Re: [v6ops] new draft: draft-elkins-v6ops-multicast-virtual-nodes

A directed broadcast ping on IPv4 gives pretty much the same result.
Did you test the effects of that ?

Of course, private VLANs or (if we are talking VMs) or just using p2p
links with /128s would help this in the environments where the hosts
can not be trusted - and this of course is not virtual/physical
specific.

If we're talking specifically virtual environment, here's an approach
on how to use ebtables to isolate the hosts:

ebtables -P FORWARD DROP
ebtables -F FORWARD
ebtables -A FORWARD -i $uplinkPort -j ACCEPT # let the traffic flow
from uplink to any ports
ebtables -A FORWARD -o $uplinkPort -j ACCEPT # let the traffic flow
from any ports to uplink

(source: http://serverfault.com/questions/388544/is-it-possible-to-enable-port-isolation-on-linux-bridges)

So looks like the question at hand is:

"Should IPv6 nodes respond to Ping to FF0x::1?"

Which can be rephrased differently to ease the start of the discussion:

"What are the legitimate uses of a ping to ff0x::1 ?"

Right ?

--a

On 9/19/14, fred@cisco.com <fred@cisco.com> wrote:
> A new draft has been posted, at
> http://tools.ietf.org/html/draft-elkins-v6ops-multicast-virtual-nodes.
> Please take a look at it and comment.
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>