Re: [v6ops] new draft: draft-elkins-v6ops-multicast-virtual-nodes

[Nalini Elkins <[e-mail]>]

 
>A directed broadcast ping on IPv4 gives pretty much the same result.
>Did you test the effects of that ?

I had not.  But, since you mentioned it, I did it on two different Windows machines.  The one that is the server in question had the following results:

C:\Users\Administrator>ping x.x.x.255

Pinging x.x.x.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for x.x.x.255:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Arp cache was not updated.   I did a packet trace in the background and indeed no ICMP replies were seen.   

I did the same ping x.x.x.255 on one of my client PCs and saw:

Pinging x.x.x.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

But this time the packet trace showed that actually ICMP replies were sent.

>Of course, private VLANs or (if we are talking VMs) or just using p2p
>links with /128s would help this in the environments where the hosts
>can not be trusted - and this of course is not virtual/physical
>specific.

Yes.  We wanted to bring up the topic of isolation of nodes for discussion.

>If we're talking specifically virtual environment, here's an approach
>on how to use ebtables to isolate the hosts:

>ebtables -P FORWARD DROP
>ebtables -F FORWARD
>ebtables -A FORWARD -i $uplinkPort -j ACCEPT # let the traffic flow
>from uplink to any ports
>ebtables -A FORWARD -o $uplinkPort -j ACCEPT # let the traffic flow
>from any ports to uplink

>(source:http://serverfault.com/questions/388544/is-it-possible-to-enable-port-isolation-on-linux-bridges)

I think this is very good.  But, unfortunately not very well known.   Also, is this possible for all platforms or just Linux?

>So looks like the question at hand is:

>"Should IPv6 nodes respond to Ping to FF0x::1?"

>Which can be rephrased differently to ease the start of the discussion:

>"What are the legitimate uses of a ping to ff0x::1 ?"

>Right ?

Yes.

--a


On 9/19/14, [e-mail] <[e-mail]> wrote:
> A new draft has been posted, at
> http://tools.ietf.org/html/draft-elkins-v6ops-multicast-virtual-nodes.
> Please take a look at it and comment.
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>