On 04/14/2012 12:30 PM, Tim Chown wrote: > I while ago I put this one forward, which is an alternative to > Fernando's suggestion that you have to set the whole address: > > http://tools.ietf.org/html/draft-chown-6man-tokenised-ipv6-identifiers-00 > > This was based on existing implementations, in Solaris and Linux (as > a demonstrator), with the potential for simpler renumbering in mind.
Does this really help renumbering? e.g., if you have ACLs, they are based on the whole IPv6 address, rather than on the IID... > It's probably the complete antithesis of what Fernando is trying to > achieve, but is aimed at the type of (server) systems that would > probably be DNS-advertised anyway. Note that having an address advertised in the DNS does not necessarily means that predictable addresses are not useful to an attacker. For example, let's assume that you know that a network link hosts 100 different servers, each with a different domain. If their addresses are not predictable, and the attacker wants to find all of them, he may have to rely on a "dictionary" attack. However, if the addresses *are* predictable, he could just sweep the interested part of the address space. Note: I still don't understand the use case for this technology, or how the IIDs would be selected (but since they seem to be manually-generated, I'd expect them to be "low-byte", such as ::1, ::2, etc.). Thanks! Best regards, -- Fernando Gont SI6 Networks e-mail: fg...@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 -------------------------------------------------------------------- IETF IPv6 working group mailing list ipv6@ietf.org Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
