RE: [EXTERNAL] Improving ND security

["Templin (US), Fred L" <[e-mail]>]

Does it solve the problem Owen was talking about (overloading neighbor tables as an attack)?  Is there agreement that this is a serious problem in any case?

Ted, I think SEND would solve the neighbor cache resource exhaustion attack since a NCE is
only created on receipt of an authentic (SEND-protected) IPv6 ND message.

I believe that for aviation networks, intelligent transportation systems, and other mobile node
use cases there will certainly be cases where the mobile node comes onto the network via an
unprotected open-access wireless access network. In that case, the only mitigations would be
for the MN to stand up a VPN (which is expensive overkill) or somehow use IPv6 ND with
appropriate authentication controls applied. SEND seems like agood fit for the latter.

Thanks - Fred


From: Ted Lemon [mailto:[e-mail]]
Sent: Friday, July 31, 2020 9:13 AM
To: Templin (US), Fred L <[e-mail]>
Cc: Pascal Thubert (pthubert) <pthubert=[e-mail]>; v6ops list <[e-mail]>; 6man <[e-mail]>
Subject: Re: [EXTERNAL] Improving ND security




On Jul 31, 2020, at 12:10 PM, Templin (US), Fred L <[e-mail]<mailto:[e-mail]>> wrote:
I like SEND, and it is written into my documents – is that enough of a push, or do I need
to do more aggressive marketing? Interested in helping?

The push would have to be from somebody producing software that has broad reach. And it would have to solve a real problem or nobody with that reach would try to do it.

Does it solve the problem Owen was talking about (overloading neighbor tables as an attack)?  Is there agreement that this is a serious problem in any case?