Subject: [bmwg] Draft Minutes for IETF-88

From: Sarah Banks <[email-masked]>
Date: Tue, 12 Nov 2013 20:39:48 +0000

Hello BMWG,
	The first draft of our meeting minutes from IETF-88 in Vancouver is available here:
	http://www.ietf.org/proceedings/88/minutes/minutes-88-bmwg

	Please direct editorial/blunder comments to me directly, and non editorial comments to the list. Can we get a round of applause for Bill Cerveny and Jacob Rapp for their extensive note taking of our meeting?And thanks to everyone who stayed late Friday - we had a well attended in-room session despite the oddity of getting a Friday slot.

Kind regards,
Al & Sarah

---

From: Nalini Elkins <[email-masked]>
Date: Thu, 14 Nov 2013 05:50:34 -0800 (PST)

Bill,

As I commented at the BMWG meeting, IMHO a few things would be quite valuable to benchmark for IPv6.  I do not know if these are in scope of the charter.  We can certainly discuss further, if desired.

1.  The impact of extension headers on performance
     There has been quite a bit of discussion in v6ops and 6man about "long" extension headers and ASIC size.  That is, if the header gets too big, then it is routed slowly.   I, for one, would like to see some kind of formal discussion and benchmarking of this.

2.  Router advertisements:
     Much "bad" stuff can be done with Router Advertisements.   See UTube video: http://www.youtube.com/watch?v=TfsfNWHCKK0
     I believe he got this from : https://www.thc.org/thc-ipv6/  which also has:
- parasite6: icmp neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same as ARP mitm (and parasite) - alive6: an effective alive scanng, which will detect all systems listening to this address - dnsdict6: parallized dns ipv6 dictionary bruteforcer - fake_router6: announce yourself as a router on the network, with the highest priority - redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever icmp6 redirect spoofer - toobig6: mtu decreaser with the same intelligence as redir6 - detect-new-ip6: detect new ip6 devices which join the network, you can run a script to automatically scan these systems etc. - dos-new-ip6: detect new ip6 devices and tell them that their chosen IP collides on the network (DOS). - trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN - flood_router6: flood a target with random router advertisements - flood_advertise6: flood a target with random neighbor
 advertisements - exploit6: known ipv6 vulnerabilities to test against a target - denial6: a collection of denial-of-service tests againsts a target - fuzz_ip6: fuzzer for ipv6 - implementation6: performs various implementation checks on ipv6 - implementation6d: listen daemon for implementation6 to check behind a fw - fake_mld6: announce yourself in a multicast group of your choice on the net - fake_mld26: same but for MLDv2 - fake_mldrouter6: fake MLD router messages - fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication - fake_advertiser6: announce yourself on the network - smurf6: local smurfer - rsmurf6: remote smurfer, known to work only against linux at the moment - sendpees6: a tool by willdamn(ad)gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff ;-) to keep the CPU busy. nice. - thcping6: sends a hand crafted ping6 packet

Thanks,

Nalini Elkins
Inside Products, Inc.
(831) 659-8360
www.insidethestack.com

---

From: Bill Cerveny <[email-masked]>
Date: Mon, 18 Nov 2013 07:33:43 -0500

Hi Nalini,

See comments below:

>      There has been quite a bit of discussion in v6ops and 6man about "long" extension headers and ASIC size.  That is, if the header gets too big, then it is routed slowly.   I, for one, would lik…

See http://tools.ietf.org/html/rfc5180#section-5.3, "IPv6 Benchmarking Methodology", section "Traffic with Extension Headers". There may be value in a more in-depth discussion and benchmarking of extension headers and its impact on routers / intermediate nodes.

>      I believe he got this from : https://www.thc.org/thc-ipv6/  which also has:

This was an interesting attack. I had replicated the behavior described in the YouTube video with Windows 7 and Windows 8 in VMs using flood_router6 in Nov. 2012. Sam Bowne had done a bit of research on this issue, including characterizing the behavior on multiple systems as well as confirming that Microsoft had mostly fixed the problem with patches in 2013.

A distinction with the flood_router6 Windows attack is that it didn't attack routers (intermediate nodes), as far as I know, and the attack could "only" be launched from the same "broadcast domain."

Bill
>         - parasite6: icmp neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same
>  as ARP mitm (and parasite)
> 	- alive6: an effective alive scanng, which will detect all systems listening to this address
> 	- dnsdict6: parallized dns ipv6 dictionary bruteforcer
> 	- fake_router6: announce yourself as a router on the network, with the highest priority
> 	- redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever icmp6 redirect spoofer
> 	- toobig6: mtu decreaser with the same intelligence as redir6
> 	- detect-new-ip6: detect new ip6 devices which join the network, you can run a script to automatically scan these systems etc.
> 	- dos-new-ip6: detect new ip6 devices and tell them that their chosen IP collides on the network (DOS).
> 	- trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN
> 	- flood_router6: flood a target with random router advertisements
> 	- flood_advertise6: flood a target with random neighbor advertisements
> 	- exploit6: known ipv6 vulnerabilities to test against a target
> 	- denial6: a collection of denial-of-service tests againsts a target
> 	- fuzz_ip6: fuzzer for ipv6
> 	- implementation6: performs various implementation checks on ipv6
> 	- implementation6d: listen daemon for implementation6 to check behind a fw
> 	- fake_mld6: announce yourself in a multicast group of your choice on the net
> 	- fake_mld26: same but for MLDv2
> 	- fake_mldrouter6: fake MLD router messages
> 	- fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication
> 	- fake_advertiser6: announce yourself on the network
> 	- smurf6: local smurfer
> 	- rsmurf6: remote smurfer, known to work only against linux at the moment
> 	- sendpees6: a tool by willdamn(ad)gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff ;-) to keep the CPU busy. nice.
>         - thcping6: sends a hand crafted ping6 packet
>  
>  
> Thanks,
> 
> Nalini Elkins
> Inside Products, Inc.
> (831) 659-8360
> www.insidethestack.com
> 
>  
> _______________________________________________
> bmwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bmwg

---

From: Nalini Elkins <[email-masked]>
Date: Mon, 18 Nov 2013 06:55:39 -0800 (PST)

Bill,

Is BMWG only concerned with intermediate nodes?

Bill,

Bill

---

From: Bill Cerveny <[email-masked]>
Date: Mon, 18 Nov 2013 10:42:36 -0500

Hi Nalini,

I'm not the right person to answer that question from the perspective of the BMWG. However, benchmarking nodes other than intermediate nodes is outside of the scope for the the NDP benchmarking draft, as it is written now.

In regards to the RA-based attacks based on the THC-IPv6 flood_router6 attacks, I perceived this as mostly an operating system security vulnerability, which has been fixed.

Bill

---

From: Nalini Elkins <[email-masked]>
Date: Mon, 18 Nov 2013 08:48:56 -0800 (PST)

Bill,

> I'm not the right person to answer that question from the perspective of the BMWG. However, benchmarking nodes other than intermediate nodes is outside of the scope for the the NDP benchmarking dra…

Sure.

> In regards to the RA-based attacks based on the THC-IPv6 flood_router6 attacks, I perceived this as mostly an operating system security vulnerability, which has been fixed.

Well, I would say that "fixed" is a matter of opinion.   Are you saying that "fixed" means that the operating system does not lock up tighter than a drum?  The routing table in the OS is very messed up.  I will direct a question to Microsoft on this as well.

Bill

Bill,

---

From: joel jaeggli <[email-masked]>
Date: Tue, 19 Nov 2013 23:13:33 -0800

On 11/18/13, 4:33 AM, Bill Cerveny wrote:
> Hi Nalini,
> 
> See comments below:
> 
> On Nov 14, 2013, at 8:50 AM, Nalini Elkins
> <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>> Bill,
>>
>> As I commented at the BMWG meeting, IMHO a few things would be quite
>> valuable to benchmark for IPv6.  I do not know if these are in scope
>> of the charter.  We can certainly discuss further, if desired.
>>
>>      There has been quite a bit of discussion in v6ops and 6man about
>> "long" extension headers and ASIC size.  That is, if the header gets
>> too big, then it is routed slowly.   I, for one, would like to see
>> some kind of formal discussion and benchmarking of this.
> 
> See http://tools.ietf.org/html/rfc5180#section-5.3, "IPv6 Benchmarking
> Methodology", section "Traffic with Extension Headers". There may be
> value in a more in-depth discussion and benchmarking of extension
> headers and its impact on routers / intermediate nodes.

It's a probably mistaken generalization  to assume there's a recourse to
a "slow path". In many platforms it's perfectly reasonable to expect
fast-path or no-path.

>>      Much "bad" stuff can be done with Router Advertisements.   See
>> UTube video: http://www.youtube.com/watch?v=TfsfNWHCKK0
> This was an interesting attack. I had replicated the behavior described
> in the YouTube video with Windows 7 and Windows 8 in VMs using
> flood_router6 in Nov. 2012. Sam Bowne had done a bit of research on this
> issue, including characterizing the behavior on multiple systems as well
> as confirming that Microsoft had mostly fixed the problem with patches
> in 2013.
> 
> A distinction with the flood_router6 Windows attack is that it didn't
> attack routers (intermediate nodes), as far as I know, and the attack
> could "only" be launched from the same "broadcast domain."
> 
> Bill
>> 	- sendpees6: a tool by willdamn(ad)gmail.com <http://gmail.com>, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff ;-) to keep the CPU busy. nice.
>> www.insidethestack.com <http://www.insidethestack.com>
>>
>>  
>> [email-masked] <mailto:[email-masked]>