Re: [v6ops] Fwd: Fwd: I-D Action: draft-halpern-6man-nddos-mitigation-00.txt

[Philip Homburg <[e-mail]>]

(Do we want this discussion in v6ops if the draft belongs to 6man?)

>So then indeed there is a trade off to be made of how noisy you find it 
>acceptable for ND to be by default versus overall reliability.
>
>Given that 6LoWPAN found even the current specification of ND too 
>chatty, and went ahead and developed their own solution, it could be 
>argued that the design goal of low chattiness should be de-weighted for 
>vanilla ND, and we accept that there'll be two ND implementations with 
>different design goals.
>
>On the other hand, multicast is an expensive operation. The days of LANs 
>being passive buses are long gone, and multicast actually has to be 
>emulated in silicon. Any increase in chattiness will likely impose an 
>upper limit on the number of nodes per link, that is probably much lower 
>than the limit with today's ND.

One question that needs to be answered is whether we want to completely replace
ND or augment it to just deal with an ND attack.

My preference is to just survive an attack. 

The advantage of the multicast option is that it doesn't require any protocol
changes. The disadvantage is that it will never work on networks where
multicast is very expensive (for example wifi).

On other networks, for example a wired network in a datacenter, MLD snooping
may even reduce the impact on the actual network to almost zero. Of course that
does require routers that can generate NS messages at wire speed and switches
that can do multicast filtering/forwarding also at wire speed.

Going beyond that, a 'please register option' in an RS message can be sent
always by a router to ensure that the router always has a complete list
of neighbors or just when the router is under attack.

Doing it always makes ND more chatty but may simplify router design. And also
weeds out bad hosts. 

Doing it only when under attack makes to option more error prone (because it is
not used until it is really needed) but doesn't cause any load on the network
during normal operation.

>It also loses the solution to the 
>half-open pipe problem, which means ND is no longer a reliable 
>indication of two-way communications being possible. How are you going 
>to do reachability confirmation if the router does not send out Neighbor 
>Solicitation messages?

There is of course some interaction with NUD, but to a large extent that is
a separate problem. A router can use any of the techniques that protect against
a DoS to find out where a node is (find its link layer address) and then use
point-to-point communication for verifying the reachability of the node.