Operational Neighbor Discovery Problems

Abstract

In IPv4, subnets are generally small, made just large enough to cover the actual number of machines on the subnet.

Virtual Subnet: A BGP/MPLS IP VPN-Based Subnet Extension Solution

“…Meanwhile, since security issues associated with the NDP are inherited due to the use of NDP proxy, those security considerations and recommendations as described in [RFC6583] are applicable to this document as well.…”

Analysis of the 64-bit Boundary in IPv6 Addressing

“…It should be noted that several other mitigations of the ND cache attack are described in [RFC6583], and that limiting the size of the cache and the number of incomplete entries allowed would also defeat the attack. For the specific case of a point-to-point link between routers, this attack is indeed mitigated by a /127 prefix [RFC6164].…”

“…Denial-of-service attacks related to Neighbor Discovery are discussed in Section 3.4 and in [RFC6583]. One of the mitigations suggested by that document is "sizing subnets to reflect the number of addresses actually in use", but the fact that this greatly simplifies scanning attacks is not noted.…”

Enterprise IPv6 Deployment Guidelines

“…The potential NDP cache exhaustion attack (see [RFC6583] as a packet for a random destination will be dropped and will never trigger a neighbor resolution.…”