Re: 6MAN Adoption call on raft-chakrabarti-nordmark-6man-efficient-nd-04

[Lorenzo Colitti <[e-mail]>]

On Thu, Jan 9, 2014 at 3:09 PM, Mikael Abrahamsson <[e-mail]> wrote:

> You don't need to modify ND to do that, though. You can defend against that
>> sort of attack by having the ND implementation:
>>
>> 1. Prioritize preserving ND cache entries over making new address
>> resolution attempts.
>> 2. Glean ND cache entries from DAD packets (and if need be, NS/NA
>> packets),
>> and prioritize those gleaned entries over new address resolution attempts.
>>
>> Some of these measures are documented in RFC 6583.
>>
>
> If I do that, can I instantly drop packets not in my ND table already? (or
> my table of 1 and 2 above)?
>
> If not, I don't consider it a complete solution.


I'm afraid I don't understand the question. You can't "just drop packets
not in your ND table already" - otherwise you won't be able to talk to a
new host that just joined the link. What I believe you can do is, even when
you are under full-scale attack, allow the following to work:

1. Communications to and from devices in your table keep working.
2. New directly-connected devices can make it into your neighbour cache.

Is there something else would you want to do?