Re: Address privacy

[Fernando Gont <[e-mail]>]

On 30/1/20 15:00, Michael Richardson wrote:
> 
> Ca By <[e-mail]> wrote:
>      >> The rationale for temporary addresses may be obvious, but I don't believe
>      >> anyone has yet quantified the effects. For instance, RFC4941 is thirteen
>      >> years old, is there any evidence that it has materially improved anyone's
>      >> privacy? (I'm not being cynical, but I think it's a fair question).
>      >>
> 
>      > Anecdotally, i would say unequivocally yes at a large scale eyeballs
>      > network, random iid has materially improved security of the host.
>      > The
>      > inability to do network scanning is huge.
> 
> This feels like an anecdotal observation.
> 
> Have you been able to quantify the difference in script-kiddie/scanning
> attacks over the years?    A graph of ND traffic from the router out
> would probably be one way to measure this.
> 
> The IETF NOC struggled with arp-exhaustion due to scanners, but then got
> solutions in the APs/routers for IPv4, which I think worked eventually for
> IPv6.   But, do we get any data on this?
> 
> Did anyone actually try to scan IPv6 subnets before privacy addresses?

I assume by "privacy" you meant "temporary" (RFC4941). If so: temporary 
addresses are irrelevant. They key change here was RFC7217. Pre-rfc7217, 
addresses still had patterns. Nowadays, slaac addresses don't.


FWIW, I have scanned IPv6 networks both before and after RFC7217.


> My IPv4/28 is continously being probed, but I rately see any IPv6 scan
> traffic.

Scan of your /64, or port scan of your IPv6 address(es)?

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492