Subject: Re: [mobile-ip] what optimistic DAD?

From: Rajeev Koodli <[email-masked]>
Date: Tue, 01 Jul 2003 09:29:58 -0700

Nick 'Sharkey' Moore wrote:

> G'day Hesham!
>
> On 2003-06-30, Soliman Hesham wrote:
> >  > Nick 'Sharkey' Moore wrote:
> >  > >
> >  > > Yeah, and I think that's the difference.  Optimistic DAD is an
> >  > > attempt to make all this work ON AN UNMODIFIED NAR at the expense
> >  > > of a couple of extra round-trips.  I think it's important that
> >  > > we get a practical handover protocol which will work in
> >  > > Starbucks :-)
> >  >
> >  > Good applicability statement. If you don't wish to change the
> >  > router, run reactive with BU to the old router.
> >
> > => There is no reason to do that, you can use it
> > with predictive handovers as well as I showed
> > several times.
>
> Yeah, that's what I meant too, which is why I emphasized
> "ON AN UNMODIFIED NAR".  Eg: even if the prediction signalling
> comes from the MN, the AP, the pixies &c Optimistic DAD
> will be a useful technique for predictive fast handovers.
>

It seems to me that running in reactive mode is the most
straightforward way to implement the oDAD, FMIPv6,
for the time being anyway.
Getting the MN to send FBU on the old link, which will
cause "prediction" at NAR, does not seem to be easy.
Is there some data to share on this ?

-Rajeev

>
> -----Nick
> --
> "Premature optimization is the root of all evil (or at least most of it)
> in programming." -- Donald Knuth

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 2 Jul 2003 16:54:26 +0100

Hi James,

We already had that chat on the ML. The question is whether the home is
safe or not. If it's not, the attacker could block your address before
you even bind to it by playing with ND. I suspect the Home MUST be SAFE.

Pascal

> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: mercredi 2 juillet 2003 17:36
> To: Pascal Thubert (pthubert); Nick 'Sharkey' Moore;
[email-masked]
> Subject: Re: [mobile-ip] what optimistic DAD?
> 
> > >
> > > Any suggestions about how to determine who the "real owner" is?
> > >
> > >
> >
> > I think of the home address as an address statically configured on
the
> > 'home' interface, rightfully owned by the MN. In other words, the MN
> > should be allowed to NA (override=1). As opposed to a HA that is
only a
> > proxy.
> >
> 
> One nice DoS attack would be for an attacker to start claiming the
home
> address, causing the HA to stop proxying, and the attacker then gets
the
> traffic for the victim.
>             jak

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 3 Jul 2003 07:41:36 +0100

> you recommend. However, if there is enough technical justification for
> making this simplification you recommend, then I'm certainly not
> strongly opposed to it. I think the key is to approach it from the
> standpoint that link-local scope DoS attacks such as DAD aren't really
> something we need to protect against.
> 
Yes :)

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 3 Jul 2003 07:44:32 +0100

> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: mercredi 2 juillet 2003 22:29
> To: Ed Remmell
> Cc: Pascal Thubert (pthubert); [email-masked]
> Ed Remmell wrote:
> > Vijay, are you still strongly opposed to this HA auto-deregister
> > capability (upon detection of another node's DAD of the registered
home
> > address) that Pascal is recommending?
> 
> yup. going strong on it. :)
> 
> > If so, then why?
> 
> we have been through the discussion. there is nothing new
> from me. any changes to a binding cache entry should come
> from an authenticated Binding Update.
> 

Well, this is a good summary of the reasons against that were given at
the time. The discussion dried out when I stopped arguing because there
was nothing to argue against. And nobody cut a decision. The support of
home in MIP is more complex than it needs to be. 

Pascal