Re: 6MAN Adoption call on raft-chakrabarti-nordmark-6man-efficient-nd-04

[Ole Troan <[e-mail]>]

On 09 Jan 2014, at 8:57 , Mikael Abrahamsson <[e-mail]> wrote:

> On Thu, 9 Jan 2014, Lorenzo Colitti wrote:
> 
>> Why not? What's the downside of sending out an NS for an address that's not there? You consume an ND cache slot for the incomplete entry, but if you use the optimizations you'll always have enough space to avoid a DoS scenario.
> 
> Because potentially this would cause hundreds or thousands of NS multicast packets on the LAN per second in a ddos scenario?
> 
> If we can avoid the router having to learn anything by means of external packet triggers, I think it would be a big win.

a game of whac-a-mole? ;-)
at least you have a new set of problems that needs to be solved.

- how is state maintained on the first-hop router(s)?
  how does the host detect that the first-hop router has lost state?
  how do you synchronize state between the set of routers on the link?
- while ND classic scales by the number of active addresses on the link,
  you'll now scale by the total number of addresses on the link
- how do routers garbage collect? i.e. how do routers detect that an address is no longer in use, 
  the node has left the link?

as Lorenzo stated I believe the external DOS attacks on the ND cache can be mostly mitigated
by a good implementation. prioritising the active speakers, rate-limiting the number of request per second,
use a circular buffer and so on. it wouldn't be completely unexpected if there was some level of
stateful or stateless filtering being done on the borders stopping these forms of attacks either.

that said, vendors do implement snooping solutions e.g. 
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book.pdf
(not touting cisco's solution here, I'm sure all the other vendors have similar, but it was the
first I found). 

that use ND and DHCP snooping to maintain a stateful table on the first-hop routers and switches.
address registration may make such solutions easier to implement.

cheers,
Ole