Re: 6man w.g. last call for <draft-ietf-6man-grand>

[Mark Smith <[e-mail]>]

Hi Jen,

On Thu, 23 Jul 2020, 11:15 Jen Linkova, <[e-mail]> wrote:

> On Thu, Jul 23, 2020 at 9:01 AM Mark Smith <[e-mail]> wrote:
> > There are other issues that this method provides benefits to or
> > solves, more than just the specific problem you're thinking about:
> >
> > - helping mitigate ND cache exhaustion DoS attack by preloading the
> > cache with addresses
>
> I'm not sure I fully understand how it would help...Could you please
> elaborate?
> The attack is trying to create a lot of INCOMPLETE entries by sending
> packets to non-existing addresses.
> Unless we require that routers rely on GRAND only and never even try
> to create a new entry upon receiving a packet to an address never seen
> before, the router behaviour would still be the same.
>

That's why I said "mitigate" not "solve" ;-)



> > > The routers already have all link-local addresses of hosts on the LAN
> > > in their caches.
> >
> > I don't understand how.
>
> OK, I should have said 'all link-local addresses which hosts have used'.
> An address which has not been used (send/receive packets) might not be
> in the cache.
>
> > Hosts aren't limited to a single link-local address on an interface,
> > and could generate a new one at any time. So if a host generates a new
> > LLA, it would do GRAND for it so that the routers are informed of the
> > new LLA.
>
> Well, as soon as the host starts using that LLA it would be sending ND
> packets from it which would populate the cache entry anyway.
>

It wouldn't be in the router's ND cache though unless the LLA was used to
communicate with the router or through the router per the ability to
forward LLA addressed packets.


> But I agree, GRAND would make it faster.
>

This would be where GRAND ensures a new LLA is in the router's cache. Some
of the time it's only reason to be there is for the IPv6 addresses in use
on the link purpose.

> > > I think it would be better to remove all the text around link-layer
> > > > unicasting of GRAND NAs for the time being.
>
> OK, will do in the next version.
>
>
Great, thanks very much.

Regards,
Mark.


> --
> SY, Jen Linkova aka Furry
>