[v6ops] Re: Address accountability (was: Re: Re: New WGLC for draft-ietf-v6ops-nd-considerations)

[David Farmer <[e-mail]>]

On Tue, Sep 17, 2024 at 03:38 Lorenzo Colitti <lorenzo=
[e-mail]> wrote:

> On Tue, Sep 17, 2024 at 5:25 PM Tim Chown <Tim.Chown=
> [e-mail]> wrote:
>
>> The issue I hear from universities wanting to deploy IPv6 is “how do I
>> have the accountability I have via DHCPv4?”. They’re worried about tracking
>> dual-stack hosts with IPv6 privacy addresses.
>>
>>
>>
>> Maybe there are commercial tools that help with this now. While I was
>> manging a campus deployment I used an open source package that polled
>> switches and routers and created a db of physical ports/MACs/IPs, and on
>> WiFi we had 802.1X thanks to eduroam being used.
>>
> There's also draft-ietf-dhc-addr-notification
> <https://datatracker.ietf.org/doc/draft-ietf-dhc-addr-notification/>,
> which is in the RFC editor queue and should hopefully be published shortly.
> That's an dopt-in mechanism, but that's enough in some use cases (e.g.,
> when the enterprise controls the devices that can connect to the network).
>

The reality is DHCPv4 by itself was never enough, you either needed to add
something like IP source guard to prevent statically configured host or
malicious hosts spoofing addresses, or you needed to snoop ARP and MAC
forwarding tables to build IP, MAC, and switch port bindings, for all hosts
including statically configured host, added to the DHCP information. Then
frequently MAC address registration was added to provide a user name
binding to all of that. 802.1x has replaced MAC registration from providing
us a user binding these days.

Because, the available IPv4 pools were limited, devices like laptops that
moved around you had to track multiple address per day. Which isn't that
different from IPv6 temporary addresses with the recommendation to change
addresses daily or with each network rebinding.

To track all that for IPv4 or IPv6, times 10 of thousands of hosts, you
need a pretty heavy duty database. Also, you need to poll thousands of
switches, with hundreds of router interfaces, within a few seconds if you
want data accurate enough for forensic analysis. And you will want to keep
all that data for at least 30 days if not 60 or 90 days. We would also keep
the last know binding for a MAC address for up a year or two, to know the
last time we saw a MAC address.

We don't have to have DHCP, v4 or v6, but it still provides additional
useful information. Furthermore, most of the other data sources we collect
are polled, DHCP had the advantage of being somewhat of a push data source.
Also having multiple sources of the MAC to IP binding allows for cross
validation of this critical piece of data in most cases.

So even though we don't need draft-ietf-dhc-addr-notification, it will
provide an IPv6 push data source and cross-validation for the IPv6 to MAC
address binding data we already collect from ND tables in the routers.

The IPv4 cross-validation failures we find are most of the time from bugs
in our code or in the routers or switches. But once in a while, it points
to malicious host activities. The point being, you want to collect data
from multiple and even overlapping source to help detect malicious
activity, it not just about accountability for regular activity.

Thanks

>