience.

- kurtis -

---

From: Mark Smith <[email-masked]>
Date: 28 Nov 2002 08:57:34 +1100

> I thought that they where leaked more or less every week...at least 

My experience is possibly somewhat limited, I made the statement based
on :

1) the default ACLs and route filters for the rather large ISP I used to
work for. Unfortunately I don't get a chance to work in the core of that
network, so I'm making a judgement on what was supposed to be the
practice rather than reality.

2) I logged into router-server.cerf.net, couldn't find any network 10/8
in the bgp and route tables, looked at their incoming BGP route filters,
they weren't filtering for it, so their upstream ASs looked to be
filtering it.

I was mostly wondering if people were over estimating the occurance of
RFC1918 route leaks, purely because "they stick out like a saw thumb".

With the RFC1918 leaks you see, do they disappear pretty quickly after
they appear, indicating somebody took action to stop the leak ? It would
also be interesting to see if the origin AS of these RFC1918 leaks is
one of the private ones.

ps, we can take this off-ML if people don't think it is relevant to
IPv6.

Mark.

---

From: Pekka Savola <[email-masked]>
Date: Thu, 28 Nov 2002 00:08:44 +0200 (EET)

> ps, we can take this off-ML if people don't think it is relevant to

I think what was meant was that 10/8 addresses leak as _source_ addresses, 
which is about equally bad.

We have filters on our border, and the counter keeps ticking quite a bit..

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Mark Smith <[email-masked]>
Date: 28 Nov 2002 09:23:07 +1100

> which is about equally bad.

Fair enough - I'd overlook that one, mostly because I don't see many
bogus source addresses bounce off my firewall, and I figured that source
address filtering (as per the BCP) as a preventative measure against syn
attacks was pretty common.