Re: [v6ops] Operational guidelines for a company/organization IPv6 address scheme supplemental to RFC5157

[Fernando Gont <[e-mail]>]

Stefan,

On 09/25/2012 11:42 AM, Marksteiner, Stefan wrote:
> First of all I think I've forgotten to clarify that I'm talking about
> IIDs, sorry ;) The aim of my thoughts would be to make it harder for
> externals to scan for attackable addresses.

If so, you should implement draft-ietf-6man-stable-privacy-addresses


> One often cited (mostly
> by marketeers) benefit of IPv6 is the vast amount of addresses per
> subnet making it seemingly harder to scan, which would be nullified
> if companies used simple sequential addressing.

It's also nullified for other reasons. Please see:
<http://www.si6networks.com/presentations/IETF84/fgont-ietf84-opsec-host-scanning.pdf>


> I'm suggesting to recommend companies to use a different scheme as
> ::1;::2 or ::BABE;::CAFE or even ::4593;4594 and so on which
> according to some studies (e.g. [1], pp.65-75, especially 68) most
> administrators unfortunately do. What might be needed to change this
> would be a scheme which is practicably administrable in the easiest
> possible way.

draft-ietf-6man-stable-privacy-addresses aims at exactly that.

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492