Subject: [Mip6] RE: Mip6 Digest, Vol 7, Issue 23

From: 박은영 <[email-masked]>
Date: Fri, 19 Nov 2004 09:35:42 +0900

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, November 19, 2004 9:35 AM
To: [email-masked]
Subject: Mip6 Digest, Vol 7, Issue 23

Send Mip6 mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www1.ietf.org/mailman/listinfo/mip6
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Mip6 digest..."

Today's Topics:

   1. Re: New I-D: Security Issues in Dynamic Home Agent
      AddressDiscovery (Alexandru Petrescu)
   2. Re: New I-D: Security Issues in Dynamic Home	Agent
      AddressDiscovery (Alexandru Petrescu)
   3. Re: New I-D: Security Issues in Dynamic Home Agent
      AddressDiscovery (Alexandru Petrescu)
   4. Re: New I-D: Security Issues in Dynamic Home	Agent
      AddressDiscovery (Alexandru Petrescu)
   5. Re: New I-D: Security Issues in Dynamic Home	Agent
      AddressDiscovery (James Kempf)
   6. RE: Mip6 Digest, Vol 7, Issue 21 (???)

----------------------------------------------------------------------

Message: 1
Date: Thu, 18 Nov 2004 22:50:23 +0100
From: Alexandru Petrescu <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
	AddressDiscovery
To: James Kempf <[email-masked]>
Cc: [email-masked], Henrik Petander <[email-masked]>,
	[email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii; format=flowed

James Kempf wrote:
> Alex,
> Many ISPs block ICMP

James, as far as I can remember, one cellular ISP doesn't block ICMPv4
although NAT is in place and there is at least one other cellular ISP
that does not do NAT.  I will not dare however to make definitive
statements about ISPs, cellular or otherwise.

> below. The basic architectural thinking that went into DHAAD seems to
>  have been that home agent discovery on the Internet is analgous to 
> router discovery on the local link. I believe this thinking is not 
> accurate, as services are discovered in the Internet in ways that are
>  much different than locally in enterprise networks.

If this thinking is not accurate, then MPD qualifies to same thinking:
MPD is devised after router discovery on the local link too.

> Personally, I think the WG will come up with a couple (but probably 
> not just one)

It's good when there is choice.

> techniques that are a better fit with the way wireless ISPs currently
>  operate, and therefore are more deployable. We've got a some good 
> drafts in this area, and the technical discussion seems to be 
> progressing along well.

Again, I'll have to look at these.

Alex

------------------------------

Message: 2
Date: Thu, 18 Nov 2004 23:02:05 +0100
From: Alexandru Petrescu <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home	Agent
	AddressDiscovery
To: James Kempf <[email-masked]>
Cc: [email-masked], Henrik Petander <[email-masked]>,
	[email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii; format=flowed

Does this somehow mean that probably the DHAAD part of the NEMO BAsic 
Support suddenly becomes superfluous?  This should be known...

Alex

James Kempf wrote:
> Alex,
> 
> Many ISPs block ICMP except on the local link, since it can be used for
ping
> attacks and also tends to cause increased traffic from backscatter during
> worm scanning. Also, as the draft points out, there are security problems
> with DHAAD, in addition to the issues with anycast that you point out
below.
> The basic architectural thinking that went into DHAAD seems to have been
> that home agent discovery on the Internet is analgous to router discovery
on
> the local link. I believe this thinking is not accurate, as services are
> discovered in the Internet in ways that are much different than locally in
> enterprise networks.
> 
> Personally, I think the WG will come up with a couple (but probably not
just
> one) techniques that are a better fit with the way wireless ISPs currently
> operate, and therefore are more deployable. We've got a some good drafts
in
> this area, and the technical discussion seems to be progressing along
well.
> 
>             jak
> 
> 
> ----- Original Message ----- 
> From: "Alexandru Petrescu" <[email-masked]>
> To: "James Kempf" <[email-masked]>
> Cc: "Henrik Petander" <[email-masked]>;
<[email-masked]>;
> <[email-masked]>; <[email-masked]>
> Sent: Thursday, November 18, 2004 12:42 PM
> Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
> AddressDiscovery
> 
> 
> 
>>James Kempf wrote:
>>[angels on a pin's top...]
>>
>>>Anyway, I think we are mostly arguing about how many angels can dance
>>> on the head of a pin, since DHAAD does not seem to be a likely
>>>candidate for deployment at this point.
>>
>>Do you know why is DHAAD not a candidate for deployment at this point?
>>Is it because it is insecure?  Should we secure it such as to be a
>>candidate for deployment?  Is it impossible to secure because of the
>>difficulties IPsec/anycast?  Maybe it is not needed to use IPsec/anycast
>>in order to have it a little more secure, a little more deployable.  Or
>>has DHAAD been simply overlooked by people in need of urgent deployment?
>>
>>
>>>The current bootstrapping work in mip6  is intended to replace DHAAD
>>>and HoAD with something that the WG deems is more deployable.
>>
>>I don't think there is anything simpler and thus more deployable than:
>>discover HA - get MPD - configure HoA.  The keys?  Pre-shared.  I still
>>have to figure out why people don't like them pre-shared here.
>>
>>I bet that other methods to do HA Discovery and HoA configuration will
>>render not only DHAAD useless but also MPD.  And, being new methods,
>>they'll surely have their own new security risks.
>>
>>That said, it still makes sense to me to recognize in a written document
>>that a certain procedure (DHAAD) in a Standards Track RFC is insecure.
>>Somehow for completeness.  Somehow as advice "don't do so".  Whether it
>>is worth the effort to secure it or not - is another question.  A
>>question which could be raised to the WG.
>>
>>
>>>Alex's point, which ran towards "the difference is that the HA is
>>>more like a router rather than a server" was more what I was looking
>>>for. I don't see this point as necessarily being decisively
>>>differentating, however, since it addresses the quality of the impact
>>> for the attack rather than the mechanisms attackers use and
>>>therefore the possible effective countermeasures, which is what I was
>>>looking for. Based on impact, one could argue that an attack on a
>>>medical server used by people daily with some chronic disease that
>>>denied them access necessary for their health would have even more
>>>impact, though the mechanism might be the same as used on cnn.com or
>>>an HA.
>>
>>This sounds logic, all layer-3 mechanisms used for attack being equal
>>the impact on layer-7 is also equal (be it health data or video
>>entertainment).  I could only argue that impact is also a sort of
>>assessment of the size of the risk, and impact of a risky local DHCP is
>>obviously lower than impact of a risky Internet-wide Mobile IPv6.  I am
>>not arguing the impact of a risky HL7, a protocol for the kind of health
>>data you mention (IIRC).
>>
>>Note I still have to read the drafts you mentioned.
>>
>>Alex
>>
> 
> 
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6

------------------------------

Message: 3
Date: Thu, 18 Nov 2004 23:06:01 +0100
From: Alexandru Petrescu <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
	AddressDiscovery
To: [email-masked]
Cc: [email-masked], Henrik Petander <[email-masked]>,
	[email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii; format=flowed

qsun the 300th.  Thanks for your reply.  Could you please reveal your
name so I can address you, thanks.

Chairs, if I'm dancing on a pinus :-) please let me know if this effort
is out of focus here, thanks.

[email-masked] wrote:
> Yes, R-bit attack is another DoS attack scenario. Since this draft 
> only focus on security issues in MIPv6, we don't mention R-bit attack
>  scenarion in this draft. Actually, I think, in order to prevent 
> R-bit attack, we should protect both DHAAD Request and DHAAD Reply.

Yes, that's what I thought too, it's not enough to protect only the Reply.

> In my understanding, R-bit attack can be performed in two means: (let
>  me know if I am not correct.thanks) (1) Attacker spoofing DHAAD 
> Reply When attacker sniffs a mobile router sending a DHAAD 
> Request(R-bit set 1), it replies a DHAAD Reply with R-bit set 0. The 
> mobile router would register with home agent as a mobile node, so 
> that it cannot serve all mobile nodes attach to it.

YEs, but it may be not necessary for attacker to create a Reply faking
the HA Reply, it is sufficient to forward a fake Request to HA and drop
the valid Request.

> (2) Attacker spoofing DHAAD Request When attacker sniffs a mobile 
> router sending a DHAAD Request(R-bit set 1), it replicate the 
> message, change R-bit to 0 and send it to home agent. Then home agent
>  would reply mobile node with two DHAAD Reply(one R-bit set 0, and 
> the other R-bit set 1).

Actually, I was seeing a more powerful attacker that would create a
brand new fake request (R-bit 0) and discard the valid Request (R-bit
1), so only the fake Request hits the HA, so only the fake Reply hits
the MR.

> If the Reply with R-bit 1 arrives the mobile node first, then 
> everything is ok. But if the DHAAD Reply with R-bit 0 arrives first,
>  then the mobile router has two choice: (a) Discard it.

Yep, that's what the MR could do to realize there's error possible attack.

> The problem is: when the only home agent that supports mobile router 
> crashes, the mobile router cannot register with other home agent as a
> mobile node, or it takes long time to do this(the mobile router retry
> DHAAD unitl it achieves maximum attempts, then register as a mobile
> node.)

That is a possibliity, I didn't think that far.

> (b)Register as a mobile node. It cannot serve the mobile nodes attach
>  to it.
> 
> Based on above analysis, I think we should protect both DHAAD Request
>  and Reply to prevent R-bit attack.

Yes, I guess both should be protected somehow to protect against these
attacks.

Alex

------------------------------

Message: 4
Date: Thu, 18 Nov 2004 23:46:37 +0100
From: Alexandru Petrescu <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home	Agent
	AddressDiscovery
To: James Kempf <[email-masked]>
Cc: [email-masked], Henrik Petander <[email-masked]>,
	[email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii; format=flowed

James Kempf wrote:
> The MN doesn't need a cert, only the routers on the home link, 
> including the HA if it sends RAs, do. The MN uses the CPS/CPA to 
> obtain the cert chain from the router, and the public key from the 
> router's cert to validate the signature on the RA.

The attack was something like where the MN at home sends the fake RA to
HAs, so the receiving HAs on the home link needed to make sure the
content of that RA is valid such as _not_ to build fake HA lists.  So if
SEND were to help with this, would MN need a cert?

So this is like true simple SEND on a simple unique link, not across
tunnels.

>> Also, I think that using SEND to protect DHAAD's RAs also involves
>>  using CGAs as options, but it is not clear to me whether RAs are
>> an exception to this.
>> 
> 
> 
> I don't know that SEND could be used to protect DHAAD since the 
> CPS/CPA is sent over ICMP and therefore subject to problems with 
> fragmentation if send over more than one link, since certs can be 
> large.

Fragmentation is done by end nodes so more than one intermediary links
is not an issue.  The first link may be an issue, because the links
following usually have larger MTUs (unless successive HAs get in the
way, a la nested NEMO).  But there's also reassembly, hopefully.

> CGAs don't help here because the security issue is not authorization
>  to do something with an address (which is what CGAs provide) but 
> rather whether the router is authenticatable as certified by a 
> trusted root (and, additionally if deployed, whether the router is 
> authorized to route the subnet prefixes it is advertising).

Ok, I understand that.

What I was wondering was whether a MH on the home link can be recognized
as sending fake RAs with the tool SEND that may use certs or CGA, and if
yes, are both certs and CGAs needed?  Would this involve that HoA must
be a CGA.  I hope not.

> SEND might be used to protect RAs sent from the HA over the MN-HA 
> tunnel when the HA has the MN's CoA binding, but, again, provided the
>  MN already had the cert paths for the routers on the home link, due
>  to the issue with CPS/CPA fragmentation.

I don't think fragmentation on such long paths is an issue because
reassembly.

I didn't think to send DHAAD messages (Req/Rep) through the tunnel.  I
wondered whether SEND can protect when a legitimate-and-attacker MN is
at home. (legitimate: because it shares keys with HA but attacker
because it attacks another MN, attack by forcing HA to send fake DHAAD
Replies to MN).

Alex

------------------------------

Message: 5
Date: Thu, 18 Nov 2004 15:05:40 -0800
From: "James Kempf" <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home	Agent
	AddressDiscovery
To: "Alexandru Petrescu" <[email-masked]>
Cc: [email-masked], Henrik Petander <[email-masked]>,
	[email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain;	charset="iso-8859-1"

> The attack was something like where the MN at home sends the fake RA to
> HAs, so the receiving HAs on the home link needed to make sure the
> content of that RA is valid such as _not_ to build fake HA lists.  So if
> SEND were to help with this, would MN need a cert?

If the MN doesn't have a certified asymmetric key pair, it can't generate a
signature on the RA, thus the HAs would not accept the RA.

> What I was wondering was whether a MH on the home link can be recognized
> as sending fake RAs with the tool SEND that may use certs or CGA, and if
> yes, are both certs and CGAs needed?  Would this involve that HoA must
> be a CGA.  I hope not.
>

No, only certified asymmetric key pairs are needed and only on the HA. The
HAs can recognize the fake RA, as can any other node on the home link.

> I didn't think to send DHAAD messages (Req/Rep) through the tunnel.  I
> wondered whether SEND can protect when a legitimate-and-attacker MN is
> at home. (legitimate: because it shares keys with HA but attacker
> because it attacks another MN, attack by forcing HA to send fake DHAAD
> Replies to MN).
>

I suppose one could put a SEND signature on the DHAAD message using the key
pair certified by the router certificate.

            jak

------------------------------

Message: 6
Date: Fri, 19 Nov 2004 09:18:19 +0900
From: ??? <[email-masked]>
Subject: [Mip6] RE: Mip6 Digest, Vol 7, Issue 21
To: <[email-masked]>
Message-ID: <[email-masked]>
Content-Type: text/plain;	charset="ks_c_5601-1987"

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, November 19, 2004 2:23 AM
To: [email-masked]
Subject: Mip6 Digest, Vol 7, Issue 21

Send Mip6 mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www1.ietf.org/mailman/listinfo/mip6
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Mip6 digest..."

Today's Topics:

   1. Re: New I-D: Security Issues in Dynamic Home Agent Address
      Discovery (Henrik Petander)
   2. Re: New I-D: Security Issues in Dynamic Home Agent Address
      Discovery (Alexandru Petrescu)
   3. Re: New I-D: Security Issues in Dynamic Home Agent
      AddressDiscovery ([email-masked])

----------------------------------------------------------------------

Message: 1
Date: Thu, 18 Nov 2004 19:04:25 +1100
From: Henrik Petander <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
	Address	Discovery
To: Alexandru Petrescu <[email-masked]>
Cc: [email-masked], [email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Hi Alex,

Thanks for reading the security analysis of DHAAD part of the draft and 
commenting it.

Alexandru Petrescu wrote:
> [email-masked] wrote:
> 
>> Here is a new I-D, Security Issues in Dynamic Home Agent Address 
>> Discovery.
> 
> 
> In addition to the HA-DoS threat, I think (let me know if I'm wrong)
> there are two others: (1) faking the HA List by attacker MN on home link
> and (2) attacks on the R-bit of a NEMO DHAAD Reply.
> 
> For (1), DHAAD relies on building of a HA list by HAs on the home link,
> via the H-bit in their RAs.  An attacker MN (one that is at home on the
> home link where the legitimate HAs are) can send fake HAs to pretend to
> be a HA, I think.  Based on this fake RA, the legitimate HAs will build
> attacking HA lists, that contain the attacker MN as the highest priority
> HA (or pretending to support MRs while it doesn't).  The end result of
> this attack is that MN uses the attacker HA as a HA.

Yes, if home link is also an access network, then this is a very 
relevant vulnerability, since an attacker only needs to be able to send 
packets on the home link. We focused on the MN-HA part of the protocol, 
but this could be added to the draft, since building of HA list can also 
be seen to be a part of the DHAAD protocol. Alex, would you be 
interested in adding a subsection to the protocol vulnerabilities part 
about this?

If SEND is used on the home link then this vulnerability can be fixed, 
provided that the HAs only add HAs to their list RAs which are 
authenticated as coming from authorized routers.

I am not sure about the relevance of the R-bit attack, but it could 
possibly be used to attack MR more subtly han sending just an empty list 
or a list with fake addresses, which depending on the implementation 
might be more effective.

Thanks,

Henrik

------------------------------

Message: 2
Date: Thu, 18 Nov 2004 15:50:03 +0100
From: Alexandru Petrescu <[email-masked]>
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
	Address	Discovery
To: Henrik Petander <[email-masked]>
Cc: [email-masked], [email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii; format=flowed

Henrik Petander wrote:
>> For (1), DHAAD relies on building of a HA list by HAs on the home
>> link, via the H-bit in their RAs.  An attacker MN (one that is at
>> home on the home link where the legitimate HAs are) can send fake
>> HAs to pretend to be a HA, I think.  Based on this fake RA, the
>> legitimate HAs will build attacking HA lists, that contain the
>> attacker MN as the highest priority HA (or pretending to support
>> MRs while it doesn't).  The end result of this attack is that MN
>> uses the attacker HA as a HA.
> 
> 
> Yes, if home link is also an access network, then this is a very 
> relevant vulnerability, since an attacker only needs to be able to
> send packets on the home link. We focused on the MN-HA part of the
> protocol, but this could be added to the draft, since building of HA
> list can also be seen to be a part of the DHAAD protocol. Alex, would
> you be interested in adding a subsection to the protocol
> vulnerabilities part about this?

Sure, you need a paragraph, a two-three paragraphs?  How would you title it?

> If SEND is used on the home link then this vulnerability can be
> fixed, provided that the HAs only add HAs to their list RAs which are
>  authenticated as coming from authorized routers.

I went back to read SEND.  It somehow relies on routers (those who send
RAs) be leading to "Trust Anchors" i.e. use Certificates; this implies
to me that if we want to prevent MN from sending fake RAs on the home
link then MN should use certs, or at least HAs use certs before building
the HA lists.

Also, I think that using SEND to protect DHAAD's RAs also involves using
CGAs as options, but it is not clear to me whether RAs are an exception
to this.

Finally, outside SEND, the MN and the HA do share a key, and it would be
risky for HA to rely on that key when receiving RAs from MN at home.

> I am not sure about the relevance of the R-bit attack, but it could 
> possibly be used to attack MR more subtly han sending just an empty
> list or a list with fake addresses, which depending on the
> implementation might be more effective.

The attack on R-bit looks to me like an exemplification of more than
just denying HA service to a MH.  An attacker could just zero the bit
once and thus deny all service to LFNs but not to MR itself, there is no
need to fake other addresses in the DHAAD Reply or to block all packets
from HA to MR.  And yes, depends on the implementation a lot.

Alex

------------------------------

Message: 3
Date: Fri, 19 Nov 2004 02:58:52 +1100 (EST)
From: [email-masked]
Subject: Re: [Mip6] New I-D: Security Issues in Dynamic Home Agent
	AddressDiscovery
To: "Henrik Petander" <[email-masked]>
Cc: [email-masked], [email-masked],	Alexandru Petrescu
	<[email-masked]>
Message-ID:
	<[email-masked]>
Content-Type: text/plain;charset=iso-8859-1

> Hi Alex,
>
> Thanks for reading the security analysis of DHAAD part of the draft and
> commenting it.
>
> Alexandru Petrescu wrote:
>> [email-masked] wrote:
>>
>>> Here is a new I-D, Security Issues in Dynamic Home Agent Address
>>> Discovery.
>>
>>
>> In addition to the HA-DoS threat, I think (let me know if I'm wrong)
>> there are two others: (1) faking the HA List by attacker MN on home link
>> and (2) attacks on the R-bit of a NEMO DHAAD Reply.
>>
Yes, R-bit attack is another DoS attack scenario. Since this draft only
focus on security issues in MIPv6, we don't mention R-bit attack scenarion
in this draft. Actually, I think, in order to prevent R-bit attack, we
should protect both DHAAD Request and DHAAD Reply. Solution 2 in the draft
can be easily extended to protect R-bit attack.

In my understanding, R-bit attack can be performed in two means: (let me
know if I am not correct.thanks)
(1) Attacker spoofing DHAAD Reply
When attacker sniffs a mobile router sending a DHAAD Request(R-bit set 1),
it replies a DHAAD Reply with R-bit set 0. The mobile router would
register with home agent as a mobile node, so that it cannot serve all
mobile nodes attach to it.

(2) Attacker spoofing DHAAD Request
When attacker sniffs a mobile router sending a DHAAD Request(R-bit set 1),
it replicate the message, change R-bit to 0 and send it to home agent.
Then home agent would reply mobile node with two DHAAD Reply(one R-bit set
0, and the other R-bit set 1). If the Reply with R-bit 1 arrives the
mobile node first, then everything is ok. But if the DHAAD Reply with
R-bit 0 arrives first, then the mobile router has two choice: (a) Discard
it. The problem is: when the only home agent that supports mobile router
crashes, the mobile router cannot register with other home agent as a
mobile node, or it takes long time to do this(the mobile router retry
DHAAD unitl it achieves maximum attempts, then register as a mobile node.)
(b)Register as a mobile node. It cannot serve the mobile nodes attach to
it.

Based on above analysis, I think we should protect both DHAAD Request and
Reply to prevent R-bit attack. Thanks for your comments.

>> For (1), DHAAD relies on building of a HA list by HAs on the home link,
>> via the H-bit in their RAs.  An attacker MN (one that is at home on the
>> home link where the legitimate HAs are) can send fake HAs to pretend to
>> be a HA, I think.  Based on this fake RA, the legitimate HAs will build
>> attacking HA lists, that contain the attacker MN as the highest priority
>> HA (or pretending to support MRs while it doesn't).  The end result of
>> this attack is that MN uses the attacker HA as a HA.
>
> Yes, if home link is also an access network, then this is a very
> relevant vulnerability, since an attacker only needs to be able to send
> packets on the home link. We focused on the MN-HA part of the protocol,
> but this could be added to the draft, since building of HA list can also
> be seen to be a part of the DHAAD protocol. Alex, would you be
> interested in adding a subsection to the protocol vulnerabilities part
> about this?
>
> If SEND is used on the home link then this vulnerability can be fixed,
> provided that the HAs only add HAs to their list RAs which are
> authenticated as coming from authorized routers.
>
> I am not sure about the relevance of the R-bit attack, but it could
> possibly be used to attack MR more subtly han sending just an empty list
> or a list with fake addresses, which depending on the implementation
> might be more effective.
>
> Thanks,
>
> Henrik
>
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
>

------------------------------

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

End of Mip6 Digest, Vol 7, Issue 21
***********************************

------------------------------

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

End of Mip6 Digest, Vol 7, Issue 23
***********************************

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6