Subject: RE: [Mipshop] Possible Solution to Duplicate Problem?

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 26 Aug 2005 18:24:36 -0400

> >  > By having the NAR proxy the NCE for NCoA after processing 
 > >  > HI, we do not 
 > >  > actually forward packets to NCoA until the MN sends 
 > >  > unsolicited NA (at 
 > >  > which point if there is a collision, it is as good as 
 > >  > anything else that 
 > >  > allows traffic forwarding when DAD is in progress).
 > > 
 > > => I don't know how this relates to the discussion we're
 > > having about the attack above. If a NCE already exists in
 > > the NAR and the MN moved back to the PAR there is nothing
 > > you can do to stop it from sending a BU to the address on
 > 
 > You can. When PAR processes FBU, it sends HI to NAR, which 
 > should then 
 > proxy the NCoA. If it is the same NCoA that MN used on NAR's link 
 > previously and the entry hasn't timed out, NAR will report a 
 > collision. 
 > Otherwise (if either of the two conditions is not true), NAR 
 > will proxy 
 > the new NCoA (so that any inadvertant redirection to a 
 > victim is avoided).

=> Two points, in addition to what Jim already posted:
- If you do this you're effectively killing a MN that ping pongs
- Doing this doesn't prevent an attacker from flooding a valid
address on the NAR's link. The key issue here is reachability of 
the NCoA.

 > 
 > > the NAR's link, which doesn't belong to anyone now but still
 > > has an entry in the NAR's cache.
 > 
 > If there is an entry in NAR's NCE that does not belong to 
 > anyone, then 
 > there is no harm.

=> Apart from flooding the NAR's backhaul link.

Hesham

 > 
 > -Rajeev
 > 
 > 
 > 
 > > 
 > > Hesham
 > > 
 > > 
 > >  > 
 > >  > -Rajeev
 > >  > 
 > >  > 
 > >  > > Hesham
 > >  > > 
 > >  > > 
 > >  > > ===========================================================
 > >  > > This email may contain confidential and privileged 
 > >  > material for the sole use
 > >  > >  of the intended recipient.  Any review or distribution by 
 > >  > others is strictly
 > >  > >  prohibited.  If you are not the intended recipient please 
 > >  > contact the sender
 > >  > >  and delete all copies.
 > >  > > ===========================================================
 > >  > > 
 > >  > 
 > >  > 
 > 
 > 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Rajeev Koodli <[email-masked]>
Date: Fri, 26 Aug 2005 15:32:10 -0700

> - If you do this you're effectively killing a MN that ping pongs

I am actually okay with stating the implications, if any, in the section 
on ping pong.

> address on the NAR's link. The key issue here is reachability of 

If you mean an FBU can be sent from anywhere, then we can ensure that 
PAR does source address check.
If it is any other attacker, then I don't understand how it is our problem.

Doing reachability test will hurt performance and I don't see it's need.

-Rajeev