Subject: Re: [OPSEC] [v6ops] New Draft: Using Only Link-Local Address in Network Core

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Thu, 8 Mar 2012 23:23:23 +0100

>On the same point:
>
>>>    Traceroute: Similar to the ping case, a reply to a traceroute
packet
>>>    would come from a loopback address with a global address.  Today
this
>>>    does not display the specific interface the packets came in on.
Also
>>>    here, RFC5837 [RFC5837] provides a solution.
>
>There is a genuine source of confusion possible here for a typical
>traceroute user, even if not interested in the specific interface.
>I've seen cases where the traceroute reply came from a global address
>that was actually a PA address from an ISP that was not actually
>on the path, because the router had multiple interfaces with PA
>addresses from several ISPs. So it's actually important that the
>global address used for ICMP replies, even if it's a loopback address,
>is under a prefix that belongs to the organisation operating the router
>in question.

Also Passive-IPv6 addresses provide a way to have traceroute
capabilities again to complement a LL-only infrastructure.
(http://tools.ietf.org/html/draft-baker-opsec-passive-ip-address-00)
The convenient element is that it doesn't require the ICMP stack to be
changed and is box only behavior

G/