[ipv6hackers] New IETF I-D on IPv6 smurf amplifiers

[Fernando Gont]

On 12/15/2011 12:05 PM, Gert Doering wrote:
>>> BCP38.  Smurf yourself.
>>
>> Do you argue that BCP38 is deployed in 100% of cases or that
>> implementations of BCP38 have never been found to fail?
>>
>> Are you arguing that the proposal is nonsensical?
> 
> None of that.  I'm argueing that BCP38 will stop these attacks cold,
> and thus another reason to deploy BCP38 has been found.

Your comment didn't come across like that.



>> And/or maybe you should take the red pill before flaming?
>> (http://en.wikipedia.org/wiki/Red_pill_and_blue_pill)
> 
> If someone felt flamed by my e-mail, you're certainly welcome.  It wasn't
> written as such, but in the cold months, warmth is usually appreciated :-)
> 
> "BCP38. Smurf yourself" == "with BCP 38 deployed in enough places, all
> you can achieve with such a reflection attack is a DoS against yourself,
> and there are easier ways to take yourself offline, like 'power down
> your DSL router'".  Easier to understand?

"your point is better explained", I'd say. But as noted, for this
particular attack vector you do not need to rely on BCP 38 being
deployed and correctly implemented. The "fix" proposed in this I-D is
rather orthogonal to BCP38 -- even when BCP38 is your friend.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont at si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492