Re: [v6ops] IPv6 link-local traffic questions

[Gert Doering <[e-mail]>]

Hi,

On Sat, Mar 14, 2020 at 02:07:34AM -0400, Gyan Mishra wrote:
> I always wondered why RFC 4862 states that ND & RD packets have TTL 255.
> We have run into so many PSIRT bugs with ND which makes it more problematic
> having the TTL 255.

Read what has been written in this thread.

On the *receiving end* you MUST filter on TTL=255 for ND packets, to ensure
that these packets can never be send from an off-link node.

Consequently, you MUST send with TTL=255, so that the filter on the receiving
end can work.

> Since ND & RD packets would always be local scope in your response to
> Toreless you mentioned that GTSM that ND using 255 is kind of an example of
> GTSM in the sense that the TTL is set to 255 for a direct neighbor
> adjacency.  I think though the security issues of TTL 255 with ND/RD
> packets seem to make security a bigger issue then just leaving TTL=1.

You do not seem to understand the security issues involved :-)

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: [phone]         USt-IdNr.: DE813185279