Subject: RE: Questions on draft-ietf-isis-igp-p2p-over-lan-01.txt

From: Jeff Parker <[email-masked]>
Date: Sat, 15 Mar 2003 18:07:20 -0500

> > B)  Is it the problem of getting the MAC address 
> > itself?  If so, did you consider adding a TLV 
> > to the hello that include your MAC?
> 
> Yes--and we did consider that. On the other hand, 
> we decided there are so many other good ways of 
> getting this information, there didn't seem to be
> any point in adding such a tlv.

My memory is that this topic takes up more space
in the draft than any other.  That often 
translates into lots of questions.  But the
techniques you describe certainly cover the problem.  

> > C) Although you have ruled this out in the 
> > algorithm you describe, someone is bound to 
> > try dynamic configuration, by sending 
> > both LAN and P2P packets ...

> {Prohibiting that] could be added, I think.

Great.  

> > D) Does a 3rd rogue router operating on a LAN and 
> > "capturing" the adjacency from one or both of the 
> > 2 'real' routers constitute a new Security Threat?
> 
> I don't think so, any more than on a "normal" network.
> 
> Russ

Naiming Shen made the same observation.  However,
unlike proxy ARP or sending bogus packets, there
is little evidence of the hack:  No complaints from 
ARP, no traps from the fooled router.  (I'll call this 
"the second router" with the attacker being the 
first.)  The second router just drops the 
packets from the third router.  

The third router does have "evidence" that 
the configuration doesn't match the network,
modulo the comments about point C.
Perhaps we could add a notification that
says something like

	"Evidence of 3rd P2P IS on P2P network"

This could be edge-triggered so that it is 
only sent once per router per circuit.

This should be sent by the second router as 
well as the third, as we may have just shut
the third router out of the network, so it 
is unable to reach the management station. 
If a router wiht an adjacency gets a P2P 
hello that matches any appropriate filters 
(VLAN, matching area for L1 interfaces or 
routers) then it should register a notification 
before dropping the packet.  

I'd be happy to add such a notification to
the MIB, should you decide to call for it
here.

- jeff parker