RFC6583 - Operational Neighbor Discovery Problems
Venue
IETF RFCs, Internet Engineering Task Force (2012)
Publication Year
2012
Authors
Warren Kumari, Igor Gashinsky, Yahoo!, Joel Jaeggli, Zynga
BibTeX
Abstract
In IPv4, subnets are generally small, made just large enough to cover the actual
number of machines on the subnet. In contrast, the default IPv6 subnet size is a
/64, a number so large it covers trillions of addresses, the overwhelming number of
which will be unassigned. Consequently, simplistic implementations of Neighbor
Discovery (ND) can be vulnerable to deliberate or accidental denial of service
(DoS), whereby they attempt to perform address resolution for large numbers of
unassigned addresses. Such denial-of-service attacks can be launched intentionally
(by an attacker) or result from legitimate operational tools or accident
conditions. As a result of these vulnerabilities, new devices may not be able to
"join" a network, it may be impossible to establish new IPv6 flows, and existing
IPv6 transported flows may be interrupted.
This document describes the potential for DoS in detail and suggests possible implementation improvements as well as operational mitigation techniques that can, in some cases, be used to protect against or at least alleviate the impact of such attacks.
