Re: [v6ops] SLAAC renum: Problem Statement & Operational workarounds

[Owen DeLong <[e-mail]>]

> On Oct 31, 2019, at 12:47 PM, Ted Lemon <[e-mail]> wrote:
> 
> On Oct 31, 2019, at 3:41 PM, Fernando Gont <[e-mail] <mailto:[e-mail]>> wrote:
>> As someone that has played a lot with ND-based DoS vectors, I should say
>> that you trust RAs, or you don't. If you do, all bets are off. ("sudo
>> apt-get install ipv6toolkit;man ra6" and you'll get examples of a bunch
>> of other DoS attacks that an attacker can perform).
> 
> As an end user, I don’t have this experience.   If someone is spamming my network with RAs, I can find out who and disconnect them.   A DoS attack based on massive quantities of RAs is a lot different than an attack that shuts my network off with one multicast. 

There are a variety of attacks in Fernando’s documentation which do not require large numbers of Gas.

A few multicast RAs well timed can, for example, change everyone’s default gateway for MITM games.

Another thing you often seem to miss, Ted, is that not everyone’s environment is necessarily similar to yours.

When developing I-Ds and RFCs, care must be taken to consider that the internet is an extremely diverse set of networks in an even more diverse set of environments.

Owen