Subject: Re: LLMNR TTL change

From: Bernard Aboba <[email-masked]>
Date: Sun, 31 Aug 2003 16:50:40 -0700 (PDT)

As Mika has indicated, this issue is not as simple as it looks.  For
those who are new to this issue (or are just now reading the draft for
the first time), past discussion is covered in issues 2, 34 and 35 of
the LLMNR Issues list:

http://www.drizzle.com/~aboba/DNSEXT/llmnrissues.html

A brief summary of the discussion is as follows:

a. Multicast queries.  Here the destination is a link-scope multicast
address, so it can be argued that TTL is not particularly relevant.  In
Issue 44, Stuart argued that TTL=255 can be used in this situation without
fear of leakage, and I would agree.

b. TCP queries and responses.  Here the goal is to prevent
establishment of a TCP connection to an off-link destination.  IMHO, the
argument for TTL=1 is fairly persuasive here, as is the argument for not
utilizing multicast for PTR queries, which are highly likely to be bogus.

c. UDP Responses.  This is the case which has generated the most
discussion. Setting TTL=255 on UDP Responses and checking it does ensure
against spoofing by an off-link host.  The potential downside is leakage
by a host that does not ARP for IPv4 Link-Local addresses, or by a host
that responds to UDP unicast queries.  If it is reasonable to assume that
LLMNR is only implemented on hosts that also implement the IPv4 LL spec,
then the former concern can be dismissed.  The latter concern is more
serious, since use of TCP for unicast queries is not required.

Given that this is WG last call, and that the draft as well as the
discussion is fairly far advanced, it's expected that posters wishing to
see a change to the draft do the following:

1. Read the draft. It's available at
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-mdns-22.txt

2. Read the Issues list:
http://www.drizzle.com/~aboba/DNSEXT/llmnrissues.html

3. Submit a change request in the format specified on the Issues list.
This includes clearly indicating what text you want changed, and what you
want it changed to.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>