Re: [v6ops] new draft: draft-elkins-v6ops-multicast-virtual-nodes

[Mikael Abrahamsson <[e-mail]>]

On Mon, 22 Sep 2014, Nalini Elkins wrote:

> If I have a 1,000 nodes under my control, then that is how many that 
> should be in my AD and BD.  IPv6 allows for large subnets so why not?

Because it's a bad idea. IPv4 allows for subnetting at /22 for your 1000 
nodes, that doesn't mean it's a good idea.

> Possibly not.  We wanted to raise the issue.  BTW, Pings, as you know,
> are the precursor to much malicious activity.  It is something that

No, I don't know that. ICMP PINGs are an essential diagnostic tool.

> someone with ill intent is liable to do readily.  And, it provides
> a huge amount of data on other nodes in a broadcast domain.

I don't believe in security by obscurity. I believe in real security.

> "The one MAC address that all devices share in common in normal 
> operation is the media broadcast, or FF:FF:FF:FF:FF:FF.  In this case, a 
> device will take the packet and send an interrupt for processing. Thus, 
> a flood of these broadcast frames will consume all available resources 
> on an end-system [9]. It is perhaps prudent that system administrators 
> should consider ensuring that their border routers do not allow directed 
> broadcast packets to be forwarded through their routers as a default."

... and this is exactly what happened in 1997 when smurf attacks were 
stopped by this exact feature. "no ip directed-broadcast" on Cisco 
routers. You can still ping the broadcast address from the router itself, 
it just won't allow remote pings to work as it won't forward packets to 
the network broadcast IP address. Exactly the same way it works in IPv6 
because Link local addresses aren't reachable from another interface and 
aren't forwarded between interfaces.

> On Linux, I believe when you do a PING, it is continuous until 
> intentionally stopped.  So, doing a Ping to FF02::1 from a Linux machine 
> will create havoc without having ill intent.  That is, accidentally.

Absolutely, and it's all due to the decision to put a lot of nodes in the 
same L2 domain which has been known for 20-30 years to be bad design and 
can cause the exact problems you're describing. If you ping the network 
broadcast address on IPv4 you get the exact same thing, I don't see why 
you blame IPv6 for this?

-- 
Mikael Abrahamsson    email: [e-mail]