Re: [CGA-EXT] Hashed DAD

On 28 feb 2008, at 23:14, Suresh Krishnan wrote:

>> However, wouldn't the attack only work if M gets to monitor all  
>> multicast traffic? If M is required to set up MLD state for the  
>> multicast group that the NS goes to then a layer 2 device could  
>> limit the number of multicast groups that M can subscribe to and  
>> existing DAD wouldn't be susceptible to this attack.

> Depends on the link type. On an ethernet link, it would be as easy  
> as putting the interface in promiscuous mode.

That won't help you if the ethernet switch doesn't forward the  
multicasts. Although the really cheap switches implement multicast  
simply by broadcasting them to all ports and the somewhat more  
expensive but still cheap switches don't support IGMP snooping (and we  
can reasonably assume that in the future, they won't support MLD  
snooping), in a managed environment having the switches do this is  
probably easier than a protocol-based solution.

However, on wireless links it's much harder to protect against  
stations simply receiving all multicasts.
_______________________________________________
CGA-EXT mailing list
CGA-EXT@ietf.org
https://www.ietf.org/mailman/listinfo/cga-ext