Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Brian E Carpenter <[e-mail]>]

> On Nov 5, 2013, at 10:21 AM, Brian E Carpenter <[e-mail]> wrote:
> 
>> On 06/11/2013 02:07, Nick Hilliard wrote:
>>> On 05/11/2013 12:54, Ole Troan wrote:
>>>> why don't you filter out packets on the edge destined to your router's addresses?
>>>> instead of what's effectively breaking IPv6 service across the network.
>>> you can use infrastructure acls if they are handled carefully and don't
>>> depend on implicit "deny any any" (which has special handling for the
>>> "platform ipv6 acl fragment hardware").  But in order to implement this you
>>> need to protect every single link network connected to your PFC3s.  If your
>>> addressing plan is designed with this in mind, it's feasible.  If you have
>>> a very large network or if you've not handled your link address assignments
>>> very carefully, it's often not practical because it means dynamically
>>> maintaining huge access lists on every single device on the network.

>> I think Homer Simpson has a word for this situation.
>>
>> We *really* aren't going to deprecate fragmentation because of one
>> model of broken kit, are we?


On 06/11/2013 04:31, joel jaeggli wrote:

> Do you think there’s one model of broken kit?

Only one has been reported here. Of course I doubt if it's the only one
but it is very widely deployed.

On 06/11/2013 04:31, Jared Mauch wrote:

> I think the challenge here is that Cisco doesn't care to fix the problem
> inherent in their software/hardware integration issue here.  There is no
> structural correction of the defects in the software and nobody there takes
> ownership to correct it.
> 
> I've sadly seen this play out time and time again without anyone fixing basic
> infrastructure items that need correction.  They're unable to as it impacts
> too many sub-platforms/internal consumers of the code that don't see the value
> as it's not adding revenue.
> 
> Many of these headers (eg: hop-by-hop) are comparable to IPv4 features that
> are ignored or dropped by firewalls and routers (Eg: source-route, ecn, etc).
> 
> Without an explicit standard that says things MUST be supported that we can
> cite in RFP/RFI and broad coalition of purchasers it's difficult or impossible
> to change things.  Places like Cisco are too big to steer and correct the
> bad behavior.  I would love to be proven wrong, but years of experience tell
> me it's not going to get better.

I don't think there's any doubt whatever that fragmentation is a mandatory
part of the IPv6 standard. For the rest of the extension headers, the
requirement is in the RFC Editor queue and the new IANA registry
is already in place at
http://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml#extension-header

   Brian