Subject: Re: [Int-area] xping and IPv6 Node Information Queries (????)

From: Ron Bonica <[email-masked]>
Date: Tue, 28 Mar 2017 23:04:26 +0000

Hi Jinmei,

Nominally, XPING only returns the following information:

- Interface status (UP/DOWN/Does not exist)
- Protocols running on the interface (IPv4, IPv6)

Some additional information may be gleaned. We see this as a security issue and present mitigations. Please see the Security Considerations section.

                                                                 Ron

> 
> Message: 3
> Date: Tue, 28 Mar 2017 11:39:53 -0700
> From: ???? <[email-masked]>
> To: Internet Area <[email-masked]>
> Subject: [Int-area] xping and IPv6 Node Information Queries
> Message-ID:
> 	<CAJE_bqf2=qxLVx-
> YKwbjA98A0FSmuZSDdx4fAn=[email-masked]>
> Content-Type: text/plain; charset=UTF-8
> 
> The idea of xping reminded me of IPv6 Node Information Queries
> (RFC4620).  In my understanding operators hated it because it was
> deemed to disclose too much information, and the feature is generally
> disabled by default if implemented.  Maybe the xping draft refers to
> it and explains how these two are different (I've not read the entire
> text of xping yet - sorry).
> 
> --
> JINMEI, Tatuya
> 
> 
>

---

From: 神明達哉 <[email-masked]>
Date: Tue, 28 Mar 2017 16:22:54 -0700

At Tue, 28 Mar 2017 23:04:26 +0000,
Ron Bonica <[email-masked]> wrote:

> Some additional information may be gleaned. We see this as a
> security issue and present mitigations. Please see the Security
> Considerations section.

It looks good to me.  I didn't intend to say xping is a bad idea just
like NIQ isn't deployed very well, but just wanted to point out that
both share some similar considerations.  And so this is a suggestion
for a future version of this draft:

> > Maybe the xping draft refers to
> > it and explains how these two are different.

--
JINMEI, Tatuya