On 13-jun-2006, at 21:52, Fred Baker wrote:
The real value in this document, besides suggesting appropriate
firewall configurations, is in the lines of reasoning presented for
the configuration elements. For example, a router solicitation by
definition travels from a host seeking a first hop router to a system
that it is directly connected to at a lower layer such as a wired or
wireless Ethernet. The document recommends that this class of message
never be forwarded, and one in fact hopes that not only would it not
be forwarded, but that the originator would set TTL=1 to prevent the
occurrence even if the router were misconfigured.
RFC 2461:
6.1.1. Validation of Router Solicitation Messages
Hosts MUST silently discard any received Router Solicitation
Messages.
A router MUST silently discard any received Router Solicitation
messages that do not satisfy all of the following validity checks:
- The IP Hop Limit field has a value of 255, i.e., the packet
could not possibly have been forwarded by a router.
Although the document mentions using the hop limit at 255 as a
security feature, I think this could be more prominent, as it may give
people a reason to forego some or even all ICMPv6 filtering.
As such, the document collects a fair bit of wisdom from which the
unschooled can learn.
You're making me bite my tongue here, Fred...