Re: [ipv6] Re: /64 ND DoS

2011-07-13 Thread Jared Mauch
On Jul 13, 2011, at 4:11 AM, Mikael Abrahamsson wrote: > On Wed, 13 Jul 2011, Ray Hunter wrote: > >> So where's the limit for ND and prefix length on today's implementations and >> platforms? > > Todays L3 switches typically have an ND/ARP table size limitations in the > 1-4k entry range. >

Re: [ipv6] Re: /64 ND DoS

2011-07-13 Thread Philip Homburg
In your letter dated Wed, 13 Jul 2011 01:47:32 +0200 you wrote: >But EUI-48 itself has a not-very-well-published sub-structure of a >"manufacturer's IEEE-assigned company_id" and a "manufacturer-selected >extension identifier" > >What if SLAAC was (temporarily) redefined to build EUI-64 identifie

Re: [ipv6] Re: /64 ND DoS

2011-07-13 Thread Mikael Abrahamsson
On Wed, 13 Jul 2011, Ray Hunter wrote: So where's the limit for ND and prefix length on today's implementations and platforms? Todays L3 switches typically have an ND/ARP table size limitations in the 1-4k entry range. What if SLAAC was limited to using 20 bits or even just 16 bits of MAC

Re: [ipv6] Re: /64 ND DoS

2011-07-13 Thread Ray Hunter
Florian Weimer wrote: * Ray Hunter: Are 2^24 interface identifiers small enough that every implementation could simply provide enough resources (for ND) to cope with all addresses being in play simultaneously? You'd need per-interface and per-VLAN tables. I don't think that's feasi

Re: [ipv6] Re: /64 ND DoS

2011-07-13 Thread Florian Weimer
* Ray Hunter: > Are 2^24 interface identifiers small enough that every implementation > could simply provide enough resources (for ND) to cope with all > addresses being in play simultaneously? You'd need per-interface and per-VLAN tables. I don't think that's feasible. -- Florian Weimer

[ipv6] Re: /64 ND DoS

2011-07-12 Thread Ray Hunter
Message: 9 Date: Tue, 12 Jul 2011 13:50:16 -0400 From: Jared Mauch To: Philip Homburg Cc:ipv6@ietf.org Subject: Re: /64 ND DoS Message-ID: Content-Type: text/plain; charset=us-ascii I think this needs to be refined, hence the feedback process via the community here. I think sending to all-rout