Re: 6MAN Adoption call on raft-chakrabarti-nordmark-6man-efficient-nd-04

[Lorenzo Colitti <[e-mail]>]

On Wed, Jan 8, 2014 at 9:12 PM, Mikael Abrahamsson <[e-mail]> wrote:

> For me, another important issue to solve is the ND exhaustion when there
> is scanning going on. So for me, the value of this document is if there is
> a "non-discovery mode" of ND implemented. It might be better to do this in
> a different document, I don't know.
>
> So a mode where the clients use ARO to register their addresses, and
> legacy clients use DHCPv6 for IA_NA and the ND table is populated by these
> two mechanisms and packets destined for unknown IPv6 addresses are just
> dropped.
>
> This would be a big win, especially if it could be done with minimal
> changes to the clients.


You don't need to modify ND to do that, though. You can defend against that
sort of attack by having the ND implementation:

1. Prioritize preserving ND cache entries over making new address
resolution attempts.
2. Glean ND cache entries from DAD packets (and if need be, NS/NA packets),
and prioritize those gleaned entries over new address resolution attempts.

Some of these measures are documented in RFC 6583.