Re: 6MAN Adoption call on raft-chakrabarti-nordmark-6man-efficient-nd-04

[Lorenzo Colitti <[e-mail]>]

On Thu, Jan 9, 2014 at 4:05 PM, Mikael Abrahamsson <[e-mail]> wrote:

>
>> I'm afraid I don't understand the question. You can't "just drop packets
>> not in your ND table already" - otherwise you won't be able to talk to a
>> new host that just joined the link. What I believe you can do is, even when
>> you are under full-scale attack, allow the following to work:
>>
>
> If you glean the DAD packet the host most likely will emit, then that
> works around the problem.


Or the RSes which it also most likely will emit (and, with
draft-6man-resilient-rs, which it will continue to emit until you send it
an RA), yes.


> 1. Communications to and from devices in your table keep working.
>> 2. New directly-connected devices can make it into your neighbour cache.
>>
>> Is there something else would you want to do?
>>
>
> No, that is exactly what I want to do,


So if that's what you want to do, then I think you can do it with the
current ND protocol, even if you are under full-scale attack, with the
implementation optimizations I described (gleaning and prioritization).


> but I don't want to start doing discovery because I received a packet from
> an external source to an address on my LAN I don't currently have any
> decent knowledge of that it is in use.
>

Why not? What's the downside of sending out an NS for an address that's not
there? You consume an ND cache slot for the incomplete entry, but if you
use the optimizations you'll always have enough space to avoid a DoS
scenario.