IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

Tore Anderson <tore@fud.no> Wed, 13 November 2013 08:07 UTC

Return-Path: <tore@fud.no>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DBBA21F9E43 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 00:07:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.55
X-Spam-Level:
X-Spam-Status: No, score=-2.55 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id skU-3Dc6AA-v for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 00:07:01 -0800 (PST)
Received: from greed.fud.no (greed.fud.no [IPv6:2a02:c0:1001:100::145]) by ietfa.amsl.com (Postfix) with ESMTP id 1B03E11E8114 for <v6ops@ietf.org>; Wed, 13 Nov 2013 00:06:48 -0800 (PST)
Received: from [2a02:c0:2:1:1194:17:0:1000] (port=33791 helo=echo.linpro.no) by greed.fud.no with esmtpsa (TLS1.0:DHE_RSA_CAMELLIA_256_CBC_SHA1:256) (Exim 4.80) (envelope-from <tore@fud.no>) id 1VgVTG-0000J9-8T; Wed, 13 Nov 2013 09:06:42 +0100
Message-ID: <52833312.5010901@fud.no>
Date: Wed, 13 Nov 2013 09:06:42 +0100
From: Tore Anderson <tore@fud.no>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.1.0
MIME-Version: 1.0
To: "Fred Baker (fred)" <fred@cisco.com>, "v6ops@ietf.org WG" <v6ops@ietf.org>
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com>
In-Reply-To: <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Nov 2013 08:07:03 -0000

* Fred Baker (fred)

> My first premise in both cases is that a firewall primarily mitigates
> attacks on the bandwidth of a network and an aggregated network.

For this to actually be the case, the firewall's WAN link must have a
higher bandwidth than the LAN it protects. I'd say this is rather
uncommon in residential broadband these days, so the even if the CPE's
firewall drops absolutely *everything*, a bandwidth attack would still
succeed.

Tore

v2.23.0 | Report a Bug | By Email