Re: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

Hi Fernando,
You did not mention that the /48 may be dynamic (PA changing over time).
Hence, even /48 block may not block the offender.
The offender in principle may buy a connection from such a Carrier. Then rotate his /56 periodically.

The possibility to trace offenses against RIR blocks is missing in the document.
It is the most meaningful statistic.

IMHO: it may sense to mention in the absent conclusion that "there is no reliable way to block only offender. If the offense is big enough, it is possible to block legal entity (consulting with RIRs registry)."
Eduard
-----Original Message-----
From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of Fernando Gont
Sent: Tuesday, February 7, 2023 7:28 AM
To: IPv6 Operations <v6ops@ietf.org>
Subject: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

Folks,

FYI, this one is targeted at opsec, but might be of interest to this group:

* TXT: 
https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
* HTML: 
https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html

Thanks!

Regards,
Fernando

-------- Forwarded Message --------
Subject: (IETF I-D); Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for
draft-gont-opsec-ipv6-addressing-00.txt)
Date: Fri, 3 Feb 2023 01:28:17 -0300
From: Fernando Gont <fgont@si6networks.com>
To: opsec@ietf.org

Hi, All,

I happened to participate in an IPv6 deployment meeting with some large content provider. Eventually there was a discussion about how to mitigate some attacks using block-lists, and they argued that they ban offending addresses (/128 for the IPv6 case), following IPv4 practices. 
While they had already deployed IPv6, some of the associated implications arising from the increased address space seemed to be non-obvious to them.

So that's what motivated the publication of this document.

* TXT: 
https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
* HTML: 
https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html

Comments welcome!

Thanks,
Fernando

-------- Forwarded Message --------
Subject: New Version Notification for
draft-gont-opsec-ipv6-addressing-00.txt
Date: Thu, 02 Feb 2023 19:48:40 -0800
From: internet-drafts@ietf.org
To: Fernando Gont <fgont@si6networks.com>, Guillermo Gont <ggont@si6networks.com>

A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt
has been successfully submitted by Fernando Gont and posted to the IETF repository.

Name:		draft-gont-opsec-ipv6-addressing
Revision:	00
Title:		Implications of IPv6 Addressing on Security Operations
Document date:	2023-02-02
Group:		Individual Submission
Pages:		8
URL: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/
Htmlized: 
https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing

Abstract:
    The increased address availability provided by IPv6 has concrete
    implications on security operations.  This document discusses such
    implications, and sheds some light on how existing security
    operations techniques and procedures might need to be modified
    accommodate the increased IPv6 address availability.

The IETF Secretariat

_______________________________________________
v6ops mailing list
v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops