Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Jen Linkova <[e-mail]>]

On Sat, Oct 20, 2018 at 4:09 AM Sander Steffann <[e-mail]> wrote:
> > All those people can take the whole network (almost) down with a
> > single packet w/o the v6-only flag anyway.
> > How about this:
> > - kids/students/disgruntled employees/you can send an RA with GUA PIO
> > and RDNSS option;
> > - hosts start sending IPv6 traffic to IPv6-enabled destinations to the
> > rogue host;
> > - it would be enough for the attacker to respond with SYN/ACK to TCP
> > handshake to take Happy Eyeballs out of the picture for TCP traffic;
>
> And here you go beyond "a single packet".

I don't think so. A single packet is enough to redirect all v6 traffic
to the attacker.

> > I agree we shall avoid all of that. But the way to do this is not by
> > setting/unsetting some flags in RAs but by implementing proper IPv6
> > security.
>
> The world of SMBs and home networks is not like that... The vast majority of SMBs don't even have a manageable switch.

Oh in that case they don't even need an RA to make the network unusable.
Rogue DHCP server etc.

-- 
SY, Jen Linkova aka Furry