Re: [v6ops] Fwd: New Version Notification for draft-linkova-v6ops-ipmaclimi-00.txt

[Nick Hilliard <[e-mail]>]

Mark Smith wrote on 08/11/2022 22:16:
> These problems fundamentally exist because hosts are in a position to 
> create state in network elements without getting authorisation and 
> therefore exhaust that state capacity

The IETF designed slaac with a specific philosophy in mind, namely that 
the network client should not be especially constrained by the policies 
of the network operator. Part of this approach included giving slaac a 
default free-for-all in terms of number resource acquisition inside any 
particular prefix. So this didn't happen by accident - it was a 
fundamental design choice.

> This is not a new problem, IPv4 ARP caches have always been vulnerable 
> to state capacity exhaustion.

You're correct that it's not a new problem: for mechanisms like 
DHCP/ipv4, static/ipv4 and static/ipv6, the client needs to set out to 
go out of its way to claim network resources.  With DHCPv6, the problem 
can be managed by setting per-client limits.  What's different with 
SLAAC is that unconstrained resource acquisition is enabled by default 
and there's no option to disable or constrain the behaviour.

Nick