Re: 6man w.g. last call for <draft-ietf-6man-grand>

[Jen Linkova <[e-mail]>]

On Thu, Jul 23, 2020 at 9:01 AM Mark Smith <[e-mail]> wrote:
> There are other issues that this method provides benefits to or
> solves, more than just the specific problem you're thinking about:
>
> - helping mitigate ND cache exhaustion DoS attack by preloading the
> cache with addresses

I'm not sure I fully understand how it would help...Could you please elaborate?
The attack is trying to create a lot of INCOMPLETE entries by sending
packets to non-existing addresses.
Unless we require that routers rely on GRAND only and never even try
to create a new entry upon receiving a packet to an address never seen
before, the router behaviour would still be the same.

> > The routers already have all link-local addresses of hosts on the LAN
> > in their caches.
>
> I don't understand how.

OK, I should have said 'all link-local addresses which hosts have used'.
An address which has not been used (send/receive packets) might not be
in the cache.

> Hosts aren't limited to a single link-local address on an interface,
> and could generate a new one at any time. So if a host generates a new
> LLA, it would do GRAND for it so that the routers are informed of the
> new LLA.

Well, as soon as the host starts using that LLA it would be sending ND
packets from it which would populate the cache entry anyway.
But I agree, GRAND would make it faster.

> > > I think it would be better to remove all the text around link-layer
> > > unicasting of GRAND NAs for the time being.

OK, will do in the next version.

-- 
SY, Jen Linkova aka Furry