Subject: [Mip6] Alternate care of address????

From: "Awadhesh Paswan" <[email-masked]>
Date: Thu, 20 Jan 2005 18:01:06 +0530

Dear All,

          Can somebody tell me why alternate care of address is used in 
MIPv6?
when should Mobile node send Binding update with Alternate care of 
address?

Regards
Awadhesh Kumar Paswan

______________________________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 20 Jan 2005 14:23:26 +0100

In your previous mail you wrote:

=> in two cases:
 - when the care of address is not the source address
 - when the care of address needs to be repeated in a protected part
   of the packet.

=> in one of the two cases. Please note that home registrations are
protected by IPsec ESP in transport mode and this is in the second case.

Regards

[email-masked]

---

From: "Awadhesh Paswan" <[email-masked]>
Date: Thu, 20 Jan 2005 19:43:27 +0530

thank you for the reply.

In Tahi test case Mobile node sends  binding update to correpondent node 
with alternate care of address option. Now Correpondent node should send 
binding acknowledgment  to the source address of binding update. In 
binding update message source address is different than alternate care of 
address.
Then what is the use of alternate care of address here.

In our MIPv6 implementation we are not providing IPSec security between MN 
and CN.

if care of address is different that source address then Correspondent 
node  should send binding acknowledgment to Mobile node's alternate care 
of address.
but  TAHI says it should be sent to the source address of binding update.

In this case what is the use of alternate care of address?

Plz clarify it.

Regards
Awadhesh Kumar Paswan

Francis Dupont <[email-masked]>
Sent by: [email-masked]
01/20/2005 06:53 PM
 
        To:     "Awadhesh Paswan" <[email-masked]>
        cc:     [email-masked]
        Subject:        Re: [Mip6] Alternate care of address????

   MIPv6?

=> in two cases:

Regards

---

From: Francis Dupont <[email-masked]>
Date: Thu, 20 Jan 2005 16:53:14 +0100

In Tahi test case Mobile node sends  binding update to correpondent node 
   with alternate care of address option.

=> this is not the common case but as it is supposed to be harder it has
to be tested too.

   Now Correpondent node should send 
   binding acknowledgment  to the source address of binding update.

=> this is specified in RFC 3775 section 9.5.4.

   In binding update message source address is different than
   alternate care of address.
   Then what is the use of alternate care of address here.
   
=> this is the first use (the second is with IPsec ESP in transport mode).

=> IPsec (small s).

=> RFC 3775 has a MUST for the source address in the IPv6 header.

=> TAHI is right.

>From the original answer:
   
   => in two cases:

=> I should have added the only common case was home deregistration where,
for instance, the MN coming back to home sent the BU to the HA from
its home-link-local address. There was a second way (with lifetime = 0)
to deregister and this one was removed (RFC 3775 says "MUST use the
home address").

Regards

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 20 Jan 2005 09:39:32 -0800

Awadhesh Paswan wrote:

>
> Dear All,
>
>           Can somebody tell me why alternate care of address is used 
> in MIPv6?
In Fast Handovers for Mobile IPv6 (FMIPv6), Alt-CoA is used when the MN 
sends Fast BU prior to moving to a new subnet. The Alt-CoA is the new 
CoA the MN would use on the new subnet, and source IP address in the FBU 
is the current CoA (referred to as previous CoA in FMIPv6).

Regards,

-Rajeev

>------------------------------------------------------------------------
>

---

From: Christian Vogt <[email-masked]>
Date: Sun, 23 Jan 2005 21:22:31 +0100

> is the current CoA (referred to as previous CoA in FMIPv6).

Hi all,

there is a similar scenario with plain Mobile IPv6 as well when
the MN wants to register a new CoA with the HA or the CN, but still
attempts to receive (most of the) in-flight packets meanwhile being
delivered to the old CoA.

(0) MN is attached to link A
(1) MN starts scanning for new access routers and
     discovers one on link B
(2) MN temporarily switches to link B
(3) MN does the care-of-address test on link B
(4) MN temporarily switches back to link A (to receive
     in-flight packets)
(5) MN does the home-address test on link A
(6) MN registers with the HA and the CN via link A
(7) When the first BA comes in, MN switches to link B

In (6), the CoA must be from link A, and the Alt-CoA is the new one from
link B.

Of course, the MN cannot possibly catch all packets that the HA/CN sends
to link A until it has been informed about the handover.  But some of
them it can.  The whole procedure has a higher benefit if the
care-of-address test is done concurrently, after the handover, as
proposed in [1].

- Christian

[1]
http://www.watersprings.org/pub/id/draft-vogt-mip6-early-binding-updates-00.txt

--
Christian Vogt, Institute of Telematics, University of Karlsruhe
www.tm.uka.de/~chvogt/pubkey/

   "The appropriate age for marriage is around eighteen for girls
    and thirty-seven for men." (Aristotle)

---

From: Wassim Haddad <[email-masked]>
Date: Mon, 24 Jan 2005 01:48:43 +0200 (EET)

> care-of-address test is done concurrently, after the handover, as

=> The question is: do we really need a CoA test in *any* situation?
Please check draft-dupont-mipv6-3bombing-01.
IMHO, this particular issue (and in the absence of any form of CoA test on
the HA side), deserves some more analysis.

Regards,

Wassim H.

---

From: Christian Vogt <[email-masked]>
Date: Mon, 24 Jan 2005 08:15:24 +0100

> the HA side), deserves some more analysis.

True.  The question of requiring a CoA test between two entities or not
boils down to whether or not there is a relationship of trust between
the two.  RFC 3775 assumes this trust for the case that the two entities
are the MN and the HA.  Typically, the trust will exist (or correct
behavior will be enforcable) as part of the administrative/subscriptive
relationship between the MN and the HA.  However, for scenarios where
this assumption cannot be met, RFC 3775 would have to be extended by a
CoA test for home registrations, IMO.

Since there is generally no trust between a MN and a CN, RFC 3775
requires the CoA test for correspondent registrations.  Still, there may
be scenarios where even the MN and the CN have an a-priori relationship
so that the CoA can be omitted.  Charlie's pre-configuration approach is
a good example of how RFC 3775 can be tailored to those scenarios.

- Christian

---

From: Francis Dupont <[email-masked]>
Date: Mon, 24 Jan 2005 10:20:06 +0100

the two.

=> not only, I argue in my draft that fake care-of addresses can be
caught by the ingress filtering and without the ingress filtering
one can be the target of easy DoS attacks not using the mobility.
Note that the argument doesn't apply to "real" alternate care-of addresses.

Regards