Re: [bmwg] draft-cerveny-bmwg-ipv6-nd-02

[Bill Cerveny <[e-mail]>]

Hi Nalini,

See comments below:

On Nov 14, 2013, at 8:50 AM, Nalini Elkins <[e-mail]> wrote:

> Bill,
> 
> As I commented at the BMWG meeting, IMHO a few things would be quite valuable to benchmark for IPv6.  I do not know if these are in scope of the charter.  We can certainly discuss further, if desired.
> 
> 1.  The impact of extension headers on performance
>      There has been quite a bit of discussion in v6ops and 6man about "long" extension headers and ASIC size.  That is, if the header gets too big, then it is routed slowly.   I, for one, would like to see some kind of formal discussion and benchmarking of this.

See http://tools.ietf.org/html/rfc5180#section-5.3, "IPv6 Benchmarking Methodology", section "Traffic with Extension Headers". There may be value in a more in-depth discussion and benchmarking of extension headers and its impact on routers / intermediate nodes.

> 
> 2.  Router advertisements:
>      Much "bad" stuff can be done with Router Advertisements.   See UTube video: http://www.youtube.com/watch?v=TfsfNWHCKK0
>      I believe he got this from : https://www.thc.org/thc-ipv6/  which also has:

This was an interesting attack. I had replicated the behavior described in the YouTube video with Windows 7 and Windows 8 in VMs using flood_router6 in Nov. 2012. Sam Bowne had done a bit of research on this issue, including characterizing the behavior on multiple systems as well as confirming that Microsoft had mostly fixed the problem with patches in 2013.

A distinction with the flood_router6 Windows attack is that it didn't attack routers (intermediate nodes), as far as I know, and the attack could "only" be launched from the same "broadcast domain."

Bill
>         - parasite6: icmp neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same
>  as ARP mitm (and parasite)
> 	- alive6: an effective alive scanng, which will detect all systems listening to this address
> 	- dnsdict6: parallized dns ipv6 dictionary bruteforcer
> 	- fake_router6: announce yourself as a router on the network, with the highest priority
> 	- redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever icmp6 redirect spoofer
> 	- toobig6: mtu decreaser with the same intelligence as redir6
> 	- detect-new-ip6: detect new ip6 devices which join the network, you can run a script to automatically scan these systems etc.
> 	- dos-new-ip6: detect new ip6 devices and tell them that their chosen IP collides on the network (DOS).
> 	- trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN
> 	- flood_router6: flood a target with random router advertisements
> 	- flood_advertise6: flood a target with random neighbor advertisements
> 	- exploit6: known ipv6 vulnerabilities to test against a target
> 	- denial6: a collection of denial-of-service tests againsts a target
> 	- fuzz_ip6: fuzzer for ipv6
> 	- implementation6: performs various implementation checks on ipv6
> 	- implementation6d: listen daemon for implementation6 to check behind a fw
> 	- fake_mld6: announce yourself in a multicast group of your choice on the net
> 	- fake_mld26: same but for MLDv2
> 	- fake_mldrouter6: fake MLD router messages
> 	- fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication
> 	- fake_advertiser6: announce yourself on the network
> 	- smurf6: local smurfer
> 	- rsmurf6: remote smurfer, known to work only against linux at the moment
> 	- sendpees6: a tool by willdamn(ad)gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff ;-) to keep the CPU busy. nice.
>         - thcping6: sends a hand crafted ping6 packet
>  
>  
> Thanks,
> 
> Nalini Elkins
> Inside Products, Inc.
> [phone]
> www.insidethestack.com
> 
>  
> _______________________________________________
> bmwg mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/bmwg