Subject: Re: [v6ops] new draft: draft-vyncke-v6ops-ipv6-only-thin-clients

From: "Valenkamp Derk-Jan (ID NET)" <[email-masked]>
Date: Mon, 29 Jun 2015 08:13:11 +0000

Hi,

See my comments inline.

Regards

Derk

From: Mark ZZZ Smith [mailto:[email-masked]]
Sent: Montag, 29. Juni 2015 04:19
To: [email-masked]
Cc: [email-masked]
Subject: Re: [v6ops] new draft: draft-vyncke-v6ops-ipv6-only-thin-clients

Hi,

Some thoughts/comments:

Regarding WoL, at least one of my Wifi NICs supports it, so it isn't exclusive to wired links. I don't know much about it, I've discovered it because I've wanted to save device power and therefore switch it off. According to some Internet searching it is more generally known as "Wake on Wireless LAN" or "WoWLAN".

"1.3.  Mitigation"

"For example, to reach all nodes in 2001:db8::/64, let's
   configure a static Neighbor Cache entry for 2001:db8::cafe:c0:ffee as
   ff-ff-ff-ff-ff-ff."

I think it would be better to use the IPv6 link-layer "all nodes" multicast address of 33:33:00:00:00:01 for this. Ideally, in an IPv6 only network, NICs could drop link-layer broadcasts and perform an amount of multicast address filtering.

...
Derk: Yes, I guess for IPv6 only 33:33:00:00:00:01 will be the better choice. I’ve no experience how a Layer 2 switch handle a packet with ethertype ‘IPv6’ and destination ff:ff:ff:ff:ff:ff, which is in my opinion illegal packet.

"2.  opening a door to a denial of service attack: a remote hostile
       party could keep sending packets this is specific unicast address
       forcing all hosts to stay awake, hence wasting electrical energy.
       As this address is a unicast address which does not belong to any
       physical host on the layer-2 domain, then all nodes will silently
       discard this packet at the layer-3."

This reads to me as though it is being seen as an IPv6 specific threat, where as I'd consider it to also be a threat in an IPv4 network. If it is not seen as an IPv4 threat because of RFC1918 addresses, then I think the equivalent mitigation for IPv6 would be to limit the ability to wake devices by only allowing/using ULA addresses for WoL magic destinations (i.e., devices would still have global addresses, but a global address would not be a magic WoL address.)

Derk: The threat exist also in IPv4 networks. That’s why usually directed broadcast are only enabled with access-list, to allow the directed broadcast only from certain source IP’s.  In our university network  only allowing/using ULA addresses for WoL would not solve the threat.

Regards,
Mark.