Subject: Re: [v6ops] Best venue to begin addressing the "/64 ND DoS" concerns ?

From: Ray Hunter <[email-masked]>
Date: Sun, 17 Jul 2011 21:00:13 +0200

>
> Subject:
> Re: [v6ops] Best venue to begin addressing the "/64 ND DoS" concerns ?
> From:
> Philip Homburg <[email-masked]>
> Date:
> Sun, 17 Jul 2011 15:37:00 +0200
>
> To:
> Mark Smith <[email-masked]>
> CC:
> [email-masked], IPv6 Operations <[email-masked]>
>
> Precedence:
> list
> References:
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]> 
> <[email-masked]>
> In-Reply-To:
> Your message of "Sun, 17 Jul 2011 22:48:40 +0930 ." 
> <[email-masked]>
> Message-ID:
> <[email-masked]>
> Message:
> 8
>
>
> In your letter dated Sun, 17 Jul 2011 22:48:40 +0930 you wrote:
>    
>> >Actually, that level of change might not be that necessary. If the
>> >destination address for the Duplicate Address Detection probes was
>> >changed to the all-nodes rather than the solicited nodes multicast
>> >address, then all receving nodes could immediately create a neighbor
>> >cache entry for the new device if one doesn't already exist. From that
>> >point on, Neighbor Unreachability Detection would then take care of
>> >maintaining the neighbor cache entry, and deleting it if the host
>> >disappears.
>>      
>
> And then a router reboots. How does it find out about all the nodes already
> there?
>
>
>    
It's not just a router rebooting that's a problem: a temporarily 
split-brain L2 link (think spanning tree thrashing at the time when a 
node registers) could cause the same problem. There has to be some time 
related or event related (or both) trigger to refresh (not just when a 
L3 event like a node restart or interface up/down occurs).

Something has to give IMVHO, because AFAIK all of the current mitigation 
measures all rely on scarcity of either attacker or target addresses, 
which just isn't reality assuming mass-deployment of SLAAC.

How can you effectively (rate) filter if you can't tell good from bad?

I agree with Philip that there should be a number of options put on the 
table, and the various trade offs examined.

The conclusion might be that there needs to be various forms of ND, that 
are media dependent. Or small tweaks might help.
Or it might be that the current compromise really is the best 
achievable. But let's see.

regards,
RayH