Re: [v6ops] Mitigation against IPv6 Router Advertisements flooding - draft-moonesamy-ra-flood-limit-00

[S Moonesamy <[e-mail]>]

Hi Arturo,
At 04:30 04-07-2013, Arturo Servin wrote:
>     Sorry, I should have said "Or are these recommendations orthogonal
>to a network applying RA Guard?"

Yes.

>     I think the ansewer is still yes. But for that reason I think that
>you should mention that this is an add-on to RA Guard (not instead of,
>not criticizing it) and it is intended to provide some security
>mechanisms to the host when the network administrator do not have this
>capability (RA-Guard) in its network.

I think that we are looking at this from two different angles.  I can 
look at this in terms of:

  (a) how does the network protect the host

  (b) how is the host protected

If there is a protection for (a), for example, Router Advertisement 
Guard, (b) might not be much of a problem.  If the host is protected, 
the question being asked is whether (a) is needed or not.  I am not 
trying to answer that question as there is existing code for doing 
(b) and that is what the draft is talking about.  What the person 
writing the code for the host may wish to say is that their system 
provides for the limits mentioned in draft-moonesamy-ra-flood-limit-00.

>     In the end, having RA-Guard could solve enteraly this problem, but
>when it is not provided by the network the host should have mechanisms
>to defend itself. Then is when your draft applies. Does it make sense my
>comment?

Yes, I understood what you wrote.  In my opinion it depends on your 
security posture.  Some people may prefer to put security closer to 
the end whereas others might find it better to do it centrally.  RFC 
6104 discusses about scenarios and different methods to mitigate 
against rogue Router Advertisements.  In my opinion that is where the 
above is more relevant.  What the code does is to prevent the host it 
is running on from crashing.

Regards,
S. Moonesamy