[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Status of various documents

OK, folks. Lets get a review.
http://www.ietf.org/internet-drafts/draft-manral-v6ops-tiny- fragments-issues-02.txt "Operational issues with Tiny Fragments in IPv6", Vishwas Manral, 9-Jan-06, 
  <draft-manral-v6ops-tiny-fragments-issues-02.txt>
The principal comment that I noted from our previous discussion was that the problem existed for IPv4 also, and hence was not specifically an IPv6 problem. The working group did not choose to make a recommendation on the topic, and personally I wasn't aware that we were asked to. The key recommendation seems to be that there be a minimum MTU size large enough to contain the IPv6 header (with all of its additional headers) plus the second layer header, and that middleware devices like firewalls discard messages that were a non- last fragment and were smaller than that size.
In such a case, this would convert the attack to another kind of attack, one in which the target is bombarded with fragments of messages, but never enabled to reassemble them, and attacking the reassembly tables and associated memory. The solution for that is fortunately trivial - in the event that there is any any overload in this area, discard the oldest fragment in the buffer and any other fragments that are presumptively part of the same message - the same way we protect TCP TCBs.
The origin of the discussion was in Mobile IP, where related issues were addressed.
What do folks wish the document said? Is this something for the working group to make an effort on? Is there a feeling that it should be a working group draft? 


On May 24, 2006, at 11:56 PM, Vishwas Manral wrote:


Hi Fred,
I thought it was an important enough issue to be addressed, from the operational perspective.
If possible I would want to drive it further. Would be eager to get your views on the same. 

Thanks for restarting the discussion,
Vishwas

On 5/24/06, Fred Baker <fred@cisco.com> wrote:
On May 24, 2006, at 12:02 AM, Vishwas Manral wrote:

> I am not sure the draft http://www.ietf.org/internet-drafts/draft-
> manral-v6ops-tiny-fragments-issues-02.txt is dead. It still exists
> in the IETF repository.

Yes, it is in the repository; it remains until they flush it out.
What I was saying is that discussion seems to be at an end.

What would you like to do with it further? Do you plan to continue
driving this?