Subject: Re: [MOBILE-IP] Deregistration question...

From: Jonathan Khoo <[email-masked]>
Date: Thu, 15 Jun 2000 09:50:46 SGT

Hi there,

Thanks for the reply. Is there anyway to prevent traffic from going to a
bogus MN after it has sent it's gratutious ARP and deregistration fails?

Have a nice day!

Cheers,
Jonathan

>     This is also probably where the disclaimer normally goes that >this
>use of ARP doesn't make the network less secure or chaotic than >in the
>non-mobile case; anyone can gratuitous arp an address if they >so choose.
>
>                               Cheers,
>                                   Steve

________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

---

From: Steven Glass - Solaris Software <[email-masked]>
Date: Thu, 15 Jun 2000 14:35:27 -0400

> Jonathan

    According to the way 2002-bis is written, no.  The HA would have to
reclaim the address after the unsucessful dereg, which isn't allowed.  This is
done to make things no worse than they would be without mobile ip.  Any other
node can gratuitous arp for the mobile's IP address, thereby stealing the
traffic.  If *whomever* fails the dereg (bad nonce, whatever) it's better for
the HA to not take the MN's IP address back, thereby potentially stealing the
traffic from a legitimate mobile node (no different than a node stealing the
address, but which wouldn't be likely to attempt to deregister), rather than
taking the address back and stealing the traffic.  If the HA gets another
registration request from the mobile node, though, it should absolutely take
the address (gratuitous ARP).

    Perhaps a better strategy may be if the MN fails authentication the HA
should gratuitous arp the address back, but any other error the HA shouldn't.
Anyone have a good reason why this isn't done?

                              Cheers,
                                  Steve

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Mon, 19 Jun 2000 12:42:29 +0900

Hi, Steve,

 I agree with you this isn't an MIP specific issue but a common issue.

 I have another related issue:  an MN will often register its HA without
 B-bit.  Then, if an erroneous node sends erroneous gratuitous ARPs, the
 HA can detect them, but not relay them to the MN.  So, in this case,
 the MN cannot detect such erroneous ARPs.
 I think, it might be better an HA should relay such erroneous ARPs to
 an MN, whether the B-bit is set or not.

Thanks.
-Yoshi

---

From: Steven Glass - Solaris Software <[email-masked]>
Date: Mon, 19 Jun 2000 14:45:42 -0400

>  an MN, whether the B-bit is set or not.

    Tsudasan,

    This is a nice feature!   The HA lets the mobile node, if it's still on
the other end of the tunnel, know that someone's captured its address.  If
it's still at the other end of the tunnel, it reregisters to allow the HA to
resend a gratuitous arp and recapture the address.  Sure, the MN can't compete
with a bag-guy on the home subnet, but it could certainly let a user know
what's happening...

                              Cheers,
                                  Steve