Subject: Re: Transmission of IPv6 Jumbograms as Atomic Fragments

From: "Templin (US), Fred L" <[email-masked]>
Date: Thu, 18 Nov 2021 20:11:58 +0000

Nick,

> Do you have a use case in mind for the ID field?

Thank you for this timely question. I just got done posting a major update to the
draft, which now is titled: "IPv6 Packet Identification" and considers all forms of
IPv6 packets and not just Jumbograms. In answer to your question here is the new
Section 2 text from the draft (link provided below):

"2.  IPv6 Packet Identification

   When IPv6 sources and destinations have some way of maintaining
   "windows" of acceptable Identification values, the destination may be
   able to examine received packet Identifications to determine whether
   they likely originated from the source.  The AERO
   [I-D.templin-6man-aero] and OMNI [I-D.templin-6man-omni]
   specifications discuss methods for maintaining windows of
   unpredictable values that may reduce attack profiles in some
   environments."

Thanks, and here is the draft URL:

https://datatracker.ietf.org/doc/draft-templin-6man-jumbofrag/

Fred

> -----Original Message-----
> From: Nick Hilliard [mailto:[email-masked]]
> Sent: Thursday, November 18, 2021 9:16 AM
> To: Templin (US), Fred L <[email-masked]>
> Cc: IPv6 List <[email-masked]>
> Subject: Re: Transmission of IPv6 Jumbograms as Atomic Fragments
> 
> 
> Templin (US), Fred L wrote on 18/11/2021 15:23:
> > Bob, what I want is exactly the Identification field that is found in the Fragment Header
> > while simply leaving the rest of the fields of that header set to 0
> 
> Do you have a use case in mind for the ID field?
> 
> Nick

---

From: Mark Smith <[email-masked]>
Date: Fri, 19 Nov 2021 11:10:50 +1100

On Fri, 19 Nov 2021, 07:12 Templin (US), Fred L, <[email-masked]>
wrote:

>    they likely originated from the source.

This seems to be describing the sequence number verification used in IPsec
AH per RFC 4302.

It may be worth either just using AH as is, and getting all of its other
benefits, or look at creating a simplified version of it rather than
modifying the jumbogram EH to start duplicating existing AH functionality.

According to RFC 4302 there are a range of reserved SPI values (1 through
255), you could use one of those to indicate a light weight version of AH
that just does packet identification, avoiding the need to set up Security
Associations with IKE.

Regards,
Mark.

The AERO
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>