Skip to main content

Operational Neighbor Discovery Problem
draft-gashinsky-v6ops-v6nd-problems-00

Document Type Replaced Internet-Draft (individual)
Expired & archived
Authors Igor Gashinsky , Joel Jaeggli , Warren "Ace" Kumari
Last updated 2011-10-24 (Latest revision 2011-10-06)
Replaced by draft-ietf-v6ops-v6nd-problems
RFC stream (None)
Intended RFC status (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Replaced by draft-ietf-v6ops-v6nd-problems
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:

Abstract

In IPv4, subnets are generally small, made just large enough to cover the actual number of machines on the subnet. In contrast, the default IPv6 subnet size is a /64, a number so large it covers trillions of addresses, the overwhelming number of which will be unassigned. Consequently, simplistic implementations of Neighbor Discovery can be vulnerable to denial of service attacks whereby they attempt to perform address resolution for large numbers of unassigned addresses. Such denial of attacks can be launched intentionally (by an attacker), or result from legitimate operational tools that scan networks for inventory and other purposes. As a result of these vulnerabilities, new devices may not be able to "join" a network, it may be impossible to establish new IPv6 flows, and existing ipv6 transported flows may be interrupted. This document describes the problem in detail and suggests possible implementation improvements as well as operational mitigation techniques that can in some cases to protect against such attacks.

Authors

Igor Gashinsky
Joel Jaeggli
Warren "Ace" Kumari

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)