Re: [v6ops] Revised I-D: Advice on RA-Guard Implementation

[Simon Perreault <[e-mail]>]

On 01/08/2012 09:14 PM, Fernando Gont wrote:
> The second bullet in Section 3 is meant to address fragment-handling:
>
>     o  If the layer-2 device is unable to identify whether the packet is
>        an ICMPv6 Router Advertisement message or not (i.e., the packet is
>        a fragment, and the necessary information is missing), and the
>        IPv6 Source Address of the packet is a link-local address or the
>        unspecified address (::), block the packet.
>
> The idea is that if that non-first fragments are always forwarded,
> whereas first-fragments are blocked if:
>
> a) We've found that what follows the fragment header is an RA packet, or,
>
> b) this is a first-fragment, and it is missing upper-layer protocol
> information.

Ok, I understand now. Thanks.

I still don't see where in the text it is said that non-first fragments 
are always forwarded. It looks like it makes no difference between first 
and non-first.

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca