Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP items fornew charter

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 12 May 2005 18:47:13 -0400

> DNS operators have evolved a set of procedures to use to 
 > counter the threat.
 > I believe something similar is needed with HMIP.

=> Is this documented somewhere? If not, what are these procedures?
DHCP had a site-local address as well, I don't know if they removed it.

Hesham

 > 
 > W.r.t. DHCPv6, from Section 3 of RFC 3315:
 > 
 >    Two advantages of IPv6 are that support
 >    for multicast is required and nodes can create link-local 
 > addresses
 >    during initialization.  The availability of these 
 > features means that
 >    a client can use its link-local address and a well-known multicast
 >    address to discover and communicate with DHCP servers or 
 > relay agents
 >    on its link.
 > 
 > This means that the scope of a DoS attack on a DHCP server 
 > can be limited to
 > a single link, making it easier to find and disable the attacker.
 > 
 > With HMIP, a MAP could be located at some distance from the 
 > links it is
 > covering (in fact, for good location privacy, it will have 
 > to be), requiring
 > that the MAP address be either globally routable or a 
 > Hinden-Haberman (don't
 > know what they're calling them these days) limited routable 
 > address. In
 > either case, the topological scope from which a DoS attack 
 > can be mounted is
 > considerably larger, making it difficult to impossible to 
 > quickly find and
 > disable the attacker.
 > 
 >             jak
 > 
 > 
 > 
 > 

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Thu, 12 May 2005 16:05:58 -0700

jak>> Suggest talking to someone in the DNS community. I don't think they've
written it down, though there may have been a NANOG presentation on it, or
something like that.

            jak