Subject: RE: [mobile-ip] Fast Handover document revision

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 13 Feb 2003 23:05:06 +0100

Rajeev,

 > > Because router discovery never gives you a global or site 
 > local address! Read
 > > RFC 2541 (Section 4.2, Router Advertisement Format):
 > >
 > >     IP Fields:
 > >         Source Address
 > >                     MUST be the link-local address 
 > assigned to the interface
 > > from which this message is sent.
 > >
 > 
 > And, Mobile IPv6 extends this with the global address using the
 > 'H' bit.

=> Don't you mean the R bit in the RA? 

Hesham

 > 
 > In any case, if an SA is with a router's link-local address, 
 > how would
 > that hold on some other router ?
 > 
 > -Rajeev
 > 
 > 
 > >
 > >             jak
 >

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 13 Feb 2003 16:10:51 -0800

> => Don't you mean the R bit in the RA?

Yes. The 'R' bit in Prefix Information Option of RA.
Sorry..

Thanks,

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Fri, 14 Feb 2003 09:20:21 -0800

> Yes. The 'R' bit in Prefix Information Option of RA.

Section 7.2 of draft-ietf-mobileip-ipv6-20.txt) specifies this as a MUST only
for home agents. It is a MAY for other routers.

Unless I am missing something, advertising a global address for a last hop
router to a host raises a possible security risk. Though we should confirm this
with the IPv6 list, I suspect that the reason a global address was not specified
in RFC 2461 in the first place was because the authors wanted to avoid the
possibiity that a host could send the address to some other host across the
Internet, and the other host could then launch a DoS attack on the router. Also,
while a case might be made for a home agent, the subnet anycast address can be
used for the purpose of having the host contact the home agent. For any other
router, there is no need for this, and I can't see an ISP deploying this since
it will expose their last hop routers.

Any idea why this is in the draft, and any chance it can be removed? I realize
time is late.

            jak

---

From: Jari Arkko <[email-masked]>
Date: Fri, 14 Feb 2003 20:40:46 +0200

> Internet, and the other host could then launch a DoS attack on the router. Also,

I could be missing something here, but how is this different from doing
a traceroute from the host (or the peer) and attacking the addresses
found?

Jari