Re: [v6ops] new draft: draft-vyncke-v6ops-ipv6-only-thin-clients

[Mark ZZZ Smith <[e-mail]>]

Hi,
Some thoughts/comments:


Regarding WoL, at least one of my Wifi NICs supports it, so it isn't exclusive to wired links. I don't know much about it, I've discovered it because I've wanted to save device power and therefore switch it off. According to some Internet searching it is more generally known as "Wake on Wireless LAN" or "WoWLAN".

"1.3.  Mitigation"

"For example, to reach all nodes in 2001:db8::/64, let's
   configure a static Neighbor Cache entry for 2001:db8::cafe:c0:ffee as   ff-ff-ff-ff-ff-ff."
I think it would be better to use the IPv6 link-layer "all nodes" multicast address of 33:33:00:00:00:01 for this. Ideally, in an IPv6 only network, NICs could drop link-layer broadcasts and perform an amount of multicast address filtering.
...

"2.  opening a door to a denial of service attack: a remote hostile       party could keep sending packets this is specific unicast address       forcing all hosts to stay awake, hence wasting electrical energy.       As this address is a unicast address which does not belong to any       physical host on the layer-2 domain, then all nodes will silently       discard this packet at the layer-3."
This reads to me as though it is being seen as an IPv6 specific threat, where as I'd consider it to also be a threat in an IPv4 network. If it is not seen as an IPv4 threat because of RFC1918 addresses, then I think the equivalent mitigation for IPv6 would be to limit the ability to wake devices by only allowing/using ULA addresses for WoL magic destinations (i.e., devices would still have global addresses, but a global address would not be a magic WoL address.)
Regards,Mark.