Subject: icmpv6-v3 comment

From: Jyrki Soini <[email-masked]>
Date: Mon, 01 Mar 2004 16:18:14 +0200

There is discussion and motivation why ICMPv6 error messages in general 
case MUST NOT be send in response to
multicast packets. In contrast ICMP Echo Reply message has the following 
text:

  "An Echo Reply SHOULD be sent in response to an Echo Request message
   sent to an IPv6 multicast or anycast address.  In this case, the
   source address of the reply MUST be a unicast address belonging to
   the interface on which the Echo Request message was received."

Even though ping to multicast addresses has some operational use for 
instance to diagnose multicast propagation
issues, I find it hard to justify this when comparing to potential risks 
as an DoS attack mechanism.
Once we are updating the standard, should we make this behaviour 
deprecated and write instead:

    "An Echo Reply [SHOULD NOT| MAY] be sent in response to an Echo 
Request message
     sent to an IPv6 multicast or anycast address. If this potentially 
dangerous reply
     is sent, the source address of the reply MUST be a unicast address 
belonging to
    the interface on which the Echo Request message was received."

Some other possible limitations could be:
 - echo reply to multicast packet only on link-local scope addresses
 - rate limit to very low accepted packet frequency
---
Jyrki Soini

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Tue, 2 Mar 2004 01:19:29 +0200 (EET)

>     the interface on which the Echo Request message was received."

First, at this point, I'd leave anycast addresses as is.

Second, I think with multicast debugging, the behaviour has to be 
consistent -- either you MUST answer or you MUST NOT.  If you receive 
an answer from some nodes, but not from others, debugging will be 
difficult.

So, whatever we choose (I don't have really strong opinions), it 
should be a MUST or MUST NOT.

>  - echo reply to multicast packet only on link-local scope addresses

Or maybe only "global" or some other scope (e.g., "up to scope B") 
could be forbidden/rate-limited.

The problem with rate-limiting is that it requires the separate 
timers, which some will argue must be configurable, causing more 
complexity than it's worth..

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: "Stephen Sprunk" <[email-masked]>
Date: Mon, 1 Mar 2004 17:30:49 -0600

Thus spake "Jyrki Soini" <[email-masked]>
> case MUST NOT be send in response to multicast packets. In contrast
> ICMP Echo Reply message has the following text:
>
> instance to diagnose multicast propagation issues, I find it hard to
justify
> this when comparing to potential risks as an DoS attack mechanism.

How can this possibly be used as a DoS attack?  Multicast inherently
prevents source address spoofing, at least outside the sender's own subnet.

S

Stephen Sprunk        "Stupid people surround themselves with smart
CCIE #3723           people.  Smart people surround themselves with
K5SSS         smart people who disagree with them."  --Aaron Sorkin

---

From: Mohacsi Janos <[email-masked]>
Date: Tue, 2 Mar 2004 09:53:08 +0100 (CET)

> First, at this point, I'd leave anycast addresses as is.

Agree.

> should be a MUST or MUST NOT.

I strongly for MUST. It is rather common debugging technique to test p2p
links and tunnel to ping with multicast address. This should not
disappear...

For bigger scopes I would recommend careful enable answering to multicast
pings....

> complexity than it's worth..

Agreed.

Janos Mohacsi
Network Engineer, Research Associate
NIIF/HUNGARNET, HUNGARY
Key 00F9AF98: 8645 1312 D249 471B DBAE  21A2 9F52 0D1F 00F9 AF98