Subject: [OPSEC] non malicious icmp - growing probability of encountering with mpls vpns

From: "Langer, Anthony J" <[email-masked]>
Date: Sat, 01 Nov 2008 23:22:05 +0000

Per the request of Ron Bonica (note email thread below), please note
responses from the front line Service Provider Operations technician
regarding the below excellent drafts:

draft-ietf-opsec-icmp-filtering-00 and draft-gont-opsec-ip-security-01:

Consideration of non malicious ICMP attacks in MPLS VPN Service Provider
space:

Historically peering with the Service provider has been limited to layer
2 Frame Relay and ATM.  ICMP was handled 100% by the customer's cpu
cycles.  With the proliferation of MPLS VPN's the service provider's CPU
resources can now be impacted by non malicious ICMP from the from the
Customer Edge router (CE) to the Service Provider Edge router (PE).

A good example of this is upon turn up of a new MPLS VPN connection.
The CE focused operations center uses ICMP to drive traffic.  This is
done to verify that the segment from the CE to PE is running without
error and they are getting the bandwidth in the contract.  

If you take this example and apply it to a DS3 and above PE to CE
circuit, then you are well in the zone for a non malicious ICMP attack.

Topology and OSI model peering considerations are a key in understanding
and targeting potential non malicious ICMP attacks.

Anthony Langer

------email thread from Ron Bonica-------------

Hi Anthony,

There are two very important drafts working in OPSEC right now. They
address very elementary stuff and could use review from somebody like
you. They are:

- draft-ietf-opsec-icmp-filtering-00

- draft-gont-opsec-ip-security-01

Could you take a look and provide comments to the mailing list?

                                Ron

Anthony Langer 

Tier II Global Data Network Operations

Email: [email-masked]

Telephone: (919) 377-7141 Vnet: 966-7141

Verizon Business - global capability, personal accountability.

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec