Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Sander Steffann <[e-mail]>]

Hi,

> All those people can take the whole network (almost) down with a
> single packet w/o the v6-only flag anyway.
> How about this:
> - kids/students/disgruntled employees/you can send an RA with GUA PIO
> and RDNSS option;
> - hosts start sending IPv6 traffic to IPv6-enabled destinations to the
> rogue host;
> - it would be enough for the attacker to respond with SYN/ACK to TCP
> handshake to take Happy Eyeballs out of the picture for TCP traffic;

And here you go beyond "a single packet".

> - the attacker can also answer DNS requests and make the situation
> even worse (if the victims prefer to use RDNSS servers);

Same here.

>> Such networks have no capacity for debugging anyway, and because of the low number of packets necessary to sustain the attack won't know what hit them. ISPs will get calls about the internet being broken, ICT consultants will spend hours searching for the cause of the problem, they will all blame "that annoying IPv6 thingy" etc etc etc. Let's avoid all of that.
> 
> I agree we shall avoid all of that. But the way to do this is not by
> setting/unsetting some flags in RAs but by implementing proper IPv6
> security.

The world of SMBs and home networks is not like that... The vast majority of SMBs don't even have a manageable switch.

Cheers
Sander