Subject: Re: [dhcwg] MAC Address Tracking via DHCP6

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Fri, 1 Feb 2013 14:56:03 +0000

Hi Maglione, 

Thanks for your review and a good question.

draft-ietf-dhc-addr-registration introduces a new IPv6 Neighbor Discovery
option and a
   new DHCPv6 option to propagate the address registration information
from the hosts to the network.  It requires the changes on the host.

draft-asati-dhc-ipv6-autoconfig-address-tracking, on the other hand,
requires no changes to IPv6 Neighbor Discovery and no changes to the
hosts. It introduces changes in DHCPv6 specific to the last hop router and
the DHCP server, thereby keeping the changes within the network (and DHCP
server).

Cheers,
Rajiv

-----Original Message-----
From: Maglione Roberta <[email-masked]>
Date: Friday, February 1, 2013 3:26 AM
To: Rajiv Asati <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, Philipp Kern <[email-masked]>,
Brian Hamacher <[email-masked]>
Subject: RE: MAC Address Tracking via DHCP6

>Hello Rajiv,
> is there any relation between your draft and
>draft-ietf-dhc-addr-registration-00?
>
>Thanks
>Regards,
>Roberta
>
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Rajiv Asati (rajiva)
>Sent: Thursday, January 31, 2013 6:27 PM
>To: Philipp Kern; Brian Hamacher
>Cc: [email-masked]
>Subject: Re: MAC Address Tracking via DHCP6
>
>
>There is a better way out to track the IPv6 addresses used by the hosts
>(via SLAAC or static) -
>
>http://tools.ietf.org/html/draft-asati-dhc-ipv6-autoconfig-address-trackin
>g
>
>Cheers,
>Rajiv
>
>-----Original Message-----
>From: Philipp Kern <[email-masked]>
>Organization: The Debian Project (http://www.debian.org)
>Date: Wednesday, December 12, 2012 10:37 AM
>To: Brian Hamacher <[email-masked]>
>Cc: "[email-masked]" <[email-masked]>
>Subject: Re: MAC Address Tracking
>
>>On Tue, Dec 11, 2012 at 04:04:14PM -0600, Brian Hamacher wrote:
>>> I am looking for a good way to track my users MAC Addresses.  I have a
>>> test DHCPv6 server up and running ISC 4.1.1-P1.  When I look through my
>>> DHCP logs as well as my leases file I do not see the client MAC Address
>>> anywhere.  Do I need to enable an option to allow this to be logged?  I
>>> am looking to figure out how I can track what user had what IP Address
>>> at any given time.  The MAC Address is traditionally how I have done
>>> this.
>>
>>One way would be to poll your routers' ND tables (like fetching ARP
>>tables
>>in IPv4). As soon as you use relaying you most certainly won't get a
>>useable MAC address from your client, even though it might be possible in
>>the same network segment. (The MAC address is not copied from the wire
>>into the new relayed packet sent by the router to your server.)
>>
>>DHCPv6 uses the so-called client identifier extensively and not the MAC
>>address anymore. So you cannot do any static assignment based on MAC
>>addresses.
>>
>>Kind regards
>>Philipp Kern
>
>--------------------------------------------------------------------
>IETF IPv6 working group mailing list
>[email-masked]
>Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>--------------------------------------------------------------------
>
>Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle
>persone indicate. La diffusione, copia o qualsiasi altra azione derivante
>dalla conoscenza di queste informazioni sono rigorosamente vietate.
>Qualora abbiate ricevuto questo documento per errore siete cortesemente
>pregati di darne immediata comunicazione al mittente e di provvedere alla
>sua distruzione, Grazie.
>
>This e-mail and any attachments is confidential and may contain
>privileged information intended for the addressee(s) only. Dissemination,
>copying, printing or use by anybody else is unauthorised. If you are not
>the intended recipient, please delete this message and any attachments
>and advise the sender by return e-mail, Thanks.
>

---

From: Chuck Anderson <[email-masked]>
Date: Fri, 1 Feb 2013 10:42:26 -0500

There is also draft-ietf-dhc-dhcpv6-client-link-layer-addr-opt-04
which handles the case for DHCPv6 clients.  That also requires no
changes to clients--only the DHCPv6 Relay Agent.

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Fri, 1 Feb 2013 15:47:48 +0000

Hi Chuck,

Yah, but draft-ietf-dhc-dhcpv6-client-link-layer-addr-opt is for DHCPv6
clients, as you rightly pointed out, and not for SLAAC/static hosts.

Cheers,
Rajiv

-----Original Message-----
From: Chuck Anderson <[email-masked]>
Date: Friday, February 1, 2013 10:42 AM
To: Rajiv Asati <[email-masked]>
Cc: Maglione Roberta <[email-masked]>, "[email-masked]"
<[email-masked]>, Brian Hamacher <[email-masked]>,
"[email-masked]" <[email-masked]>, Philipp Kern <[email-masked]>
Subject: Re: [dhcwg] MAC Address Tracking via DHCP6

---

From: Ted Lemon <[email-masked]>
Date: Fri, 1 Feb 2013 15:49:03 +0000

> changes to clients--only the DHCPv6 Relay Agent.

This document doesn't apply to SLAAC or CGA addresses, though—just stateful addresses acquired through DHCPv6.   Admittedly, we could also snoop DHCPINFORM traffic, but there's no guarantee that all devices on the network will do a DHCPINFORM, even if the O bit is set.

---

From: Tomek Mrugalski <[email-masked]>
Date: Fri, 01 Feb 2013 16:54:31 +0100

On 01.02.2013 16:49, Ted Lemon wrote:
> This document doesn't apply to SLAAC or CGA addresses, though—just
> stateful addresses acquired through DHCPv6.   Admittedly, we could
> also snoop DHCPINFORM traffic, but there's no guarantee that all
> devices on the network will do a DHCPINFORM, even if the O bit is
> set.
That's INFORMATION-REQUEST, right? Or do we talk here about some not
obvious matching strategy between v4 and v6? And I think there's no O
bit for v4...

Tomek

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Fri, 1 Feb 2013 15:57:38 +0000

I agree, Ted. 

-----Original Message-----
From: Ted Lemon <[email-masked]>
Date: Friday, February 1, 2013 10:49 AM
To: Chuck Anderson <[email-masked]>
Cc: Rajiv Asati <[email-masked]>, "[email-masked]" <[email-masked]>,
Brian Hamacher <[email-masked]>, Philipp Kern <[email-masked]>,
"[email-masked]" <[email-masked]>
Subject: Re: [dhcwg] MAC Address Tracking via DHCP6

>This document doesn't apply to SLAAC or CGA addresses, though‹just
>stateful addresses acquired through DHCPv6.   Admittedly, we could also
>snoop DHCPINFORM traffic, but there's no guarantee that all devices on
>the network will do a DHCPINFORM, even if the O bit is set.
>

---

From: Ted Lemon <[email-masked]>
Date: Fri, 1 Feb 2013 16:18:59 +0000

> obvious matching strategy between v4 and v6? And I think there's no O

You can just start calling me gramps and get it over with, Tomek.   :)

Yes, you are quite correct—I meant Information Request, not DHCPINFORM.

---

From: Tim Chown <[email-masked]>
Date: Fri, 1 Feb 2013 16:50:52 +0000

> clients, as you rightly pointed out, and not for SLAAC/static hosts.

You can also of course just use tools that harvest data from network/switch/router devices, and build the info from that. There's a number of open source options in that space, from bespoke tools for address tracking through to full-on monitoring platforms. Then you don't need changes in hosts or routers.

Regardless, I hope draft-ietf-dhc-dhcpv6-client-link-layer-addr-opt progresses.

Tim