Subject: Re: [Efficientnd-dt] DAD problems (revision 2)

From: Erik Nordmark <[email-masked]>
Date: Thu, 01 May 2014 16:59:18 -0700

On 3/23/14, 3:46 AM, Ole Troan wrote:
> all,
>
> an updated list of DAD problems.
Thanks for updating the list. We need to get the DT back in motion to 
make sure we can make some progress before Toronto.
>
> 1. Doesn’t detect duplicate L2 addresses in all cases
> 2. Fails when L2 port is blocked. Host connected to a switch with STP enabled (~50 seconds before traffic is allowed)
> 3. Fails on multicast unreliable links (collision detection requires two multicast messages to pass through)
> 4. False positives in case of looped interfaces (solved by enhanced-dad)
> 5. Introduces delays before an address can be used (Optimistic DAD fixes that rfc4429)
> 6. Doesn’t deal with partition and joining, since detection is only done on start up.
> 7. Doesn’t specify what to do in case of collision in the general case. CGA, privacy addresses have their own schemes.
> 8. Requires all nodes to be awake to defend their address
> 9. Unclear on what a node should do after L2 events / waking up from sleep
Agree with all of the above.

> 10. DAD is used to build state in the network
Is that a problem? It doesn't read like a problem the way you phrased it 
so I don't understand.
> 11. DAD is used by L2 devices to check if an address is in use (RFC6620)
Doesn't read as a problem. FWIW RFC 6620 normally uses a regular NS to 
check whether an address is in use (at its old anchor).
The only time it uses DAD probes is when a host moves to a new port 
(anchor) and doesn't send a DAD probe.

> 12. DAD doesn't support multi-link subnets (but the IPv6 architecture doesn't either).

While we do have RFC 4903 pointing out some issues with multi-link 
subnets, I don't think it or any other RFC declares such non-support.

In fact we do have Mobile IPv6 which is a proposed standard and provides 
one way to construct a multi-link subnet (where the link consisting of 
zero or one broadcast links plus a collection of pt-pt tunnels). Thus 
the IPv6 architecture can't forbid them.

I think the statement that makes sense for this DT is that any 
improvements to make DAD work for multi-link subnets is out of scope.

Regards,
Erik

>
> cheers,
> Ole
>
>
> _______________________________________________
> Efficientnd-dt mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/efficientnd-dt

---

From: Ole Troan <[email-masked]>
Date: Mon, 5 May 2014 11:36:26 +0200

Erik,

> Thanks for updating the list. We need to get the DT back in motion to make sure we can make some progress before Toronto.

yes, it has been worrisomely quiet here.

> Is that a problem? It doesn't read like a problem the way you phrased it so I don't understand.

it is a problem in that it doesn't work reliably.

> Doesn't read as a problem. FWIW RFC 6620 normally uses a regular NS to check whether an address is in use (at its old anchor).
> The only time it uses DAD probes is when a host moves to a new port (anchor) and doesn't send a DAD probe.

OK, then I've misunderstood, I thought it was used by SAVI L2 devices to build state.

> While we do have RFC 4903 pointing out some issues with multi-link subnets, I don't think it or any other RFC declares such non-support.
> 
> In fact we do have Mobile IPv6 which is a proposed standard and provides one way to construct a multi-link subnet (where the link consisting of zero or one broadcast links plus a collection of pt-pt tunnels). Thus the IPv6 architecture can't forbid them.
> 
> I think the statement that makes sense for this DT is that any improvements to make DAD work for multi-link subnets is out of scope.

agree.

cheers,
Ole

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 9 May 2014 12:14:04 +0000

Hi Ole and Erik

> OK, then I've misunderstood, I thought it was used by SAVI L2 devices to
[PT] You have not really misunderstood, though we do not "build" but rather "(re)validate" state.
A pure L2 first hop switch may not have an IPv6 address on the access vlan. In that case DAD is the only way to probe.

Cheers,

Pascal