Re: [v6ops] Fwd: New Version Notification for draft-taylor-v6ops-fragdrop-00.txt

On Oct 16, 2012, at 7:21 AM, Gert Doering <gert@space.net> wrote:

> Hi,
> 
> On Tue, Oct 16, 2012 at 08:07:08AM +0100, Brian E Carpenter wrote:
>> Use the flow label. This is one of the reasons we did RFC 6436, 6437 and 6438.
> 
> So how exactly is "filter based on an arbitrary value the attacker can
> control" better than "just let non-initial fragments through"?
> 
> Which is what I'd do - either reassemble at the (stateful) firewall,

Reassembly at "firewalls" is wickedly expensive (in terms of CPU, memory, etc) and often end up as bottlenecks under things like missing fragment / incomplete fragment attacks.  Also, this is assuming that there is a stateful firewall somewhere between the Internet and your network -- for many many people this is not true (or really possible).

> or let non-initial fragments pass.

Or drop them…

W

> 
> Gert Doering
>        -- NetMaster
> -- 
> have you enabled IPv6 on something today...?
> 
> SpaceNet AG                        Vorstand: Sebastian v. Bomhard
> Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
> D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
> Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 

--
Consider orang-utans.
In all the worlds graced by their presence, it is suspected that they can talk but choose not to do so in case humans put them to work, possibly in the television industry. In fact they can talk. It's just that they talk in Orang-utan. Humans are only capable of listening in Bewilderment.
-- Terry Practhett