Subject: a question about send-psreq-04

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Mon, 10 Nov 2003 06:52:05 +0900

Hello,

I have a quick question about draft-ietf-send-psreq-04.

Section 4.1.1 (4.1.1 Neighbor Solicitation/Advertisement Spoofing)
mentions Duplicate Address Detection as follows:

   More specifically, there are two cases when a node creates neighbor
   cache entries upon receiving Soliciations:
...
   2.  During Duplicate Address Detection (DAD), if a node receives a
       Neighbor Solicitation for the same address it is soliciting for,
       the situation is considered a collision, and the node must cease
       to solicit for the said address.

(BTW: there is a typo: Soliciations should be Solicitation in the
first sentence)

The description per se is not wrong, but I don't understand how this
is related to the story described in this section.

In my understanding, the main point of the attack in this section is a
DoS/Redirect attack by sending an ND message with a forged link-layer
address option.  In that sense, it should basically apply to all kinds
of neighbor solicitation.

Perhaps this bullet tries to show an exception to this attack, but if
so, I don't understand why this is listed with the 1st bullet (the
router solicitation case) where the attack can be applied.

Could someone clarify this point?

Thanks,

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Mon, 10 Nov 2003 08:06:59 +0900

Oops, sorry, I was a bit careless when I typed the previous message.

>>>>> On Mon, 10 Nov 2003 06:52:05 +0900, 
>>>>> JINMEI Tatuya <[email-masked]> said:

> (BTW: there is a typo: Soliciations should be Solicitation in the

I meant "Soliciations should be Solicitations in the first sentence"

					JINMEI, Tatuya

---

From: "James Kempf" <[email-masked]>
Date: Mon, 10 Nov 2003 17:16:58 -0800

> of neighbor solicitation.

Section 4.1.1 is about attacks that involve spoofing an address when a node
would create a Neighbor Cache entry.

            jak

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Tue, 11 Nov 2003 12:17:10 +0900

>>>>> On Mon, 10 Nov 2003 17:16:58 -0800, 
>>>>> "James Kempf" <[email-masked]> said:

> would create a Neighbor Cache entry.

Okay, but my main point still applies.  There should be nothing
special in the DAD case in terms of the attacks; other "normal"
neighbor solicitations for link-layer address resolution would also
cause the creation of a neighbor cache entry.  So, why the 2nd bullet
of Section 4.1.1 exists?

					JINMEI, Tatuya

---

From: "James Kempf" <[email-masked]>
Date: Mon, 10 Nov 2003 19:34:25 -0800

Like I said, this section deals with cases where the node creates a NC
entry. There are two such cases, thus there are two bullets.

            jak

----- Original Message ----- 
From: <JINMEI Tatuya / $B?@L@C#:H (B <[email-masked]>)>
To: "James Kempf" <[email-masked]>
Cc: "Pekka Nikander" <[email-masked]>; "Erik Nordmark"
<[email-masked]>; <[email-masked]>
Sent: Monday, November 10, 2003 7:17 PM
Subject: Re: a question about send-psreq-04