Subject: RE: [dhcwg] RFC 3256 on The DOCSIS Device Class DHCP

From: "Kostur, Andre" <[email-masked]>
Date: Fri, 19 Apr 2002 08:28:22 -0700

You could simply configure your DHCP server to ignore requests which don't
have option 82....

> -----Original Message-----
> From: Bud Millwood [mailto:[email-masked]]
> Sent: Friday, April 19, 2002 1:50 AM
> To: [email-masked]
> Subject: Re: [dhcwg] RFC 3256 on The DOCSIS Device Class DHCP
> 
> 
> We have at least one customer making policy decisions on the 
> server based on 
> the Class Identifier (option 60) value. Apparently, it's 
> always "docsis1.0" 
> for a DOCSIS cable-modem. (Not sure about docsis 1.1).
> 
> But even though this method appears to work fine in practice, 
> I welcome this 
> new draft because of the security aspect, as well as the 
> possibility for 
> future expansion using the reserved bits.
> 
> I think it's important to let a trusted device give us as 
> much information as 
> possible about the clients we're servicing. So important, in 
> fact, that I 
> have wondered about the possibility of *requiring* *any* kind 
> of relay agent 
> (DOCSIS or not) to insert option 82, with information about 
> the originating 
> machine (hwtype-mac, for example). The premise being that even in 
> corporations, most routers are trusted equipment, usually 
> locked away in a 
> basement somewhere.
> 
> Bud Millwood
> Weird Solutions, Inc.
> http://www.weird-solutions.com
> tel: +46 70 566 7803
> fax: +46 8 758 3687
> mailto:[email-masked]
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dhcwg
>

---

From: Bud Millwood <[email-masked]>
Date: Mon, 22 Apr 2002 12:51:14 +0200

> You could simply configure your DHCP server to ignore requests which don't

Yep, on provider networks, but on most corporate networks the average relay 
agent doesn't support option 82. I was just pointing out that providers are 
using a decent mechanism for limiting DoS attacks, and maybe this technique 
could be implemented in more networks if the average relay agent provided 
support for this 82 (specifically RID, in the format of the 'htype'-'chaddr' 
field would be sufficient).

But as Richard Woundy pointed out, not all relay agents have info about the 
CPE, so you couldn't really make it a requirement.

Thanks for the links, Richard.

Bud Millwood
Weird Solutions, Inc.