Subject: Re: [Int-dir] INT Directorate - Seeking Directorate reviews

From: Ralf Weber <[email-masked]>
Date: Wed, 1 Jul 2015 10:22:27 +0200

Moin!

On 30 Jun 2015, at 9:03, [email-masked] wrote:
> A misbehaving CPE can indeed vary the source IPv6 address it uses to 
> send its IPv4-in-IPv6 packets to the DS-Lite AFTR. If the AFTR 
> maintains state for each new softwire (from the same B4), then varying 
> the source IPv6 address can be a source of DoS attack that may exhaust 
> the AFTR resources.
>
> A first mitigation to this attack vector is to limit the number of 
> softwire per B4 (already recorded in the draft). This countermeasure 
> should be complemented with rate limiting softwires with new source 
> IPv6 from the same CPE.
>
> A new version that includes changes to address your comment is 
> available online:
That addresses my concern. IMHO it would be clearer to replace CPE with 
prefix, so that section 5 would say:

Enforcing the recommendations documented in Section 4 together with
rate limiting softwires with new source IPv6 addresses from the same
prefix to defend against DoS attacks that would result in varying the 
B4's
IPv6 address to exhaust AFTR resources.

But that's just minor wording issue.

So long
-Ralf
---
Ralf Weber
Principal Architect, Special Projects
office: +49 6446 4392053
mobile: +49 151 22659325
us: +1 650 817 5895
Nominum
www.nominum.com
[email-masked]

---

From: <[email-masked]>
Date: Wed, 1 Jul 2015 08:31:44 +0000

Dear Ralf,

Deal!

I made this change in my local copy: s/CPE/prefix.

Thank you.

Cheers,
Med

> -----Message d'origine-----
> De : Ralf Weber [mailto:[email-masked]]
> Envoyé : mercredi 1 juillet 2015 10:22
> À : BOUCADAIR Mohamed IMT/OLN
> Cc : Bernie Volz (volz); [email-masked]; [email-masked];
> Christopher LILJENSTOLPE ([email-masked]); [email-masked]; draft-
> [email-masked]
> Objet : Re: INT Directorate - Seeking Directorate reviews
> 
> Moin!
>