<div dir="ltr">On Fri, Jan 31, 2014 at 2:07 PM, Ole Troan <span dir="ltr"><<a href="mailto:ot@cisco.com" target="_blank">ot@cisco.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">>> Consensus around here is that we support DHCPv6 for non-/64 subnets<br>
>> (particularly in the context of Prefix Delegation), but the immediate<br>
>> next question is "Why would you need that?"<br>
><br>
> /64 netmask opens up nd cache exhaustion as a DoS vector.<br>
<br>
</div>FUD.<br>
<br></blockquote><div><br></div><div>Hi Ole,</div><div><br></div><div>I personnally verified that this type of attack works with at least one major firewall vendor, provided you know/guess reasonably well the network behind it. (I'm not implying that this is a widespread attack type).</div>
<div><br></div><div>I also found this paper: <a href="http://inconcepts.biz/~jsw/IPv6_NDP_Exhaustion.pdf">http://inconcepts.biz/~jsw/IPv6_NDP_Exhaustion.pdf</a></div><div><br></div><div>I'm looking for other information sources, do you know other papers dealing with this problem ? Why do you think this is FUD ?</div>
</div><div><br></div><div>Thanks,</div>-- <br>Aurélien Guillaume<div><br></div>
</div></div>