Subject: RE: [Mipshop] Possible Solution to Duplicate Problem?

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 26 Aug 2005 18:39:00 -0400

> Soliman, Hesham wrote:
 > > => Two points, in addition to what Jim already posted:
 > > - If you do this you're effectively killing a MN that ping pongs
 > 
 > I am actually okay with stating the implications, if any, in 
 > the section 
 > on ping pong.
 > 
 > 
 > > - Doing this doesn't prevent an attacker from flooding a valid
 > > address on the NAR's link. The key issue here is reachability of 
 > > the NCoA.
 > > 
 > 
 > If you mean an FBU can be sent from anywhere, then we can 
 > ensure that 
 > PAR does source address check.
 > If it is any other attacker, then I don't understand how it 
 > is our problem.

=> We are defining the FBU right? I don't know how src address
checks can help here. The src address will be valid.

 > 
 > Doing reachability test will hurt performance and I don't 
 > see it's need.

=> I didn't suggest doing reachability checks. At the same
time I wouldn't dismiss it so quickly. I was saying that this is 
something that should be discussed and that the root cause
of the attack is the lack of the CoA reachability checks. Whether
we decide to act on that or not is a separate issue.

Hesham

 > 
 > -Rajeev
 > 
 > 
 > 
 > >  > If there is an entry in NAR's NCE that does not belong to 
 > >  > anyone, then 
 > >  > there is no harm.
 > > 
 > > => Apart from flooding the NAR's backhaul link.
 > > 
 > > Hesham
 > > 
 > >  > 
 > >  > -Rajeev
 > >  > 
 > >  > 
 > >  > 
 > >  > > 
 > >  > > Hesham
 > >  > > 
 > >  > > 
 > >  > >  > 
 > >  > >  > -Rajeev
 > >  > >  > 
 > >  > >  > 
 > >  > >  > > Hesham
 > >  > >  > > 
 > >  > >  > > 
 > >  > >  > > 
 > ===========================================================
 > >  > >  > > This email may contain confidential and privileged 
 > >  > >  > material for the sole use
 > >  > >  > >  of the intended recipient.  Any review or 
 > distribution by 
 > >  > >  > others is strictly
 > >  > >  > >  prohibited.  If you are not the intended 
 > recipient please 
 > >  > >  > contact the sender
 > >  > >  > >  and delete all copies.
 > >  > >  > > 
 > ===========================================================
 > >  > >  > > 
 > >  > >  > 
 > >  > >  > 
 > >  > 
 > >  > 
 > 
 > 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Rajeev Koodli <[email-masked]>
Date: Fri, 26 Aug 2005 15:53:12 -0700

> checks can help here. The src address will be valid.

Right. I was referring to a case that Jim brought up where the FBU can 
supposedly originate anywhere else.

> => I didn't suggest doing reachability checks. At the same

Okay.

> we decide to act on that or not is a separate issue.

Yes. It has broader implications including MIP.

-Rajeev