Subject: Re: Ra-Guard evasion (new Internet-Drafts)

From: Karl Auer <[email-masked]>
Date: Thu, 02 Jun 2011 10:36:12 +1000

On Wed, 2011-06-01 at 14:20 -0300, Fernando Gont wrote:
> * "IPv6 Router Advertisement Guard (RA-Guard) Evasion", available at:
> http://tools.ietf.org/id/draft-gont-v6ops-ra-guard-evasion-00.txt

Section 1, second para: "of identifying" should be "to identify"

Section 1, third para: "had so far been" should be "have so far been"

Section 1, third para: "deemed as appropiate" should be "deemed
appropriate"

Section 1, fourth para: The techniques could *probably* be exploited.
And maybe mention DHCPv6 here as well...?

Section 2.1, first sentence is missing words or something. No legitimate
what?

Section 2.1 first para: should be "simply ignoring". Suggest leaving
"simple", "simply" etc out of such sentences. It might not be simple at
all.

Section 2.1 second para: should be "implement" not "implements"

Page 6: This might be a silly thought, but why would the implementation
need to do fragment reassembly? All it needs to do is locate RAs,
whether they are in fragments or not. It has all the info it needs in
the fragment with the RA. That is, it passes earlier packets, but if a
fragment arrives with an RA in it, it checks the RA. The destination
might end up with a partial packet, but it will never get the damaging
fragment, and will eventually discard the partial.

End of Section 2.2: "it should be obvious" - well, it isn't :-)
Definitely expand on precisely why.

Regards, K.

PS: Responding on this list, rather than NANOG - is that OK?

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer ([email-masked])                   +61-2-64957160 (h)
http://www.biplane.com.au/kauer/                   +61-428-957160 (mob)

GPG fingerprint: DA41 51B1 1481 16E1 F7E2 B2E9 3007 14ED 5736 F687
Old fingerprint: B386 7819 B227 2961 8301 C5A9 2EBC 754B CD97 0156