Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text

[[e-mail]]

> So would you expect all of your routers to be able to do this
> level of processing?

Yes.

> It seems to me that you'd only need routers that can do that
> processing facing potential malicious sources e.g. transit, peering,
> and possibly customer (although customers have a strong disincentive
> because it is in their interests for the router to stay
> available).

Customers themselves may have such a disincentive (unless they are
trying to deliberately sabotage the network infrastructure - which has
been known to happen). Customer PCs and other equipment which are
"owned" (i.e. part of a botnet, under control of an external party)
may well have a strong incentive to deliberately create problems.

> I wouldn't think it would be worth the expense to have
> this level of hardware filtering available on core routers.

Reasonable arguments can be made either way (Same level of hardware
filtering for core routers: Potentially more expensive hardware, but
potentially simpler logistics - fewer hardware product variants).

I *might* consider core routers without such hardware filtering *if*
I was running a pure MPLS core, and was reasonably certain customer
traffic wouldn't hit the core routers directly.

Steinar Haug, AS 2116