Re: IPv6 Router Advertisement Option for NTP Server Configuration

2011-12-23 Thread Doug Barton
On 12/21/2011 15:52, Bhatia, Manav (Manav) wrote: Hi Doug, Sort of surprised that no one else has responded so far, but I'll bite. Quite simply, no. Slightly less simply, use DHCP since that's what it's for. I wish it were this simple. Well good news for you then, it IS that simple.

I-D Action: draft-ietf-6man-udpzero-05.txt

2011-12-23 Thread internet-drafts
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IPv6 Maintenance Working Group of the IETF. Title : IPv6 UDP Checksum Considerations Author(s) : Godred Fairhurst Magnus

Re: Fragmentation-related security issues

2011-12-23 Thread Florian Weimer
* Fernando Gont: Hello, Florian, On 12/20/2011 07:00 AM, Florian Weimer wrote: cut here IPv6 allows packets to contain a Fragment Header, without the packet being actually fragmented into multiple pieces. Such packets typically result from hosts that have received an

Re: draft-ietf-6man-rpl-routing-header-07

2011-12-23 Thread Robert Cragie
Hi Jonathan, Some comments and questions below. Robert On 22/12/2011 6:02 PM, Jonathan Hui wrote: On Dec 22, 2011, at 9:24 AM, Mukul Goyal wrote: Again, just because you received a message on an interface for which you've enabled RPL doesn't mean you know the message came from a router

Re: draft-ietf-6man-rpl-routing-header-07

2011-12-23 Thread Mukul Goyal
If a packet, carrying an SRH, is received over an interface not in RPL domain, it is discarded. Thus, an attack may only be mounted within an RPL domain. Also, a packet, carrying an SRH, cant be sent over an interface not in RPL domain. So, any attack can not propagate beyond the RPL domain.

Re: draft-ietf-6man-rpl-routing-header-07

2011-12-23 Thread Jonathan Hui (johui)
To alleviate some of the usual security concerns with source routing, we want to limit the scope if where attacks can be initiated. Any outside attacker can fabricate a SRH and send it to a RPL router. How do you prevent that without some way of limiting the scope? Also, Mukul's proposal is

Re: IPv6 Router Advertisement Option for NTP Server Configuration

2011-12-23 Thread Brian E Carpenter
On 12/21/2011 15:52, Bhatia, Manav (Manav) wrote: ... Today, we can get NTP server information only with DHCP. DHCP only works after RAs have been processed. In some environments (mobile IPv6) delays in acquiring NTP and other servers information is critical and waiting for DHCP to come up