Re: [v6ops] IPv6 link-local traffic questions

[Owen DeLong <[e-mail]>]

> 
> TTL security is a necessity for ND with limited risk of run away ND packets as it’s  minimal bandwidth usage.
> 
>    With a multicast stream the risk is much greater if forwarded multiple hops past the BFER PE as stated and maybe a high data rate stream so undesirable to ever happen.
> 
>  ND is the only protocol I know of that uses TTL security.  
> 
> I would go with TTL=1.

If you think this through, it depends on which problem you are trying to solve.

If you are looking to make sure that your packet won’t get accidentally forwarded by a non-malicious router, then a hop limit of 1 works best.
If you are looking to make absolutely certain that the packet didn’t come from a non-local source, then a hop limit of 255 is the only choice.

If you use a hop limit of 1, then a remote attacker only needs to craft a packet with the correct initial hop limit to ensure that it arrives on
your link what the appropriate remaining hop limit of 1.

OTOH, if you require a hop limit of 255 on the receive side (thus requiring that the sender use a hop limit of 255), there’s no way to get
a crafted packet through a (non-malicious) router and still have the packet retain a hop limit of 255.

Owen