June 2020 - NANOG - lists.nanog.org

RE: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs)
by Templin (US), Fred L 01 Jun '20

01 Jun '20

NBMA is not necessarily a one-size-fits-all category, and it looks like multiple proposals are considering models for NBMA links. AERO and OMNI define an NBMA link model for virtual links and do define the operation of IPv6 ND over those links in ways that go beyond RFC5942. This is encouraged in RFC4861 where it says: “Unless specified otherwise (in a document that covers operating IP over a particular link type) this document applies to all link types. However, because ND uses link-layer multicast for some of its services, it is possible that on some link types (e.g., Non-Broadcast Multi-Access (NBMA) links), alternative protocols or mechanisms to implement those services will be specified (in the appropriate document covering the operation of IP over a particular link type).” Fred From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of Pascal Thubert (pthubert) Sent: Monday, June 01, 2020 7:27 AM To: Wes Beebee (wbeebee) <wbeebee=40cisco.com(a)dmarc.ietf.org>; Etienne-Victor Depasquale <edepa(a)ieee.org> Cc: NANOG <nanog(a)nanog.org>; ipv6(a)ietf.org Subject: RE: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs) I take the “there was no NBMA” off, then, Wes, you’re correct. I’ll add a ref to RFC 5942 in section 4.4 that discusses the use of on-link flag. Note that Hub and spoke is a very limited conception of NBMA. Think of an IOT network such as a RPL domain, or a frame relay network with OSPFv2 NBMA / P2MP models. It takes quite a bit more than resetting the on-link flag to enable IPv6 ND on those NBMA networks, though it is indeed necessary. This is what I tried to express too concisely. Keep safe, Pascal PS For NBMA, RFC 4861 clearly says non-broadcast multiple access (NBMA) - Redirect, Neighbor Unreachability Detection and next-hop determination should be implemented as described in this document. Address resolution, and the mechanism for delivering Router Solicitations and Advertisements on NBMA links are not specified in this document. Note that if hosts support manual configuration of a list of default routers, hosts can dynamically acquire the link-layer addresses for their neighbors from Redirect messages. From: Wes Beebee (wbeebee) <wbeebee=40cisco.com(a)dmarc.ietf.org<mailto:wbeebee=40cisco.com@dmarc.ietf.org>> Sent: lundi 1 juin 2020 16:00 To: Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>>; Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> Cc: NANOG <nanog(a)nanog.org<mailto:nanog@nanog.org>>; ipv6(a)ietf.org<mailto:ipv6@ietf.org> Subject: Re: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs) RFC 5942 outlines how NBMA works with Neighbor Discovery. Using this RFC, IPv6 has been deployed in NBMA networks (DOCSIS) with 10 million+ subscribers without any problems. - Wes From: ipv6 <ipv6-bounces(a)ietf.org<mailto:ipv6-bounces@ietf.org>> on behalf of "Pascal Thubert (pthubert)" <pthubert=40cisco.com(a)dmarc.ietf.org<mailto:pthubert=40cisco.com@dmarc.ietf.org>> Date: Sunday, May 31, 2020 at 8:29 AM To: Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> Cc: NANOG <nanog(a)nanog.org<mailto:nanog@nanog.org>>, "ipv6(a)ietf.org<mailto:ipv6@ietf.org>" <ipv6(a)ietf.org<mailto:ipv6@ietf.org>> Subject: Re: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs) Cool, that’s the whole point. With IPv6 ND as defined 20+ years ago there couldn’t be NBMA and there couldn’t be MLSN. We have changed that in IoT and we are now trying to generalize to all types of links. There’s a tentative to get the aforementioned draft adopted at 6MAN. If you found it useful please voice support ! Take care, Pascal Le 31 mai 2020 à 13:11, Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> a écrit : Pascal, thank you, the draft at https://datatracker.ietf.org/doc/draft-thubert-6man-ipv6-over-wireless/ is very informative. You hit the nail on the head with your suggestion of confusion between the congruence of link and subnet. However, I followed one of the references (RFC4903) in your draft and it does not help that it (RFC4903) points to RFC4291's assertion that: "Currently IPv6 continues the IPv4 model that a subnet prefix is associated with one link" RFC4903 further states that: "clearly, the notion of a multi-link subnet would be a change to the existing IP model.". I confess: your assertion in the draft that: "In Route-Over Multi-link subnets (MLSN) [RFC4903], routers federate the links between nodes that belong to the subnet, the subnet is not on-link and it extends beyond any of the federated links" is news to me. Best regards, Etienne On Sat, May 30, 2020 at 1:39 PM Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>> wrote: Hello Etienne Victor Maybe you’re confusing link and a subnet? This is discussed at length here: https://datatracker.ietf.org/doc/draft-thubert-6man-ipv6-over-wireless/ RPL can route inside a subnet using host routes. This is how a multi link subnet can be made to work... Please let me know if the draft above helped and whether it is clear enough. The best way for that discussion would be to cc 6MAN. Keep safe, Pascal Le 30 mai 2020 à 10:03, Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> a écrit : Thank you Carsten, and thank you Pacal. Your replies are valuable and packed with insight. I'll wrap up with how I interpret RPL's behaviour in terms of IP hops. On one hand, RFC6775 defines a route-over topology as follows: "A topology where hosts are connected to the 6LBR through the use of intermediate layer-3 (IP) routing. Here, hosts are typically multiple IP hops away from a 6LBR. The route-over topology typically consists of a 6LBR, a set of 6LRs, and hosts." If RPL is route-over by definition, then RFC6775 would imply that there are typically multiple IP hops between a leaf and the border router. On the other hand, there at least two contradictions (which I justify after stating them): (a) RFC6550 states that "RPL also introduces the capability to bind a subnet together with a common prefix and to route within that subnet." (b) Reduction of a DODAG to a single subnet prefix, albeit only only one parent-child relationship deep, is clearly shown at Contiki-NG's Github page (deep dive section). The hinge on which my understanding revolves is that an IP hop traverses a router and ***results in a change of prefix of the link on which the packet travels*** : --------<incoming packet; link prefix = p1>------><router> --------<outgoing packet; link prefix = p2>------> With RPL, the "hop" would look like as shown below: --------<incoming packet; link prefix = p1>------<router> --------<outgoing packet; link prefix = p1>------ There seems to be a change in the meaning associated with "IP hop". I guess that I can reconcile both cases through the observation that RPL actually does apply to a single, NBMA link and therefore the IP prefix ***is*** the same. Then again, calling the RPL device involved in the packet forwarding by the name "router" feels like an uncomfortable stretch. Don't routers sit at the meeting point of different layer 2 links? Cheers, Etienne On Fri, May 29, 2020 at 10:39 PM Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>> wrote: Hello Etienne You may see ND as the host to * interface for any network and RPL as the router to router interface when the network is NBMA. Some of us cared about the interworking. Look at the RPL Unaware leaf I-draft and you’ll see that I’m sure. Keep safe, Pascal > Le 29 mai 2020 à 20:28, Carsten Bormann <cabo(a)tzi.org<mailto:cabo@tzi.org>> a écrit : > > Hi Etienne, > > I’m also not sure many of the classical network operators assembled in NANOG work with 6LoWPANs today, but I still can answer your question. > >> While trying to build a holistic view of LoWPANs, I'm consulting the IETF's informational and standards documents. >> >> I'm struck by the impression that, despite the significance of RFC6775's extension of Neighbor Discovery(ND) to low-power and lossy networks (LLNs), >> it is largely ignored by RFC6550 (RPL), with little to no reference to the ontological plane created in RFC6775's terminology section. > > Yes, you could say that. > > ND (Neighbor discovery) describes interfaces between hosts and between hosts and routers. > 6LoWPAN-ND does not use host-to-host interfaces (different from Ethernet, all traffic goes over routers, which RFC 4861 already forsaw in the L — on-link — bit, which isn’t set in 6LoWPAN-ND). > > RFC 6550 was completed at a time when many people who came in from the WSN (wireless sensor network) world thought they could get away with a network that is wholly composed of routers. > Even the “leaf” nodes in the RPL world were participating in the routing protocol and therefore didn’t really need a host-router interface. There was no separate host-router interface in that world, because there were no non-router hosts. > >> (a) router advertisements and router solicitations are substituted by DAG information objects (DIO) and DAG information solicitations (DIS) > > Right, DIO and DAO are router-to-router messages. If there are no hosts (and routers don’t bootstrap themselves as hosts), you don’t need ND. > >> (b) the terms "mesh-under" and "route-over" (widely cited), defined in RFC6775, are absent from RFC6550 > > RFC6550 is route over by definition. Actually, the term was coined by the people working closely with the RPL development; RFC 6775 does appropriate it as 6LoWPAN-ND is applicable in either case. > >> (c) jarringly: RFC6775 describes the route-over topologies as multi-IP-hop, while RFC6550 gathers DODAG nodes within the confines of the same IPv6 prefix as their border router - no multiple IP hops. > > I’m not sure where you get this interpretation: RFC 6550 (RPL) is very much about IP hops. > Maybe you mean the address architecture that was defined explicitly in RFC 6775; RFC 6550 does not really say much about addresses. > > Note that the RPL people have since proceeded to (at least partially) embrace the host-router concept from the IP architecture; RFC 8505 is an update to RFC 6775 that makes 6LoWPAN-ND more palatable to RPL people. > > I have CCed Pascal Thubert who, as a co-author to all three RFCs, certainly will have another perspective on this. > > Grüße, Carsten > -- Ing. Etienne-Victor Depasquale Assistant Lecturer Department of Communications & Computer Engineering Faculty of Information & Communication Technology University of Malta Web. https://www.um.edu.mt/profile/etiennedepasquale -- Ing. Etienne-Victor Depasquale Assistant Lecturer Department of Communications & Computer Engineering Faculty of Information & Communication Technology University of Malta Web. https://www.um.edu.mt/profile/etiennedepasquale

1 0

FW: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs)
by Pascal Thubert (pthubert) 01 Jun '20

01 Jun '20

I take the “there was no NBMA” off, then, Wes, you’re correct. I’ll add a ref to RFC 5942 in section 4.4 that discusses the use of on-link flag. Note that Hub and spoke is a very limited conception of NBMA. Think of an IOT network such as a RPL domain, or a frame relay network with OSPFv2 NBMA / P2MP models. It takes quite a bit more than resetting the on-link flag to enable IPv6 ND on those NBMA networks, though it is indeed necessary. This is what I tried to express too concisely. Keep safe, Pascal PS For NBMA, RFC 4861 clearly says non-broadcast multiple access (NBMA) - Redirect, Neighbor Unreachability Detection and next-hop determination should be implemented as described in this document. Address resolution, and the mechanism for delivering Router Solicitations and Advertisements on NBMA links are not specified in this document. Note that if hosts support manual configuration of a list of default routers, hosts can dynamically acquire the link-layer addresses for their neighbors from Redirect messages. From: Wes Beebee (wbeebee) <wbeebee=40cisco.com(a)dmarc.ietf.org<mailto:wbeebee=40cisco.com@dmarc.ietf.org>> Sent: lundi 1 juin 2020 16:00 To: Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>>; Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> Cc: NANOG <nanog(a)nanog.org<mailto:nanog@nanog.org>>; ipv6(a)ietf.org<mailto:ipv6@ietf.org> Subject: Re: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs) RFC 5942 outlines how NBMA works with Neighbor Discovery. Using this RFC, IPv6 has been deployed in NBMA networks (DOCSIS) with 10 million+ subscribers without any problems. * Wes From: ipv6 <ipv6-bounces(a)ietf.org<mailto:ipv6-bounces@ietf.org>> on behalf of "Pascal Thubert (pthubert)" <pthubert=40cisco.com(a)dmarc.ietf.org<mailto:pthubert=40cisco.com@dmarc.ietf.org>> Date: Sunday, May 31, 2020 at 8:29 AM To: Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> Cc: NANOG <nanog(a)nanog.org<mailto:nanog@nanog.org>>, "ipv6(a)ietf.org<mailto:ipv6@ietf.org>" <ipv6(a)ietf.org<mailto:ipv6@ietf.org>> Subject: Re: RFC6550 (RPL) and RFC6775 (IPv6 Neighbor Discovery for 6LoWPANs) Cool, that’s the whole point. With IPv6 ND as defined 20+ years ago there couldn’t be NBMA and there couldn’t be MLSN. We have changed that in IoT and we are now trying to generalize to all types of links. There’s a tentative to get the aforementioned draft adopted at 6MAN. If you found it useful please voice support ! Take care, Pascal Le 31 mai 2020 à 13:11, Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> a écrit : Pascal, thank you, the draft at https://datatracker.ietf.org/doc/draft-thubert-6man-ipv6-over-wireless/ is very informative. You hit the nail on the head with your suggestion of confusion between the congruence of link and subnet. However, I followed one of the references (RFC4903) in your draft and it does not help that it (RFC4903) points to RFC4291's assertion that: "Currently IPv6 continues the IPv4 model that a subnet prefix is associated with one link" RFC4903 further states that: "clearly, the notion of a multi-link subnet would be a change to the existing IP model.". I confess: your assertion in the draft that: "In Route-Over Multi-link subnets (MLSN) [RFC4903], routers federate the links between nodes that belong to the subnet, the subnet is not on-link and it extends beyond any of the federated links" is news to me. Best regards, Etienne On Sat, May 30, 2020 at 1:39 PM Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>> wrote: Hello Etienne Victor Maybe you’re confusing link and a subnet? This is discussed at length here: https://datatracker.ietf.org/doc/draft-thubert-6man-ipv6-over-wireless/ RPL can route inside a subnet using host routes. This is how a multi link subnet can be made to work... Please let me know if the draft above helped and whether it is clear enough. The best way for that discussion would be to cc 6MAN. Keep safe, Pascal Le 30 mai 2020 à 10:03, Etienne-Victor Depasquale <edepa(a)ieee.org<mailto:edepa@ieee.org>> a écrit : Thank you Carsten, and thank you Pacal. Your replies are valuable and packed with insight. I'll wrap up with how I interpret RPL's behaviour in terms of IP hops. On one hand, RFC6775 defines a route-over topology as follows: "A topology where hosts are connected to the 6LBR through the use of intermediate layer-3 (IP) routing. Here, hosts are typically multiple IP hops away from a 6LBR. The route-over topology typically consists of a 6LBR, a set of 6LRs, and hosts." If RPL is route-over by definition, then RFC6775 would imply that there are typically multiple IP hops between a leaf and the border router. On the other hand, there at least two contradictions (which I justify after stating them): (a) RFC6550 states that "RPL also introduces the capability to bind a subnet together with a common prefix and to route within that subnet." (b) Reduction of a DODAG to a single subnet prefix, albeit only only one parent-child relationship deep, is clearly shown at Contiki-NG's Github page (deep dive section). The hinge on which my understanding revolves is that an IP hop traverses a router and ***results in a change of prefix of the link on which the packet travels*** : --------<incoming packet; link prefix = p1>------><router> --------<outgoing packet; link prefix = p2>------> With RPL, the "hop" would look like as shown below: --------<incoming packet; link prefix = p1>------<router> --------<outgoing packet; link prefix = p1>------ There seems to be a change in the meaning associated with "IP hop". I guess that I can reconcile both cases through the observation that RPL actually does apply to a single, NBMA link and therefore the IP prefix ***is*** the same. Then again, calling the RPL device involved in the packet forwarding by the name "router" feels like an uncomfortable stretch. Don't routers sit at the meeting point of different layer 2 links? Cheers, Etienne On Fri, May 29, 2020 at 10:39 PM Pascal Thubert (pthubert) <pthubert(a)cisco.com<mailto:pthubert@cisco.com>> wrote: Hello Etienne You may see ND as the host to * interface for any network and RPL as the router to router interface when the network is NBMA. Some of us cared about the interworking. Look at the RPL Unaware leaf I-draft and you’ll see that I’m sure. Keep safe, Pascal > Le 29 mai 2020 à 20:28, Carsten Bormann <cabo(a)tzi.org<mailto:cabo@tzi.org>> a écrit : > > Hi Etienne, > > I’m also not sure many of the classical network operators assembled in NANOG work with 6LoWPANs today, but I still can answer your question. > >> While trying to build a holistic view of LoWPANs, I'm consulting the IETF's informational and standards documents. >> >> I'm struck by the impression that, despite the significance of RFC6775's extension of Neighbor Discovery(ND) to low-power and lossy networks (LLNs), >> it is largely ignored by RFC6550 (RPL), with little to no reference to the ontological plane created in RFC6775's terminology section. > > Yes, you could say that. > > ND (Neighbor discovery) describes interfaces between hosts and between hosts and routers. > 6LoWPAN-ND does not use host-to-host interfaces (different from Ethernet, all traffic goes over routers, which RFC 4861 already forsaw in the L — on-link — bit, which isn’t set in 6LoWPAN-ND). > > RFC 6550 was completed at a time when many people who came in from the WSN (wireless sensor network) world thought they could get away with a network that is wholly composed of routers. > Even the “leaf” nodes in the RPL world were participating in the routing protocol and therefore didn’t really need a host-router interface. There was no separate host-router interface in that world, because there were no non-router hosts. > >> (a) router advertisements and router solicitations are substituted by DAG information objects (DIO) and DAG information solicitations (DIS) > > Right, DIO and DAO are router-to-router messages. If there are no hosts (and routers don’t bootstrap themselves as hosts), you don’t need ND. > >> (b) the terms "mesh-under" and "route-over" (widely cited), defined in RFC6775, are absent from RFC6550 > > RFC6550 is route over by definition. Actually, the term was coined by the people working closely with the RPL development; RFC 6775 does appropriate it as 6LoWPAN-ND is applicable in either case. > >> (c) jarringly: RFC6775 describes the route-over topologies as multi-IP-hop, while RFC6550 gathers DODAG nodes within the confines of the same IPv6 prefix as their border router - no multiple IP hops. > > I’m not sure where you get this interpretation: RFC 6550 (RPL) is very much about IP hops. > Maybe you mean the address architecture that was defined explicitly in RFC 6775; RFC 6550 does not really say much about addresses. > > Note that the RPL people have since proceeded to (at least partially) embrace the host-router concept from the IP architecture; RFC 8505 is an update to RFC 6775 that makes 6LoWPAN-ND more palatable to RPL people. > > I have CCed Pascal Thubert who, as a co-author to all three RFCs, certainly will have another perspective on this. > > Grüße, Carsten > -- Ing. Etienne-Victor Depasquale Assistant Lecturer Department of Communications & Computer Engineering Faculty of Information & Communication Technology University of Malta Web. https://www.um.edu.mt/profile/etiennedepasquale -- Ing. Etienne-Victor Depasquale Assistant Lecturer Department of Communications & Computer Engineering Faculty of Information & Communication Technology University of Malta Web. https://www.um.edu.mt/profile/etiennedepasquale

1 0

AS hijacking (Philosophy, rants, GeoMind)
by Justin Wilson (Lists) 01 Jun '20

01 Jun '20

One of the companies I work for recently had an issue with AS 2 (University of Delaware) hijacking a prefix. Due to Origin AS, good upstreams, and the like this has not really affected the traffic to the legit blocks. However, GeoMind picked this up almost immediately it seems. The IP blocks when you go to speedtest.net come back to the university of Delaware. This seems to be the only issue at the moment so we are working through contacting the peers of AS2 and asking them to look into this. We had also contacted University of Delaware. Here is where the philosophy comes into play. The very terse e-mail we received back was basically “As2 gets hijacked a lot and it’s not our problem”. So my question for the NANOG folks. At what point do you say “it’s not your problem” when it involves your ASN? Rant I almost always have issues with GeoMind and others when it comes to IP space. Several of my folks have received allocations from Arin in March. A few are still fighting with geolocation stuff with a few of the providers. So why does GeoMind atomically accept a hijacked prefix as correct? All the right boxes have been ticked. Origin Validiation, registry sets, etc. Happy Friday! Justin Wilson j2sw(a)mtin.net — https://j2sw.com - All things jsw (AS209109) https://blog.j2sw.com - Podcast and Blog

7 7