Re: I-D ACTION:draft-savola-v6ops-6to4-security-01.txt

[Brian E Carpenter <brian@hursley.ibm.com>]

(catching up on old mail)

It's probably worth saying yet again that without ingress filtering
in place, we are exposed to an infinity of spoofing attacks, and
6to4 spoofing is a drop in the ocean. So two basic assumptions, that
should probably be stated clearly in the draft, are that ISPs run
ingress filtering, and that 6to4 routers and relays are correctly
implemented. Without these conditions, there is no hope anyway.

   Brian

Alain Durand wrote:
> 
> Fred L. Templin wrote:
> 
> >
> > Maybe I'm behind the times here, but when I last looked at DDoS
> > attacks randomly varying the IPv4 source address was an element
> > that made the attacks particularly difficult to trace. At that
> > time, it was not necessarily true that all sites in the global
> > IPv4 Internet properly configured IPv4 ingress filtering. Are
> > you saying this is no longer the case?
> 
> Some ISPs do ingress filtering, some don't.
> The issue here is to make sure 6to4 will not be used
> as a way to bypass ingress filtering when/if in place.
> 
>     - Alain.