Subject: RE: Solicit comments on draft-pashby-ipv6-network-discovery-00.txt

From: "Pashby, Ronald W CTR NSWCDD-B35" <[email-masked]>
Date: Wed, 21 Sep 2005 13:16:56 -0500

The problem is that there is no mandatory mechinism to obtain IPv6 addresses from nodes. This severly limits the ability to manage IPv6 networks.

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]]
Sent: Wednesday, September 21, 2005 12:30
To: Pashby, Ronald W CTR NSWCDD-B35
Cc: [email-masked]
Subject: Re: Solicit comments on
draft-pashby-ipv6-network-discovery-00.txt

Hi,

Some quick comments:

I think its valuable to work on limits to ensure that
existing mechanisms don't cause denial-of-service or
flooding.

> Good
> network security mandates good network management for detecting
> unauthorized devices on the network.

It would seem that the recommended mechanisms are capable
of detecting only devices that are accidentally unauthorized,
e.g., plugged to the wrong Ethernet connector. But it wouldn't
appear to be able to detect malicious unauthorized devices,
as those would likely not respond to such queries.

Also, given that IND is not widely implemented (according
to the draft), it would seem that whatever we do would have
limited success within a network that has nodes that predate
the suggested mandatory-to-implement requirement. So
some of the accidentially unauthorized nodes would also
be missed, if they are older.

> This draft does not "add" that feature. The feature already exists.
>
(snip)

> 2) Requiring all nodes implement Inverse Neighbor Discover with the 
> addidtion of the response holdoff timer.
>
The feature exists. But an all-nodes mandatory implementation
requirement is additional functionality, and I'm not sure
there's justification for that yet - but I admit that I did not
follow the discussion in the last meeting about this, so
I may be missing something. One approach would be
to publish INDbis spec, but not make it mandatory for
everyone.

--Jari

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Fri, 23 Sep 2005 11:38:03 +0300 (EEST)

> to publish INDbis spec, but not make it mandatory for

As Jari said, I do not think adding mandatory-to-implement mechanisms 
solves the problem.  A solution already exists (to a degree), but the 
vendors have voted with their feet (i.e., nobody actually wants the 
feature).

In more general, I do not see sufficiently strong justification for 
this approach.  A typical operational approach in scenarios like these 
is to collect the source IP addresses which send traffic at routers 
(e.g., with logging access lists or netflow).

That approach can reliably identify any active node in the network -- 
mechanisms which rely on active probing (e.g., pings) will never be 
able to find all the nodes anyway (e.g., because the hosts may filter 
out pings in their local firewalls).

So, if you'd want to pursue the work on discovering the hosts in the 
network, I'd put a lot more emphasis on describing why exactly this is 
needed ("problem statement") and particularly why the existing 
operational techniques are not sufficient.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings