Subject: Re: [v6ops] ICMP rate-limiting in draft-ietf-v6ops-ipv6rtr-reqs-00

From: "Russ White" <[email-masked]>
Date: Tue, 1 Aug 2017 08:50:28 -0400

> o  SHOULD rate limit the generation of ICMP error messages
>    with a token bucket method as described in [RFC 4443].
>    Rate limits SHOULD be narrow enough to (a) protect the
>    device's ability to generate packets and (b) reduce the
>    usefulness of ICMP error packets as part of a distributed
>    denial of service attack. Limits SHOULD be generous enough to
>    allow successful path MTU discovery and traceroute. For
>    example, in a small/mid-size device, the possible defaults
>    could be bucket size=100, refill rate=100/s. Larger devices
>    can afford more generous rate limits.

I'm happy enough with this text -- I'll add it to my list for the next revision.

😊

Russ

---

From: "Alvarez, Pablo" <[email-masked]>
Date: Tue, 1 Aug 2017 15:26:42 -0400

Thanks, Russ.

What about the clarification to the first bullet in #5.4 (I will save 
the discussion of ICMP ECHO filtering for a separate thread):

----

I would also like to suggest the following revisions to the first 
bullet, to clarify what types of packets should not be filtered:

Proposed:

o  SHOULD NOT filter Destination Unreachable or Packet Too Big
    ICMP error messages by default, as this has negative impacts
    on many aspects of IPv6 operation, particularly path MTU discovery.

Current draft:

o SHOULD NOT filter ICMP unreachables by default, as this has
negative impacts on many aspects of IPv6 operation, particularly
path MTU

----

Best

Pablo Alvarez