Re: [v6ops] new draft: draft-colitti-v6ops-host-addr-availability

[Mark Smith <[e-mail]>]

On 26 July 2015 at 11:21, George, Wes <[e-mail]> wrote:
<snip>
>
> 9.1 is combative, dismissive, and incomplete. The problem is not that
> operators have made the argument that DHCPv6 is the only way to...
> What they've said is that they require a way to track which IPv6 addresses
> are assigned to which hosts for policy and legal reasons, and that is
> driving a set of deployment decisions. That's not up for debate or
> negotiation, and is part of the reason why other discussions of this issue
> have been so...vigorous. IETF needs to get out of the habit of telling
> operators that their problem isn't a problem, and focus on discussing the
> possible solutions, identifying what consensus says is the best way to
> solve the problem.

So what I'd like to know more about then is the particular problem
being trying to be solved, or more specifically the business problem
or problems being solved.

"Having a record of IP addresses assigned to devices" isn't a problem
statement, it is a statement of what a mechanism such as DHCP is
theoretically achieves. That record needs to be used for something, so
what are those uses?

I assume it is to satisfy a security need. But what are the specific
security needs? Is there anything formal that requires it, e.g., PCI
DSS?

My view is that one of the security needs is to be able to have an
audit log of devices attached to the network at particular times, so
that if there is a security attack of some form, theoretically it is
possible to identify who and/or who's device was used for the attack.

Both DHCPv4 and DHCPv6 won't actually achieve that goal, because
neither of them record static address assignments on hosts, and DHCPv6
doesn't record link-local addresses assigned or in use either. A
competent attacker will certainly know the risks of using DHCP to
acquire an address on a network they wish to minimise their footprint
on. They'll configure valid static addresses or use link-local
addresses if their target is on-link.

The IETF can come up with a proper solution statement once a proper
problem statement exists. Does a proper problem statement exist
somewhere?


Regards,
Mark.