The Fear And Loathing Of /64s On Point-To-Point Links
Posted by
Jeff Doyle
October 04, 2011
But there is an easier way to prevent these neighbor cache depletion attacks. Only point-to-point Ethernet links should have the capability to support NDP (a protocol designed for use on LANs). So the solution is to simply disable NDP on point-to-point Ethernet links.
So. Use of /127s on point-to-point links violates recommended IPv6 subnet usage. They put a band-aid on an obsolete version of ICMPv6 so that some vendors do not have to modernize their code. They prevent neighbor cache depletion attacks, but disabling NDP on point-to-point Ethernet links is a simpler prevention of those attacks.
Which brings us back around to using /127s for address conservation. And we’ve seen already that the reasoning for this when we are happily wasting just as many addresses on LANs with /64 addresses is shaky reasoning.
All in all, I don’t have strong convictions against using /127s on point-to-point links. /127s on point-to-points and /64 on everything else is still comfortably close to one-size-fits-all. I tell my clients the pros and cons I’ve presented here, and emphasize that the supposed address conservation achieved with /127s is illusory and based on shaky logic. If they insist on using them anyway, well, okay. I’m fine with that.
But there is one prefix that you should not use.
What About /126?
Page: « Previous Page | 1 | 2 | 3 | 4 | 5 | Next Page »
