Subject: [OPSEC] Spencer Dawkins' No Objection on draft-ietf-opsec-ipv6-host-scanning-07: (with COMMENT)

From: "Spencer Dawkins" <[email-masked]>
Date: Sun, 16 Aug 2015 20:26:55 -0700

Spencer Dawkins has entered the following ballot position for
draft-ietf-opsec-ipv6-host-scanning-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-host-scanning/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I echo Barry's "nice document", and would support the changes he
suggested.

I did notice what I believe is a repeated "not" in "it is not not only
the lowest-order byte".

In this text:

3.4.1.  Remote IPv6 Network Scanners

   Many address scanning tools such as nmap [nmap2012] do not even
   support sweeping an IPv6 address range.
                           ^ 
does this mean "sweeping an IPv6 address range in a remote IPv6 network"?
I think that's implicit from the section title, but what nmap supports is
clearer in the corresponding text in the next section:

3.4.2.  Local IPv6 Network Scanners

   There are a variety of publicly-available local IPv6 network
   scanners:

   o  Current versions of nmap [nmap2012] implement this functionality.

---

From: Fernando Gont <[email-masked]>
Date: Wed, 19 Aug 2015 02:21:28 +0200

Hi, Spencer,

Thanks so much for your feedback! Please find my comments in-line....

Yep. Will fix this.

> does this mean "sweeping an IPv6 address range in a remote IPv6 network"?

Yes.

>    o  Current versions of nmap [nmap2012] implement this functionality.

This is a different feature: for local scans, you can just "ping" the
all-nodes link-local multicast address. But when scanning a remote
network, you can only target unicast addresses. And for remote address
scans, nmap does not support targeting specific IPv6 address ranges.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Tue, 18 Aug 2015 20:43:35 -0500

Hi, Fernando,

> scans, nmap does not support targeting specific IPv6 address ranges.

Right. That's what I wasn't getting from the text.

Thanks,

Spencer