Subject: [savi] Broadband Forum liaison to IETF on IPv6 security

From: Christian Vogt <[email-masked]>
Date: Fri, 6 Nov 2009 03:03:34 +0800

Group -

Attached is a liaison related to SAVI from the Broadband Forum, for  
your information and consideration.  Comments?

- Christian

Begin forwarded message:

> From: Robin Mersh <[email-masked]>
> Date: November 6, 2009 1:42:05 GMT+08:00
> To: "[email-masked]" <[email-masked]>, Christian Vogt <[email-masked] 
> >, "[email-masked]" <[email-masked]>,  
> "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked] 
> >, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked] 
> >, "[email-masked]" <[email-masked]>, Mark Townsley <[email-masked] 
> >
> Subject: Broadband Forum liaison to IETF on IPv6 security
>
> Dear colleagues,
>
> For your review, please see the liaison from the Broadband Forum  
> attached below.
>
> Best regards,
> Robin Mersh
> COO
> The Broadband Forum
> phone: +1 336 288 8013
> cell: +1 303 596 7448
> email: [email-masked]
>
>
>

---

From: Frank Xia <[email-masked]>
Date: Thu, 05 Nov 2009 16:33:42 -0600

Hi Christian

The reason of Duplicate Link Local Addresses is different hosts having
same MAC addresses use same algorithm to create LLAs.
In broadband network, hosts(CPE) with duplicate  MACs are allowed.

There are two ways to fix it
1)Change CPE algorithm to lower possibility of duplicate address
   to a tolerable degree.  IPv6 use DAD to avoid the duplicate LLA.
2)Hosts are layer 2 seperated.  LLA can only be used with a link.
   Different links can have the same LLA.  

BR
Frank
  ----- Original Message ----- 
  From: Christian Vogt 
  To: SAVI Mailing List 
  Sent: Thursday, November 05, 2009 1:03 PM
  Subject: [savi] Broadband Forum liaison to IETF on IPv6 security

  Group - 

  Attached is a liaison related to SAVI from the Broadband Forum, for your information and consideration.  Comments?

  - Christian

  Begin forwarded message:

    To: "[email-masked]" <[email-masked]>, Christian Vogt <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, Mark Townsley <[email-masked]>

    Dear colleagues,

    For your review, please see the liaison from the Broadband Forum attached below.

    Best regards,
    Robin Mersh
    COO
    The Broadband Forum
    phone: +1 336 288 8013
    cell: +1 303 596 7448

------------------------------------------------------------------------------

------------------------------------------------------------------------------

  Group -

  - Christian

  > email: [email-masked]

------------------------------------------------------------------------------

  _______________________________________________
  savi mailing list
  [email-masked]
  https://www.ietf.org/mailman/listinfo/savi

---

From: Fred Baker <[email-masked]>
Date: Fri, 6 Nov 2009 06:18:16 +0800

Gentlemen:

I'm writing to you as the authors of RFCs 4861 and 4862. In a past  
meeting, I think the one in March, an issue came up in Savi that has  
now been brought to our attention in a formal manner. The problem is  
that in certain access network technologies, notably DSL and I believe  
Cable Modem, the connectivity between the CPE host or router and the  
ISP's first hop router is siloed - it looks like an Ethernet to the  
host but in fact is separated into separate channels. The effect is  
that while the ISP router can speak to and hear all of the CPEs it is  
connected to, the CPEs cannot hear each other. This has implications  
for Duplicate Address Detection in SLAAC.

We look forward to your advice.

Fred Baker
IPv6 Operations

Begin forwarded message:

> Date: November 6, 2009 1:42:05 AM GMT+08:00
> To: [email-masked], [email-masked], [email-masked] 
> , [email-masked], [email-masked], [email-masked], [email-masked] 
> , [email-masked], Mark Townsley <[email-masked]>

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Thu, 5 Nov 2009 16:37:28 -0600

Yes, in a cable deployment even if two cable modems (CM) in two different homes on the same upstream physical layer to the Cable edge router (CMTS) cannot talk directly to each other – they have to send their data to the CMTS who then forwards the data to the other modem.   Still I am not convinced of any implications for DAD in SLAAC?  Without any loss of generality, I will only refer to a CMTS for the rest of the discussion but the same is applicable to a DSLAM (or whatever L3 router sits upstream of the DLAM as the first-hop IPv6 router).  Since the CMTS sees all DAD messages from client in the downstream, if the CMTS detects a dup, the CMTS sends a NA to the client  - problem solved.   Of course, now the CMTS is doing ND Proxy which is already specified in cable standards and implemented on Docsis 3.0 IPv6 CMTS routers.  What did I miss? 

If the BBF has any new multicast architecture for ND that I have not accounted for, please send me your arch doc and I can look at it and reply to that as well.

Hemant

From: [email-masked] [mailto:[email-masked]] On Behalf Of Fred Baker (fred)
Sent: Thursday, November 05, 2009 5:18 PM
To: Erik Nordmark; Hesham Soliman; JINMEI Tatuya / 神明達哉; Thomas Narten; Susan Thomson (sethomso); [email-masked]
Cc: SAVI Mailing List; IETF IPv6 Mailing List; IPv6 Operations; [email-masked]; [email-masked]; [email-masked]; Robin Mersh
Subject: Fwd: Broadband Forum liaison to IETF on IPv6 security

Gentlemen:

I'm writing to you as the authors of RFCs 4861 and 4862. In a past meeting, I think the one in March, an issue came up in Savi that has now been brought to our attention in a formal manner. The problem is that in certain access network technologies, notably DSL and I believe Cable Modem, the connectivity between the CPE host or router and the ISP's first hop router is siloed - it looks like an Ethernet to the host but in fact is separated into separate channels. The effect is that while the ISP router can speak to and hear all of the CPEs it is connected to, the CPEs cannot hear each other. This has implications for Duplicate Address Detection in SLAAC.

Fred Baker

IPv6 Operations

Begin forwarded message:

To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], Mark Townsley <[email-masked]>

Dear colleagues,

Best regards,

Robin Mersh

COO

The Broadband Forum

phone: +1 336 288 8013

cell: +1 303 596 7448

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Thu, 5 Nov 2009 18:34:34 -0500

Colleagues,

I may be missing something, but it appears that, in the cases described, the two hosts downstream of two separate cable modems are off link to each other. This brings up the question: Do there two cable modems constitute two virtual interfaces, like two VLANs on the same physical router interface? If so, this is an architectural, rather than an implementation, question. Thoughts?

Best Regards,

Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

From: [email-masked] [mailto:[email-masked]] On Behalf Of Hemant Singh (shemant)
Sent: Thursday, November 05, 2009 5:37 PM
To: Fred Baker (fred); Erik Nordmark; Hesham Soliman; JINMEI Tatuya / 神明達哉; Thomas Narten; Susan Thomson (sethomso); [email-masked]
Cc: [email-masked]; IETF IPv6 Mailing List; [email-masked]; Robin Mersh; [email-masked]; IPv6 Operations; SAVI Mailing List
Subject: RE: Broadband Forum liaison to IETF on IPv6 security

Hemant

Gentlemen:

Fred Baker
IPv6 Operations

Begin forwarded message:

From: Robin Mersh <[email-masked]<mailto:[email-masked]>>
Date: November 6, 2009 1:42:05 AM GMT+08:00
To: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>, Mark Townsley <[email-masked]<mailto:[email-masked]>>
Subject: Broadband Forum liaison to IETF on IPv6 security

Dear colleagues,

Best regards,
Robin Mersh
COO
The Broadband Forum
phone: +1 336 288 8013
cell: +1 303 596 7448
email: [email-masked]<mailto:[email-masked]>

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Thu, 5 Nov 2009 18:39:13 -0600

Could be VLAN like one has L2 VPN in the cable specifications.   But L2 VPN will limit one to  1024 max per cable line card on a  CMTS – it’s a very limited for services arch in cable and I don’t think deployed very widely.  The point is a cable modem receiver chip is built to send its upstream data only to the CMTS and likewise receive data from the CMTS – so how can two modems even talk to each other?   

The link-local domain on the CMTS is also a well-defined and tied to a virtual L3 network interface that aggregates several physical cable network interfaces and all the modems.  As of Fall 2007, CableLabs in the U.S. that certifies CMTS and CM equipment has certified more than one CMTS vendor for Docsis 3.0 IPv6 with ND Proxy support on the CMTS.

I will be in Hiroshima, so if anyone would like to understand the cable and CMTS link-local model and mcast for ND in cable,  please find me – I am hanging out in 6man, v6ops, INT area and the like.

Regards,

Hemant

From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Thursday, November 05, 2009 6:35 PM
To: Hemant Singh (shemant); Fred Baker (fred); Erik Nordmark; Hesham Soliman; JINMEI Tatuya / 神明達哉; Thomas Narten; Susan Thomson (sethomso); [email-masked]
Cc: [email-masked]; IETF IPv6 Mailing List; [email-masked]; Robin Mersh; [email-masked]; IPv6 Operations; SAVI Mailing List; Dunn, Jeffrey H.
Subject: RE: Broadband Forum liaison to IETF on IPv6 security

Colleagues,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.

(301) 448-6965 (mobile)

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Thu, 5 Nov 2009 19:50:10 -0500

Hemant,

That is fine if only hosts are connected to the CM. If the CM is connected to a cheap CPE router, then the router seen the CM on one link (its default route out) and the hosts attached to it on other links. In the case where there are hosts connected to an integrated Ethernet hub and via WiFi, there will be two downstream broadcast domains in the home that cannot hear each other’s ND messages. As a result, for SLAAC to work, the cheap CPE router must have two /64 prefixes assigned to it or a /63 assigned to the CMTS virtual interface connected to the CM.

Am I missing something?

Best Regards,

Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

From: Hemant Singh (shemant) [mailto:[email-masked]]
Sent: Thursday, November 05, 2009 7:39 PM
To: Dunn, Jeffrey H.; Fred Baker (fred); Erik Nordmark; Hesham Soliman; JINMEI Tatuya / 神明達哉; Thomas Narten; Susan Thomson (sethomso); [email-masked]
Cc: [email-masked]; IETF IPv6 Mailing List; [email-masked]; Robin Mersh; [email-masked]; IPv6 Operations; SAVI Mailing List
Subject: RE: Broadband Forum liaison to IETF on IPv6 security

Regards,

Hemant

Colleagues,

Best Regards,

Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

---

From: Mikael Abrahamsson <[email-masked]>
Date: Fri, 6 Nov 2009 07:36:31 +0100 (CET)

On Thu, 5 Nov 2009, Dunn, Jeffrey H. wrote:

> I may be missing something, but it appears that, in the cases described, 
> the two hosts downstream of two separate cable modems are off link to 
> each other. This brings up the question: Do there two cable modems 
> constitute two virtual interfaces, like two VLANs on the same physical 
> router interface? If so, this is an architectural, rather than an 
> implementation, question. Thoughts?

This is basically "forced forwarding" for the L2 aggregation layer. It's 
often done on ETTH deployments as well as cable environments, in IPv4 it's 
done in conjunction with local-proxy-arp (in your IP subnet, the ISP 
router will answer all ARP requests with its own MAC and all traffic 
between clients within the subnet is done via the router which does not 
send out ICMP redirects).

In my mind it's unsuitable for clients to run SLAAC in these environments 
and the only real alternative is full DHCPv6(-PD) with SAVI-like 
functionality in the L2 equipment along the way (in v4 the L2 equipment 
does DHCP-snooping and installs L3 filters accordingly).

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Mikael Abrahamsson <[email-masked]>
Date: Fri, 6 Nov 2009 07:36:31 +0100 (CET)

---

From: Eric Levy-Abegnoli <[email-masked]>
Date: Fri, 06 Nov 2009 10:44:03 +0100

Mikael Abrahamsson a écrit :
>> I may be missing something, but it appears that, in the cases 
>> described, the two hosts downstream of two separate cable modems are 
>> off link to each other. This brings up the question: Do there two 
>> cable modems constitute two virtual interfaces, like two VLANs on the 
>> same physical router interface? If so, this is an architectural, 
>> rather than an implementation, question. Thoughts?
>
> This is basically "forced forwarding" for the L2 aggregation layer. 
> It's often done on ETTH deployments as well as cable environments, in 
> IPv4 it's done in conjunction with local-proxy-arp (in your IP subnet, 
> the ISP router will answer all ARP requests with its own MAC and all 
> traffic between clients within the subnet is done via the router which 
> does not send out ICMP redirects).
>
> In my mind it's unsuitable for clients to run SLAAC in these 
> environments and the only real alternative is full DHCPv6(-PD) with 
> SAVI-like functionality in the L2 equipment along the way (in v4 the 
> L2 equipment does DHCP-snooping and installs L3 filters accordingly).
>
The initial question mentionned link-local duplicate. For a reason: ther 
are not assigned by DHCPv6 which preq their existence and unicity. SLACC 
is your only choice.
Eric

---

From: Eric Levy-Abegnoli <[email-masked]>
Date: Fri, 06 Nov 2009 10:44:03 +0100

---

From: Thomas Narten <[email-masked]>
Date: Fri, 06 Nov 2009 08:58:32 -0500

Is there a problem statement somewhere that describes the actual
problem for which a solution is needed?

Has this been put into an ID, for instance?

I haven't been able to get my head around the actual problem from the
(few) emails I've seen.

Thomas

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 12:38:14 -0500

Thomas,

The problem is IMHO the following: How to assign an IPv6 UGA to CPE hosts attached to a BMA LAN (usually Ethernet or Wi-Fi) that is in turn connected via a CPE router through an NBMA link (cable modem or DSL) to an ISP router that provides Internet access. Currently, there are two methods: SLAAC and DHCPv6. Each has its own problems. Thoughts?

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Thomas Narten
Sent: Friday, November 06, 2009 8:59 AM
To: Fred Baker
Cc: [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; Erik Nordmark; [email-masked]; Robin Mersh; Susan Thomson; [email-masked]; IPv6 Operations; IETF IPv6 Mailing List; JINMEI Tatuya / 神明達哉
Subject: Re: Fwd: Broadband Forum liaison to IETF on IPv6 security

Thomas
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: james woodyatt <[email-masked]>
Date: Fri, 6 Nov 2009 10:23:05 -0800

On Nov 6, 2009, at 05:58, Thomas Narten wrote:

> I haven't been able to get my head around the actual problem from  
> the (few) emails I've seen.

The letter from the Broadband Forum Technical Chair in the message  
that originated this thread mentions an attachment that includes a  
revised Problem Statement on Duplicate Link Local Addresses, but it  
wasn't forwarded with the letter.

I'd like to read that problem statement.  Where is it?

--
james woodyatt <[email-masked]>
member of technical staff, communications engineering

---

From: Antonio Querubin <[email-masked]>
Date: Fri, 6 Nov 2009 08:34:35 -1000 (HST)

On Fri, 6 Nov 2009, Dunn, Jeffrey H. wrote:

> The problem is IMHO the following: How to assign an IPv6 UGA to CPE 
> hosts attached to a BMA LAN (usually Ethernet or Wi-Fi) that is in turn 
> connected via a CPE router through an NBMA link (cable modem or DSL) to 
> an ISP router that provides Internet access. Currently, there are two

And what happens when there are multiple CPE routers

a)  connected via a BMA LAN to the DSL or cable modem

and/or

b)  'connected' via separate NBMA links but are on the same WAN subnet 
(assigned by the ISP)

I think in the latter, if the ISP decides to silo the individual NBMA 
links then they need to adjust for that in how they do the sub-delegation 
which is I think what the issue is.  But if the ISP actually bridges the 
separate NBMA links, then there's no silo issue and the CPE can pretend 
they're in 'a'.

Antonio Querubin
808-545-5282 x3003
e-mail/xmpp:  [email-masked]

---

From: "Stark, Barbara" <[email-masked]>
Date: Fri, 6 Nov 2009 13:56:02 -0500

The liaison was posted in March 2009. It can be found here:
https://datatracker.ietf.org/documents/LIAISON/file621.doc

Yes, this is very much about dealing with potential duplicate link local
addresses.
Thanks,
Barbara

> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> james woodyatt
> Sent: Friday, November 06, 2009 1:23 PM
> To: Thomas Narten
> Cc: [email-masked]; SAVI Mailing List; savi-
> [email-masked]; [email-masked]; IPv6 Operations; IETF
> IPv6 Mailing List
> Subject: Re: Broadband Forum liaison to IETF on IPv6 security
> 

*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. GA621

---

From: Thomas Narten <[email-masked]>
Date: Fri, 06 Nov 2009 14:17:58 -0500

> https://datatracker.ietf.org/documents/LIAISON/file621.doc

This is too skimpy of problem statement for me to understand the
details of the problem.

I don't know that a lot is needed. Maybe 2-3 pages is enough. But show
me a diagram, label the pieces, show me the properties of the pieces
and explain what the *exact* problem is. Who needs to do DAD? Why
doesn't it work? etc.

And note that comments like (quoting from the above statement):

  "We can envision a number of scenarios, both malice or vendor
   incompetence by which this can happen."

There is very little anyone can do to prevent "vendor
incompetence". I hope you aren't asking the IETF to solve this
problem! :-)

Thomas

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 14:18:19 -0500

Antonio,

Regardless of whether the ISP bridges the NBMA links or not, the CPE router will not propagate the ND or NS messages onto these links. The Ethernet and Wi-Fi BMA LAN segments are separate logical links from each other and the ISP link(s). How will the CPE router be "convinced" to bridge these link-local scoped messages off link?

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: james woodyatt <[email-masked]>
Date: Fri, 6 Nov 2009 11:20:08 -0800

> https://datatracker.ietf.org/documents/LIAISON/file621.doc

That document is just the letter, i.e. it does not include the  
attachment it references.  My feeble search-fu isn't strong enough to  
find the attachment on datatracker.ietf.org, so perhaps we need BBF to  
send it again?

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Fri, 6 Nov 2009 16:47:55 -0500

The key is that the access router (which is the only router that knows this is an NBMA link and not a BMA link) can selectively decide to send ND messages (either NA's or NS(DAD) messages) when the access router detects that there is a duplicate on the link.  This is the minimum requirement to support DAD on an NBMA link.  This would need to specified in an NBMA-specific document and probably doesn't need to be mentioned in a document like RFC 4861.

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

On Fri, 6 Nov 2009, Dunn, Jeffrey H. wrote:

> hosts attached to a BMA LAN (usually Ethernet or Wi-Fi) that is in 
> turn connected via a CPE router through an NBMA link (cable modem or 
> DSL) to an ISP router that provides Internet access. Currently, there 
> are two

and/or

b)  'connected' via separate NBMA links but are on the same WAN subnet (assigned by the ISP)

I think in the latter, if the ISP decides to silo the individual NBMA links then they need to adjust for that in how they do the sub-delegation which is I think what the issue is.  But if the ISP actually bridges the separate NBMA links, then there's no silo issue and the CPE can pretend they're in 'a'.

Antonio Querubin
808-545-5282 x3003

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Fri, 6 Nov 2009 18:23:41 -0600

This is the same thought I emailed about that the access concentrator in the NBMA link performing ND Proxy - Wes and I are saying the same thing - he put is very nicely in concise form.  The access concentrator is also the first hop IPv6 router to the broadband enabled home and note that a router interface joins only the all-nodes mcast address and the interface solicited-node mcast address.  Such an interface mcast join will not let the router see all NS(DAD)s on the link.  That is why when a router in the BMA or NBMA link starts sniffing all mcast traffic, then the router sees all the NS(DAD)s on its link and this sniffing for all mcast traffic happens to be the first requirement of a ND Proxy!

As for your question below, the CPE Router in the home has got to have been delegated a prefix and each home gets a different prefix, so how can the UGA from the home device from one home ever encounter a dup at the access concentrator?  If anything dups can exist within the same home, but the CPE Router already takes care of those dups in the home LAN link.

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 6:26 PM
To: Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Wes,

That is an interesting idea. One question occurs to me that you can probably answer. What happens if a host behind the CPE router does SLAAC, configures a UGA? Since it has already done DAD, the host assumes it has an unused address. When the host finally tries to use the UGA to access the Internet and the access router sends an NA or NS(DAD), what should the host do? It has already validated the UGA using DAD. My interpretation is that it should reply to the NS(DAD) with an NA (based on RFC 4862). I am not sure about a duplicate NA, since DAD is supposed to prevent this. 

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 19:31:08 -0500

OK. Then the CPE router has a unique /64 for all of its broadcast domains? Does that mean that the customer needs to tell the ISP how many /64 prefixes they need?

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Hemant Singh (shemant) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:24 PM
To: Dunn, Jeffrey H.; Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 6:26 PM
To: Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Wes,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Fri, 6 Nov 2009 19:06:32 -0600

Jeffrey,

The answer to your question is a yes.  Alternatively, the ISP may just dole out a delegated prefix shorter than a /64 and the CPE Rtr has to live with it but the ISP may use something like a /55 that gives sufficient number of links in the home LAN.  I will reply to any more discussion on this thread once I reach Hiroshima. 

Hemant

-----Original Message-----
From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:31 PM
To: Hemant Singh (shemant); Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 20:29:25 -0500

Hemant,

Fair enough. I suppose that there are enough /55's or /56's that every household can have one; however, it does make "right sizing" the initial allocation to the ISP very important. We would not want to be allocating non-contiguous /28's on a regular basis :-)

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Hemant Singh (shemant) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 8:07 PM
To: Dunn, Jeffrey H.; Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Jeffrey,

Hemant

-----Original Message-----
From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:31 PM
To: Hemant Singh (shemant); Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 18:25:55 -0500

Wes,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: Christian Vogt <[email-masked]>
Date: Mon, 9 Nov 2009 03:41:16 -0500

Folks -

Thank you all for a productive working group meeting this morning!

As mentioned during our the meeting, the presentation of David Allan is
the problem statement that was missing in the liaison we had earlier
received from the Broadband Forum.  You find David's slides on the
meeting materials web page:

http://www.ietf.org/proceedings/09nov/slides/savi-8.pdf

The meeting materials web page now also includes last-minute updates to
the presentation slides you saw during our meeting this morning.
Meeting minutes will follow shortly.

- Christian

---

From: Alberto García <[email-masked]>
Date: Tue, 10 Nov 2009 16:40:38 +0100

Hi,
After looking at the presentation, I have some questions:
- Is address uniqueness enforced in just one BNG? Or an address must be
unique also across many BNGs?
- Is mobility assumed to occur among channels (i.e. is reasonable to have
Residential Gateways (RG) which are in one channel to move other channel)?
- What is the RG address used for? (frequent use)? At least, does NUD
exchange occurs between the RG and the BNG?

Current SAVI proposal for SLAAC is complex because it deals with uniqueness
across multiple SAVI devices, and considers that hosts may move to different
SAVI devices.

My bet is that this is not the case for Broadband Forum problem. 
Therefore, I assume that it is enough to enforce address uniqueness on each
BNG. The first host using an address as source address forces the creation
of the binding between the address and this channel. Receiving packets with
this source address from the RG extends the life of the binding. Since there
is no RG mobility, the binding can be kept until the timer associated to the
binding expires (there is no need to be too fast to change, or to probe
aggressively if the RG of the first binding is still there). This time can
be very long (of course, higher that the time to expire NUD state). 
The BNG should perform proxy ND, i.e. answer to DAD NSOL with DAD NADV if a
binding exists and a new RG tries to configure a new address. 
Data packets coming from channels for which there is no binding (the binding
is associated to other channel) are discarded.

Does this make sense?

Regards,
Alberto

|  -----Mensaje original-----
|  De: [email-masked] [mailto:[email-masked]] En nombre de
|  Christian Vogt
|  Enviado el: lunes, 09 de noviembre de 2009 9:41
|  Para: SAVI Mailing List
|  CC: David Allan I
|  Asunto: Re: [savi] Broadband Forum liaison to IETF on IPv6 security
|  
|  Folks -
|  
|  Thank you all for a productive working group meeting this morning!
|  
|  As mentioned during our the meeting, the presentation of David Allan is
|  the problem statement that was missing in the liaison we had earlier
|  received from the Broadband Forum.  You find David's slides on the
|  meeting materials web page:
|  
|  http://www.ietf.org/proceedings/09nov/slides/savi-8.pdf
|  
|  The meeting materials web page now also includes last-minute updates to
|  the presentation slides you saw during our meeting this morning.
|  Meeting minutes will follow shortly.
|  
|  - Christian
|  
|  
|  _______________________________________________
|  savi mailing list
|  [email-masked]
|  https://www.ietf.org/mailman/listinfo/savi

---

From: Alberto García <[email-masked]>
Date: Wed, 11 Nov 2009 16:28:16 +0100

Hi

|  -----Mensaje original-----
|  De: David Allan I [mailto:[email-masked]]
|  Enviado el: miércoles, 11 de noviembre de 2009 1:42
|  Para: Alberto García; Christian Vogt; 'SAVI Mailing List'
|  Asunto: RE: [savi] Broadband Forum liaison to IETF on IPv6 security
|  
|  HI Alberto:
|  
|  The unfortunate answer to all of your question is "it depends..."
|  
|  I believe it would be safe to suggest that one BNG would enforce
uniqueness,
|  although architectures could be considered where a second BNG was
effectively a
|  warm standby for a given broadcast domain... One BNG will be the
repository for
|  all active customer facing "state" any any given time...

Well, the problem would be to enforce uniqueness across several BNGs
operating in parallel.
The event of having a backup BNG assuming the role of a failed BNG could be
handled in a specific way, or just not handled at all. In this last case, if
a new BNG replaces an old one, even if it does not have the state of the
first BNG, it will learn it from the data packets it is receiving. Every RG
would be unprotected (in the sense that a different RG could obtain the
address of another RG that was operating successfully with that address) for
some time (until each RG sends its first packet). ICMPs should be used to
inform the RGs. But it would never occur that two addresses were in use at
the same time. Would this be a problem?

|  
|  We do have scenarios where a service provider test set may move around
the
|  network, but the common case is the RG association with a single port is
very
|  long lived....

Maybe manual special bindings could be set for the addresses of these test
devices (e.g. a binding to ANY port, instead of to one particular port,
meaning that an RG in any port could use this address). 
Or make the test devices changing its address each time the move.
Or make the test devices using SEND to validate securely, and make BNGs to
check the signature of a DAD NSOL to change the binding immediately for the
new port through which DAD NSOL is received.

It depends on if you don't care very much to configure the BNG/the test
devices

Is this reasonable?

|  
|  W.r.t. NUD, we have had discussions of the role of NUD vs. our use of BFD
or
|  other protocols for IPv4, but others will have to comment on the current
state of
|  play....

The real requirement would be to have packets sent from the RG (containing
its source address) periodically, to be able to create/refresh the binding.
They can either result from NUD exchange, BFD, whatever, while they contain
the IPv6 source address of the RG.

Regards,
Alberto

|  
|  My second answer above would tend to complicate any form of sticky
|  binding...although a coupling to a PHY outage as a binding invalidation
would
|  likely address that scenario, but that would require messaging that is
not
|  necessarily deployed today (ANCP notwithstanding)...
|  
|  Hope that helps
|  D
|  
|  -----Original Message-----
|  From: Alberto García [mailto:[email-masked]]
|  Sent: Tuesday, November 10, 2009 10:41 AM
|  To: Christian Vogt; 'SAVI Mailing List'
|  Cc: David Allan I
|  Subject: RE: [savi] Broadband Forum liaison to IETF on IPv6 security
|  
|  Hi,
|  After looking at the presentation, I have some questions:
|  - Is address uniqueness enforced in just one BNG? Or an address must be
unique
|  also across many BNGs?
|  - Is mobility assumed to occur among channels (i.e. is reasonable to have
|  Residential Gateways (RG) which are in one channel to move other
channel)?
|  - What is the RG address used for? (frequent use)? At least, does NUD
exchange
|  occurs between the RG and the BNG?
|  
|  Current SAVI proposal for SLAAC is complex because it deals with
uniqueness
|  across multiple SAVI devices, and considers that hosts may move to
different
|  SAVI devices.
|  
|  My bet is that this is not the case for Broadband Forum problem.
|  Therefore, I assume that it is enough to enforce address uniqueness on
each
|  BNG. The first host using an address as source address forces the
creation of the
|  binding between the address and this channel. Receiving packets with this
source
|  address from the RG extends the life of the binding. Since there is no RG
mobility,
|  the binding can be kept until the timer associated to the binding expires
(there is
|  no need to be too fast to change, or to probe aggressively if the RG of
the first
|  binding is still there). This time can be very long (of course, higher
that the time
|  to expire NUD state).
|  The BNG should perform proxy ND, i.e. answer to DAD NSOL with DAD NADV if
a
|  binding exists and a new RG tries to configure a new address.
|  Data packets coming from channels for which there is no binding (the
binding is
|  associated to other channel) are discarded.
|  
|  Does this make sense?
|  
|  Regards,
|  Alberto
|  
|  
|  |  -----Mensaje original-----
|  |  De: [email-masked] [mailto:[email-masked]] En nombre de
|  | Christian Vogt  Enviado el: lunes, 09 de noviembre de 2009 9:41
|  |  Para: SAVI Mailing List
|  |  CC: David Allan I
|  |  Asunto: Re: [savi] Broadband Forum liaison to IETF on IPv6 security
|  |
|  |  Folks -
|  |
|  |  Thank you all for a productive working group meeting this morning!
|  |
|  |  As mentioned during our the meeting, the presentation of David Allan
|  | is  the problem statement that was missing in the liaison we had
|  | earlier  received from the Broadband Forum.  You find David's slides
|  | on the  meeting materials web page:
|  |
|  |  http://www.ietf.org/proceedings/09nov/slides/savi-8.pdf
|  |
|  |  The meeting materials web page now also includes last-minute updates
|  | to  the presentation slides you saw during our meeting this morning.
|  |  Meeting minutes will follow shortly.
|  |
|  |  - Christian
|  |
|  |
|  |  _______________________________________________
|  |  savi mailing list
|  |  [email-masked]
|  |  https://www.ietf.org/mailman/listinfo/savi

---

From: David Allan I <[email-masked]>
Date: Tue, 10 Nov 2009 19:42:04 -0500

HI Alberto:

The unfortunate answer to all of your question is "it depends..."

I believe it would be safe to suggest that one BNG would enforce uniqueness, although architectures could be considered where a second BNG was effectively a warm standby for a given broadcast domain... One BNG will be the repository for all active customer facing "state" any any given time...

We do have scenarios where a service provider test set may move around the network, but the common case is the RG association with a single port is very long lived....

W.r.t. NUD, we have had discussions of the role of NUD vs. our use of BFD or other protocols for IPv4, but others will have to comment on the current state of play....

My second answer above would tend to complicate any form of sticky binding...although a coupling to a PHY outage as a binding invalidation would likely address that scenario, but that would require messaging that is not necessarily deployed today (ANCP notwithstanding)...

Hope that helps
D

-----Original Message-----
From: Alberto García [mailto:[email-masked]] 
Sent: Tuesday, November 10, 2009 10:41 AM
To: Christian Vogt; 'SAVI Mailing List'
Cc: David Allan I
Subject: RE: [savi] Broadband Forum liaison to IETF on IPv6 security

Hi,
After looking at the presentation, I have some questions:
- Is address uniqueness enforced in just one BNG? Or an address must be unique also across many BNGs?
- Is mobility assumed to occur among channels (i.e. is reasonable to have Residential Gateways (RG) which are in one channel to move other channel)?
- What is the RG address used for? (frequent use)? At least, does NUD exchange occurs between the RG and the BNG?

Current SAVI proposal for SLAAC is complex because it deals with uniqueness across multiple SAVI devices, and considers that hosts may move to different SAVI devices.

My bet is that this is not the case for Broadband Forum problem. 
Therefore, I assume that it is enough to enforce address uniqueness on each BNG. The first host using an address as source address forces the creation of the binding between the address and this channel. Receiving packets with this source address from the RG extends the life of the binding. Since there is no RG mobility, the binding can be kept until the timer associated to the binding expires (there is no need to be too fast to change, or to probe aggressively if the RG of the first binding is still there). This time can be very long (of course, higher that the time to expire NUD state). 
The BNG should perform proxy ND, i.e. answer to DAD NSOL with DAD NADV if a binding exists and a new RG tries to configure a new address. 
Data packets coming from channels for which there is no binding (the binding is associated to other channel) are discarded.

Does this make sense?

Regards,
Alberto

|  -----Mensaje original-----
|  De: [email-masked] [mailto:[email-masked]] En nombre de  
| Christian Vogt  Enviado el: lunes, 09 de noviembre de 2009 9:41
|  Para: SAVI Mailing List
|  CC: David Allan I
|  Asunto: Re: [savi] Broadband Forum liaison to IETF on IPv6 security
|  
|  Folks -
|  
|  Thank you all for a productive working group meeting this morning!
|  
|  As mentioned during our the meeting, the presentation of David Allan 
| is  the problem statement that was missing in the liaison we had 
| earlier  received from the Broadband Forum.  You find David's slides 
| on the  meeting materials web page:
|  
|  http://www.ietf.org/proceedings/09nov/slides/savi-8.pdf
|  
|  The meeting materials web page now also includes last-minute updates 
| to  the presentation slides you saw during our meeting this morning.
|  Meeting minutes will follow shortly.
|  
|  - Christian
|  
|  
|  _______________________________________________
|  savi mailing list
|  [email-masked]
|  https://www.ietf.org/mailman/listinfo/savi