Subject: RE: ICMPv3: Security Consideration Section.

From: [email-masked]
Date: Fri, 13 Feb 2004 02:36:19 -0600

Jari,

> There may be some additional ICMP issues related to DoS that you
> should mention. There are two exceptions in the multicast rule
> e.2 in Section 2.4. In theory, you could cause a very large number
> of nodes to send you Packet Too Bigs or Parameter Problems. For
> instance, just send a multicast packet with an unknown option marked
> as mandatory. Fortunately, it turns out that its relatively hard to
> get the multicast routers to carry your fake multicast packet unless
> you are on the correct multicast path, i.e. very near the legitimate
> sender. But perhaps you should say something about this too.

Even when you are on the correct path, won't this fake multicast
packet with an unknown option marked as mandatory be dropped by
the next hop multicast router ? If the next hop router (or a bunch
of them) itself is gonna drop this packet and send you ICMP error 
message, why would you receive ICMP error messages from a large 
number of nodes ??

Regards
Mukesh

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Jari Arkko <[email-masked]>
Date: Fri, 13 Feb 2004 11:16:16 +0200

> message, why would you receive ICMP error messages from a large 

Yes, if we are talking about Packet Too Big or unknown option
in a hop-by-hop options header. An unknown option in a destination
options header might reach a lot of recipients, however.

--Jari