IETF Logo Mail Archive

Re: [v6ops] new draft: draft-elkins-v6ops-multicast-virtual-nodes

Nick Hilliard <nick@foobar.org> Fri, 19 September 2014 22:55 UTC

Return-Path: <nick@foobar.org>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 720F51A88A9 for <v6ops@ietfa.amsl.com>; Fri, 19 Sep 2014 15:55:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P1I7h7g33o-J for <v6ops@ietfa.amsl.com>; Fri, 19 Sep 2014 15:55:02 -0700 (PDT)
Received: from mail.netability.ie (mail.netability.ie [IPv6:2a03:8900:0:100::5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C78A71A87CB for <v6ops@ietf.org>; Fri, 19 Sep 2014 15:55:01 -0700 (PDT)
X-Envelope-To: <v6ops@ietf.org>
Received: from cupcake.foobar.org (xe-0-0-2.transit07.phb1.foobar.org [87.192.56.84]) (authenticated bits=0) by mail.netability.ie (8.14.9/8.14.5) with ESMTP id s8JMsvQ0006423 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO) for <v6ops@ietf.org>; Fri, 19 Sep 2014 23:54:58 +0100 (IST) (envelope-from nick@foobar.org)
X-Authentication-Warning: cheesecake.netability.ie: Host xe-0-0-2.transit07.phb1.foobar.org [87.192.56.84] claimed to be cupcake.foobar.org
Message-ID: <541CB43F.2040508@foobar.org>
Date: Fri, 19 Sep 2014 23:54:55 +0100
From: Nick Hilliard <nick@foobar.org>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: v6ops@ietf.org
References: <201409191147.s8JBl1Fe016458@irp-lnx1.cisco.com> <CAPi140O_WkcS9uFCSK0+tVDF3Z1sB4_UF5Zv9kpNEMh7m94Vww@mail.gmail.com> <1411154671.21942.YahooMailNeo@web125102.mail.ne1.yahoo.com> <CAPi140Ob+TeDyYfw_1A2Q55gEF5-rNrLynQ1LkGHOVnGcNcpLA@mail.gmail.com> <1411164118.44574.YahooMailNeo@web125106.mail.ne1.yahoo.com>
In-Reply-To: <1411164118.44574.YahooMailNeo@web125106.mail.ne1.yahoo.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/v6ops/kyVlVGPz2GiaUsoxwaO_3dt-TjE
Subject: Re: [v6ops] new draft: draft-elkins-v6ops-multicast-virtual-nodes
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 Sep 2014 22:55:04 -0000

On 19/09/2014 23:01, Nalini Elkins wrote:
> Andrew, I think you may have misunderstand me.  The behavior is very definitely not
> identical in IPv4.   In IPv4, many people block or disable directed broadcast PING.  Such
> PINGs can be used for amplification in Smurf attacks.
> 
> http://www.techrepublic.com/article/understanding-a-smurf-attack-is-the-first-step-toward-thwarting-one/
> 
> Ping to FF02::1 is definitely amplification when 10 echo requests can create 2,000+ 
> echo replies.   When you do a Ping on Linux, it is continuous until you stop it.
> So, you may very easily do amplification without even meaning to.

directed broadcast ping on ipv4 is harmful because it uses global
addresses, and the directed broadcast ping can be initiated remotely and
can be used to target third party addresses.  ff02::1 is link-local only,
which means that directed broadcast ping can only be initiated locally.  If
the operator follows BCP38, the replies will stay local so the scope for
damage is minimal.  The two aren't comparable.

Nick

v2.23.0 | Report a Bug | By Email