Subject: [v6ops] draft-ietf-v6ops-ipv6rtr-reqs: ICMP considerations

From: Fernando Gont <[email-masked]>
Date: Mon, 5 Mar 2018 22:38:58 -0300

Folks,

Couple of comments:

>    Internet Control Message Protocol (ICMP) is described in [RFC0792]
>    and [RFC4443].  ICMP is often used to perform a traceroute through a
>    network (normally by using a TTL expired ICMP message), for Path MTU
>    discovery, and, in IPv6, for autoconfiguration and neighbor
>    discovery.  ICMP is often blocked by middleboxes of various kinds
>    and/or ICMP filters configured on the ingress edge of a provider
>    network, most often to prevent the discovery of reachable hosts and
>    network topology.

I don't disagree with this comment. Although I'd say that because of
rate-limiting it's more reliable to fire TCP segment for network recon
(e.g., by TCP dstport=80, and wait for SYN/ACK or RST).

  Routers implementing IPv6:
> 
>    o  Should rate limit the generation of ICMP echo and echo responses
>       by default (for instance, using a token bucket method as described
>       in [RFC4443]).  The device should support the configuration of not
>       generating ICMP echo and echo response packets to prevent topology
>       discovery.

I'd s/topology discovery/node discovery/

Me, I'd associate *Time Exceeded Message* (traceroute) with topology
discovery.

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: <[email-masked]>
Date: Sat, 10 Mar 2018 07:06:36 -0500

> Me, I'd associate *Time Exceeded Message* (traceroute) with topology

Thanks for pointing this out! I think it's likely both, so I'll add time exceeded messages to the text above.

😊

Russ