Re: [v6ops] Interesting problems with using IPv6

[joel jaeggli <[e-mail]>]

On 9/10/14 6:33 PM, Brian E Carpenter wrote:
> On 11/09/2014 00:26, Brian Haberman wrote:
>> Hi Andrew,
>>
>> On 9/10/14 6:18 AM, Andrew 👽  Yourtchenko wrote:
>>> On 9/10/14, Brian E Carpenter <[e-mail]> wrote:
>>>> On 10/09/2014 12:47, Fernando Gont wrote:
>>>>> On 09/09/2014 05:40 PM, Brian E Carpenter wrote:
>>>>>>>> Then, let me change the question: Why do I need MLD for *this*?
>>>>>> I think Brian Haberman's reply shows why that is the wrong question.
>>>>>> You need MLD for every multicast group, including a solicited-node
>>>>>> group, and if you insist on MLD snooping in the bridges (let's not
>>>>>> obfuscate by calling them switches) then you need to snoop every
>>>>>> solicited-node group.
>>>>>>
>>>>>> My question is orthogonal to MLD snooping: why do we require
>>>>>> router-alert
>>>>>> for MLD messages referring to a solicited-node group, since it by
>>>>>> definition is limited to a single L2 link (even if that link is
>>>>>> split up by bridges)?
>>>>> .. to avoid them being a special case?  -- i.e., all MLD packets carry a
>>>>> Router Alert option.
>>>> Yes, it would be an exception. But we know that HbH options in general
>>>> and Router Alert in particular are a serious performance issue, and
>>>> that all links carry this particular kind of MLD traffic, so an
>>>> exception seems like something to be discussed.
>>> How does this interact with the case where a "pure L2" switch within
>>> the link would want to snoop MLD ? Presumably, today the L2 switch
>>> would see the "router alert" and know that it needs to process this
>>> traffic.
>>>
>>> If this were to be removed, then it would be much trickier to direct
>>> the traffic to the slow path in that scenario, wouldn't it ?
>>
>> I think that depends.  As I mentioned in an earlier e-mail, some routers
>> simply use the IPv4 Protocol field or the IPv6 Next Header field to see
>> if they need to process the packet.  It is unclear (to me) how many
>> implementations still use the Router Alert to determine if the packet
>> needs local processing.  Maybe some vendors could chime in?
> 
> I have the impression that many boxes will look at *any* ICMPv6
> packet, because in their firewall role they filter ICMPv6.
> In that case the Router Alert is certainly redundant. However,
> we do need vendor feedback, as you say.

Beware equating filtering with with inspection by the control plane,
many asic based forwarding platforms ingress acl matches are never slow
path. they wouldn't be useful for dos protection if they had to hit a cpu.

> 
>    Brian C
> 
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>