Re: [v6ops] SLAAC security concerns

Hi Pascal,
I was in business for long time. I am not much scared of bad vendor implementation of multicast or not implemented multicast at all.

Your concern that not every technology is good for multicast is right: WiFi (most popular type of connection our times) is not friendly to multicast whatever vendor would do about it.
Your point is very valid, but I do not want revolution in SLAAC. I want evolution – minimal number of changes to patch only biggest holes. Revolution would not be accepted by the market.
I agree that final picture is not ideal.

PS: If people would like revolution – you have the good proposal what to do. Let we see how much would be acceptance after additional 10 years.
Eduard
From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of Pascal Thubert (pthubert)
Sent: 4 августа 2020 г. 23:42
To: Ted Lemon <mellon@fugue.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>; v6ops list <v6ops@ietf.org>; 6man <ipv6@ietf.org>; Gert Doering <gert@space.net>
Subject: Re: [v6ops] SLAAC security concerns

Talking about multicast might be misleading. Has anyone deployed L2 multicast? IEEE people told me they designed one and that after some hiccups it was made to work but not much implemented and deployed.

Even then this is pushing the scalability problem one layer down not solving it, like almost as many groups as there are addresses so what’s the point?

Else for all I know we are mostly broadcasting any DAD and lookup over the whole L2, causing storms and wasting the wireless bandwidth. This is also a major pain point for the deployment of large multi site fabrics.
Disclaimer: I have not seen IGMP snooping successfully turned on for link scope multicast; unclear if and how that can help or if as hinted in this thread it should be turned off. I’d be interested in return from experience there :)

Keep safe,

Pascal

Le 4 août 2020 à 22:17, Ted Lemon <mellon@fugue.com<mailto:mellon@fugue.com>> a écrit :
 On Aug 4, 2020, at 3:44 PM, Gert Doering <gert@space.net<mailto:gert@space.net>> wrote:
There is too many broken switch vendors out there that show again and
again that "implementing multicast is hard", breaking IPv6 ND in the
process.

Why don’t you return that switch for a refund?

(I’ve never run into a switch that had trouble with IPv6 multicast, but admittedly I only have four different switches in my house, so that’s not a very big sample.)

_______________________________________________
v6ops mailing list
v6ops@ietf.org<mailto:v6ops@ietf.org>
https://www.ietf.org/mailman/listinfo/v6ops