Re: [v6ops] IPv6 link-local traffic questions

Owen,

On 25-Mar-20 11:51, Owen DeLong wrote:
>>
>>         TTL security is a necessity for ND with limited risk of run away ND packets as it’s  minimal bandwidth usage.
>>
>>
>>        With a multicast stream the risk is much greater if forwarded multiple hops past the BFER PE as stated and maybe a high data rate stream so undesirable to ever happen.
>>
>>      ND is the only protocol I know of that uses TTL security.  
>>
>>     I would go with TTL=1.
> 
> If you think this through, it depends on which problem you are trying to solve.
> 
> If you are looking to make sure that your packet won’t get accidentally forwarded by a non-malicious router, then a hop limit of 1 works best.
> If you are looking to make absolutely certain that the packet didn’t come from a non-local source, then a hop limit of 255 is the only choice.
> 
> If you use a hop limit of 1, then a remote attacker only needs to craft a packet with the correct initial hop limit to ensure that it arrives on
> your link what the appropriate remaining hop limit of 1.

Only if the router violates the spec:
"  Routers must not forward any packets with Link-Local source or
   destination addresses to other links." [RFC4291]
Do we have any evidence of routers that are broken in this way?

    Brian

> OTOH, if you require a hop limit of 255 on the receive side (thus requiring that the sender use a hop limit of 255), there’s no way to get
> a crafted packet through a (non-malicious) router and still have the packet retain a hop limit of 255.
> 
> Owen
> 
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> 