Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Ole Trøan <[e-mail]>]

Lorenzo,

> I don't see how we can build protocols to accommodate middle boxes, and we have already done RFC3514.
> 
> I'm sorry, but there are real operational needs here.
> 
> Here's an example: suppose I am under attack by a TCP SYN flood and want to rate-limit it or filter it out so I can process legitimate traffic.
> 
> It would be reasonable for me to want to do this on a peering router, because it's as close as possible to the source, and it's a high-capacity, scalable box that needs to process each packet anyway.
> 
> I don't want to carry tens of gigabits of useless attack packets all the way the way through the network to the end host, and overwhelm it, so I can drop them there. And I also don't want to put stateful firewalls at each peering connection, because the firewalls cost a lot of money, take up space in POPs and connecting them wastes expensive ports on peering routers.
> 
> The right way to deal with this is to rate-limit or drop on the routers. You're saying the architecture doesn't allow this? Then I'm sorry, but we need a better architecture. 

yes, we need a better architecture. IPv4 and IPv6 are not different here.
I disagree that the architecture you propose is a better one though.

if I understand you correctly, to solve the above problem you need:
 - deprecate all IPv6 extension headers
 - deprecate IPv4 and IPv6 fragmentation
 - ban use of IPsec
 - ban any new transport protocol, e.g. SCTP

aren't there other solutions to this problem? no other attack signature?

cheers,
Ole