Subject: [78attendees] helo 6to4 users!

From: Chris Morrow <[email-masked]>
Date: Mon, 26 Jul 2010 08:55:50 -0400

pls turn off your 6to4 relay functionality... it is really unkind.

-chris

wlan0     Link encap:Ethernet  HWaddr 00:1d:e0:90:1a:cb
          inet addr:130.129.103.226  Bcast:130.129.103.255  Mask:255.255.248.0
          inet6 addr: fec0::8:21d:e0ff:fe90:1acb/64 Scope:Site
          inet6 addr: 2002:8281:7382:8:21d:e0ff:fe90:1acb/64 Scope:Global
          inet6 addr: 2001:df8:0:112:21d:e0ff:fe90:1acb/64 Scope:Global
          inet6 addr: 2001:df8:0:96:21d:e0ff:fe90:1acb/64 Scope:Global
          inet6 addr: fe80::21d:e0ff:fe90:1acb/64 Scope:Link

morrowc@tweezer:~$ whois 2002:8281:7382:8:21d:e0ff:fe90:1acb

Querying for the IPv4 endpoint 130.129.115.130 of a 6to4 IPv6 address.

---

From: Malcolm Scott <[email-masked]>
Date: Mon, 26 Jul 2010 14:18:28 +0100 (BST)

> pls turn off your 6to4 relay functionality... it is really unkind.

This seems to crop up regularly by accident on any large-enough network -- I 
think at least one early release of one (relatively recent) OS shipped with 
a 6to4 relay turned on by default...

(if anyone has details on specifically when this arises I'd love to know; 
it's something I've been attempting to get to the bottom of in one my other 
hats!)

Malcolm

-- 
Malcolm Scott
University of Cambridge Computer Laboratory

---

From: Aleksi Suhonen <[email-masked]>
Date: Tue, 27 Jul 2010 09:47:45 +0300

Hi,

> This seems to crop up regularly by accident on any large-enough network
> -- I think at least one early release of one (relatively recent) OS
> shipped with a 6to4 relay turned on by default...

> (if anyone has details on specifically when this arises I'd love to
> know; it's something I've been attempting to get to the bottom of in one
> my other hats!)

I get asked how to detect or prevent this quite often, when wearing my 
other hats too. So far I've only been able to say "set up a linux box 
with tshark configured to capture just ICMP RAs, except your real 
router's RA and then hunt for the MACs in your switch matrix" which 
usually gets a response of "urgh."

Switch vendors and AP vendors would win my heart by providing efficient 
tools to (semi-)automatically hunt for rogue DHCP (v4 and v6) and ICMPv6 
RA servers. :-)

In at least a couple of cases, rogue RAs have been a reason for a 
customer to not want to deploy IPv6. :-\

--
	Aleksi Suhonen

---

From: Malcolm Scott <[email-masked]>
Date: Tue, 27 Jul 2010 08:28:51 +0100 (BST)

At 09:47 today, Aleksi Suhonen wrote:

> I get asked how to detect or prevent this quite often, when wearing my other 
> hats too. So far I've only been able to say "set up a linux box with tshark 
> configured to capture just ICMP RAs, except your real router's RA and then 
> hunt for the MACs in your switch matrix" which usually gets a response of 
> "urgh."

Indeed, that's what I do currently.

> Switch vendors and AP vendors would win my heart by providing efficient tools 
> to (semi-)automatically hunt for rogue DHCP (v4 and v6) and ICMPv6 RA 
> servers. :-)

Tools exist on several modern switches for detecting rogue DHCPv4 servers; 
I'm hoping they'll start to do the same for v6 DHCP/RA servers soon...

> In at least a couple of cases, rogue RAs have been a reason for a customer to 
> not want to deploy IPv6. :-\

I know of one network which opted to drop _all_ IPv6 at the edge switch 
level...

Malcolm

---

From: Fred Baker <[email-masked]>
Date: Tue, 27 Jul 2010 10:02:14 +0200

On Jul 27, 2010, at 8:47 AM, Aleksi Suhonen wrote:

> Switch vendors and AP vendors would win my heart by providing efficient tools to (semi-)automatically hunt for rogue DHCP (v4 and v6) and ICMPv6 RA servers. :-)

At the risk of appearing to be advertising, you may be interested in:

http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-first_hop_security.html#wp1122933
http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard
  "IPv6 RA-Guard", Eric Levy-Abegnoli, Gunter Van de Velde, Chip
  Popoviciu, Janos Mohacsi, 15-Jun-10
https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard