draft-ietf-dna-simple-17.txt   rfc6059.txt 
Network Working Group S. Krishnan Internet Engineering Task Force (IETF) S. Krishnan
Internet-Draft Ericsson Request for Comments: 6059 Ericsson
Intended status: Standards Track G. Daley Category: Standards Track G. Daley
Expires: February 26, 2011 NetStar Networks ISSN: 2070-1721 Netstar Logicalis
August 25, 2010 November 2010
Simple procedures for Detecting Network Attachment in IPv6 Simple Procedures for Detecting Network Attachment in IPv6
draft-ietf-dna-simple-17
Abstract Abstract
Detecting Network Attachment allows hosts to assess if its existing Detecting Network Attachment allows hosts to assess if its existing
addressing or routing configuration is valid for a newly connected addressing or routing configuration is valid for a newly connected
network. This document provides simple procedures for detecting network. This document provides simple procedures for Detecting
network attachment in IPv6 hosts, and procedures for routers to Network Attachment in IPv6 hosts, and procedures for routers to
support such services. support such services.
Status of this Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering This is an Internet Standards Track document.
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
This Internet-Draft will expire on February 26, 2011. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6059.
Copyright Notice Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Requirements notation . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Goals . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. Goals . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Applicability . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Applicability . . . . . . . . . . . . . . . . . . . . . . 4 1.3. Link Identification Model . . . . . . . . . . . . . . . . 4
2.3. Link Identification model . . . . . . . . . . . . . . . . 4 1.4. DNA Overview . . . . . . . . . . . . . . . . . . . . . . . 4
2.4. DNA Overview . . . . . . . . . . . . . . . . . . . . . . . 4 1.5. Working Assumptions . . . . . . . . . . . . . . . . . . . 5
2.5. Working Assumptions . . . . . . . . . . . . . . . . . . . 5 2. Requirements Notation . . . . . . . . . . . . . . . . . . . . 5
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6
4. The Simple DNA Address Table (SDAT) . . . . . . . . . . . . . 7 4. The Simple DNA Address Table (SDAT) . . . . . . . . . . . . . 7
5. Host Operations . . . . . . . . . . . . . . . . . . . . . . . 7 5. Host Operations . . . . . . . . . . . . . . . . . . . . . . . 7
5.1. On receipt of a Router Advertisement . . . . . . . . . . . 7 5.1. On Receipt of a Router Advertisement . . . . . . . . . . . 7
5.2. After assignment of a DHCPv6 address . . . . . . . . . . . 8 5.2. After Assignment of a DHCPv6 Address . . . . . . . . . . . 8
5.3. Steps involved in detecting link change . . . . . . . . . 8 5.3. Steps Involved in Detecting Link Change . . . . . . . . . 8
5.4. Link-Layer Indication . . . . . . . . . . . . . . . . . . 8 5.4. Link-Layer Indication . . . . . . . . . . . . . . . . . . 8
5.5. Sending Neighbor Discovery probes . . . . . . . . . . . . 9 5.5. Sending Neighbor Discovery probes . . . . . . . . . . . . 9
5.5.1. Sending Router Solicitations . . . . . . . . . . . . . 9 5.5.1. Sending Router Solicitations . . . . . . . . . . . . . 9
5.5.2. Sending Neighbor Solicitations . . . . . . . . . . . . 9 5.5.2. Sending Neighbor Solicitations . . . . . . . . . . . . 9
5.5.3. Concurrent sending of RS and NS probes . . . . . . . . 9 5.5.3. Concurrent Sending of RS and NS Probes . . . . . . . . 9
5.5.4. Initiating DHCPv6 exchange . . . . . . . . . . . . . . 9 5.5.4. Initiating DHCPv6 Exchange . . . . . . . . . . . . . . 9
5.6. Contents of the Neighbor Discovery messages . . . . . . . 11 5.6. Contents of the Neighbor Discovery Messages . . . . . . . 10
5.6.1. Neighbor Solicitation messages . . . . . . . . . . . . 11 5.6.1. Neighbor Solicitation Messages . . . . . . . . . . . . 10
5.6.2. Router Solicitation messages . . . . . . . . . . . . . 11 5.6.2. Router Solicitation Messages . . . . . . . . . . . . . 10
5.7. Response Gathering . . . . . . . . . . . . . . . . . . . . 12 5.7. Response Gathering . . . . . . . . . . . . . . . . . . . . 11
5.7.1. Receiving Neighbor Advertisements . . . . . . . . . . 12 5.7.1. Receiving Neighbor Advertisements . . . . . . . . . . 11
5.7.2. Receiving Router Advertisements . . . . . . . . . . . 12 5.7.2. Receiving Router Advertisements . . . . . . . . . . . 11
5.7.3. Conflicting results . . . . . . . . . . . . . . . . . 12 5.7.3. Conflicting Results . . . . . . . . . . . . . . . . . 11
5.8. Further Host Operations . . . . . . . . . . . . . . . . . 12 5.8. Further Host Operations . . . . . . . . . . . . . . . . . 11
5.9. On connecting to a new point of attachment . . . . . . . . 13 5.9. On Connecting to a New Point of Attachment . . . . . . . . 12
5.10. Periodic Maintenance of the SDAT . . . . . . . . . . . . . 13 5.10. Periodic Maintenance of the SDAT . . . . . . . . . . . . . 12
5.11. Recommended retransmission behavior . . . . . . . . . . . 13 5.11. Recommended Retransmission Behavior . . . . . . . . . . . 12
6. Pseudocode for Simple DNA . . . . . . . . . . . . . . . . . . 15 6. Pseudocode for Simple DNA . . . . . . . . . . . . . . . . . . 13
7. Constants . . . . . . . . . . . . . . . . . . . . . . . . . . 16 7. Constants . . . . . . . . . . . . . . . . . . . . . . . . . . 15
8. Relationship to DNAv4 . . . . . . . . . . . . . . . . . . . . 17 8. Relationship to DNAv4 . . . . . . . . . . . . . . . . . . . . 15
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 9. Security Considerations . . . . . . . . . . . . . . . . . . . 15
10. Security Considerations . . . . . . . . . . . . . . . . . . . 17 10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16
11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 18 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17
12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18 11.1. Normative References . . . . . . . . . . . . . . . . . . . 17
12.1. Normative References . . . . . . . . . . . . . . . . . . . 18 11.2. Informative References . . . . . . . . . . . . . . . . . . 17
12.2. Informative References . . . . . . . . . . . . . . . . . . 19 Appendix A. Issues with Confirming Manually Assigned Addresses . 18
Appendix A. Issues with confirming manually assigned addresses . 19
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 20
1. Requirements notation
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
2. Introduction 1. Introduction
Hosts require procedures to simply and reliably identify if they have Hosts require procedures to simply and reliably identify if they have
moved to a network to which they had been recently connected. In moved to a network to which they had been recently connected. In
order to detect reconnection to a previously visited network, router order to detect reconnection to a previously visited network, router
and neighbor discovery messages are used to collect reachability and and neighbor discovery messages are used to collect reachability and
configuration information. This information is used to detect if the configuration information. This information is used to detect if the
host has attached to a link for which it may still have valid address host has attached to a link for which it may still have valid address
and other configuration information, and which it can use until it and other configuration information, and which it can use until it
receives confirmation through either through the Neighbor Discovery receives confirmation through either the Neighbor Discovery protocol
protocol or DHCPv6. or DHCPv6.
This document incorporates feedback from host and router operating This document incorporates feedback from host and router operating
systems implementors, which seeks to make implementation and adoption systems implementors, which seeks to make implementation and adoption
of IPv6 change detection procedures simple for general use. of IPv6 change detection procedures simple for general use.
2.1. Goals 1.1. Goals
The goal of this document is to specify a simple procedure for The goal of this document is to specify a simple procedure for
detecting network attachment (Simple DNA) that has the following Detecting Network Attachment (Simple DNA) that has the following
characteristics. characteristics.
o Routers do not have to be modified to support this scheme. o Routers do not have to be modified to support this scheme.
o The most common use cases are optimized. o The most common use cases are optimized.
o In the worst case, detection latency is equal to that of standard o In the worst case, detection latency is equal to that of standard
neighbor discovery so that performance is never degraded. neighbor discovery so that performance is never degraded.
o False positives are not acceptable. A host must not wrongly o False positives are not acceptable. A host must not wrongly
conclude that it has reattached to a previouly visited network. conclude that it has reattached to a previously visited network.
o False negatives are acceptable. A host may fail to identify a o False negatives are acceptable. A host may fail to identify a
previously visited link correctly and attempt to acquire fresh previously visited link correctly and attempt to acquire fresh
addressing and configuration information. addressing and configuration information.
2.2. Applicability 1.2. Applicability
The Simple DNA protocol provides substantial benefits over standard The Simple DNA protocol provides substantial benefits over standard
neighbor discovery procedures [RFC4861] in some scenarios and does neighbor discovery procedures [RFC4861] in some scenarios and does
not provide any benefit at all in certain other scenarios. This is not provide any benefit at all in certain other scenarios. This is
intentional as Simple DNA was designed for simplicity rather than intentional as Simple DNA was designed for simplicity rather than
completeness. In particular, the Simple DNA protocol provides completeness. In particular, the Simple DNA protocol provides
maximum benefits when a host moves between a small set of known maximum benefits when a host moves between a small set of known
links. When a host moves to a completely new link that is previously links. When a host moves to a completely new link that is previously
unknown, the performance of the Simple DNA protocol will be identical unknown, the performance of the Simple DNA protocol will be identical
to that using standard neighbor discovery procedures [RFC4861]. In to that using standard neighbor discovery procedures [RFC4861]. In
this case the main benefit of the Simple DNA protocol is to this case, the main benefit of the Simple DNA protocol is to
immediately flush out the inoperable addresses and configuration immediately flush out the inoperable addresses and configuration
instead of timing them out. The Simple DNA procedure provides instead of timing them out. The Simple DNA procedure provides
support for addresses configured using either IPv6 Stateless Address support for addresses configured using either IPv6 Stateless Address
Autoconfiguration [RFC4862] or DHCPv6 [RFC3315]. It does not support Autoconfiguration [RFC4862] or DHCPv6 [RFC3315]. It does not support
manually configured addresses since they are not widely used and can manually configured addresses since they are not widely used and can
cause unpredictable results and/or aggressive probing behavior cause unpredictable results and/or aggressive probing behavior (see
[Appendix A]. Appendix A).
2.3. Link Identification model 1.3. Link Identification Model
Earlier methods of detecting network attachment, e.g. the procedure Earlier methods of Detecting Network Attachment, e.g., the procedure
defined in [I-D.ietf-dna-protocol], relied on detecting whether the defined in [DNA-PROTOCOL], relied on detecting whether the host was
host was still connected to the same link. If the host was attached still connected to the same link. If the host was attached to the
to the same link, all information related to the link such as the same link, all information related to the link such as the routers,
routers, prefixes and configuration parameters was considered to be prefixes, and configuration parameters was considered to be valid.
valid. The Simple DNA protocol follows an alternate approach where The Simple DNA protocol follows an alternate approach where it relies
it relies on probing each previously known router to determine on probing each previously known router to determine whether to use
whether to use information learnt from THAT router. This allows information learnt from THAT router. This allows Simple DNA to probe
simple DNA to probe routers learnt from multiple earlier attachments routers learnt from multiple earlier attachments to optimize movement
to optimize movement between a known set of links. between a known set of links.
2.4. DNA Overview 1.4. DNA Overview
Detecting Network Attachment is performed by hosts after detecting a Detecting Network Attachment is performed by hosts after detecting a
link-layer "up" indication. The host uses a combination of unicast link-layer "up" indication. The host uses a combination of unicast
Neighbor Solicitations (NSs) and multicast Router Solicitations (RSs) Neighbor Solicitations (NSs) and multicast Router Solicitations (RSs)
in order to determine whether previously encountered routers are in order to determine whether previously encountered routers are
present on the link, in which case an existing configuration can be present on the link, in which case an existing configuration can be
reused. If previously encountered routers are not present then reused. If previously encountered routers are not present, then
either IPv6 Stateless Address Autoconfiguration and/or DHCPv6 is used either IPv6 Stateless Address Autoconfiguration and/or DHCPv6 is used
for configuration. for configuration.
Hosts implementing simple DNA may also send DHCPv6 packets, as Hosts implementing Simple DNA may also send DHCPv6 packets, as
described in Section 5.5.4. Since simple DNA does not modify the described in Section 5.5.4. Since Simple DNA does not modify the
DHCPv6 protocol or state machine, the operation of DHCPv6 is DHCPv6 protocol or state machine, the operation of DHCPv6 is
unchanged. unchanged.
Routers that follow the standard neighbor discovery procedure Routers that follow the standard neighbor discovery procedure
described in [RFC4861] will delay the router advertisement by a described in [RFC4861] will delay the router advertisement (RA) by a
random period between 0 and MAX_RA_DELAY_TIME (defined to be 500ms) random period between 0 and MAX_RA_DELAY_TIME (defined to be 500 ms)
as described in Section 6.2.6 of [RFC4861]. In addition, consecutive as described in Section 6.2.6 of [RFC4861]. In addition, consecutive
RAs sent to the all-nodes multicast address are rate limited to no RAs sent to the all-nodes multicast address are rate limited to no
more than one advertisement every MIN_DELAY_BETWEEN_RAS (defined to more than one advertisement every MIN_DELAY_BETWEEN_RAS (defined to
be 3 seconds). This will result in a worst-case delay of 3.5 seconds be 3 seconds). This will result in a worst-case delay of 3.5 seconds
in the absence of any packet loss. in the absence of any packet loss.
Hosts implementing simple DNA can detect the presence of a previously Hosts implementing Simple DNA can detect the presence of a previously
encountered router using unicast Neighbor Solicitations. As a encountered router using unicast Neighbor Solicitations. As a
result, where the host with a valid configuration is returning to a result, where the host with a valid configuration is returning to a
previously encountered link, delays in the sending of a Router previously encountered link, delays in the sending of a Router
Advertisement (RA) will not delay configuration as long as NS probing Advertisement (RA) will not delay configuration as long as NS probing
is successful. However in situations where the host is attaching to is successful. However, in situations where the host is attaching to
a link for the first time, or where it does not have a valid IP a link for the first time, or where it does not have a valid IP
address on the link, it will be dependent on the receipt of an RA for address on the link, it will be dependent on the receipt of an RA for
stateless auto-configuration. In these situations delays in the stateless autoconfiguration. In these situations, delays in the
receipt of an RA can be significant and may result in service receipt of an RA can be significant and may result in service
disruption. disruption.
2.5. Working Assumptions 1.5. Working Assumptions
There are a series of assumptions about the network environment which There are a series of assumptions about the network environment that
underpin these procedures. underpin these procedures.
o The combination of the link layer address and the link local IPv6 o The combination of the link-layer address and the link-local IPv6
address of a router is unique across links. address of a router is unique across links.
o Hosts receive indications when a link-layer comes up. Without o Hosts receive indications when a link layer comes up. Without
this, they would not know when to commence the DNA procedure. this, they would not know when to commence the DNA procedure.
If these assumptions do not hold, host change detection systems will If these assumptions do not hold, host change detection systems will
not function optimally. In that case, they may occasionally detect not function optimally. In that case, they may occasionally detect
change spuriously, or experience some delay in detecting network change spuriously or experience some delay in Detecting Network
attachment. The delays so experienced will be no longer than those Attachment. The delays so experienced will be no longer than those
caused by following the standard neighbor discovery procedure caused by following the standard neighbor discovery procedure
described in [RFC4861]. described in [RFC4861].
2. Requirements Notation
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
3. Terminology 3. Terminology
+---------------------+---------------------------------------------+ +---------------------+---------------------------------------------+
| Term | Definition | | Term | Definition |
+---------------------+---------------------------------------------+ +---------------------+---------------------------------------------+
| Valid IPv6 address | An IPv6 address configured on the node that | | Valid IPv6 address | An IPv6 address configured on the node that |
| | has a valid lifetime greater than zero. | | | has a valid lifetime greater than zero. |
| | | | | |
| Operable IPv6 | An IPv6 address configured on the node that | | Operable IPv6 | An IPv6 address configured on the node that |
| address | can be used safely on the current link. | | address | can be used safely on the current link. |
| | | | | |
| Router identifier | Identifier formed using the link-local | | Router identifier | Identifier formed using the link-local |
| | address of a router along with its | | | address of a router along with its |
| | link-layer address. | | | link-layer address. |
| | | | | |
| D-Flag | Flag indicating whether the address was | | D-Flag | Flag indicating whether the address was |
| | obtained using SLAAC or DHCPv6. If it is | | | obtained using Stateless Address |
| | set to 0, then SLAAC was used to configure | | | Autoconfiguration (SLAAC) or DHCPv6. If it |
| | the address. If it is set to 1, then DHCPv6 | | | is set to 0, then SLAAC was used to |
| | was used to configure the address. | | | configure the address. If it is set to 1, |
| | then DHCPv6 was used to configure the |
| | address. |
| | | | | |
| O-Flag | Flag indicating whether the address is | | O-Flag | Flag indicating whether the address is |
| | operable. If it is set to 0, the address is | | | operable. If it is set to 0, the address |
| | inoperable. If it is set to 1, the address | | | is inoperable. If it is set to 1, the |
| | is operable. | | | address is operable. |
| | | | | |
| S-Flag | Flag indicating whether SEND [RFC3971] was | | S-Flag | Flag indicating whether SEND [RFC3971] was |
| | used in the Router Advertisement that | | | used in the Router Advertisement that |
| | resulted in the creation/modification of | | | resulted in the creation/modification of |
| | this SDAT entry. If it is set to 0, then | | | this SDAT entry. If it is set to 0, then |
| | SEND was not used. If it is set to 1, then | | | SEND was not used. If it is set to 1, then |
| | SEND was used. | | | SEND was used. |
| | | | | |
| Candidate Router | A router address in the SDAT that is | | Candidate Router | A router address in the SDAT that is |
| Address | associated with at least one valid address. | | Address | associated with at least one valid address. |
| | | | | |
| Candidate Router | A set of router addresses that has been | | Candidate Router | A set of router addresses that has been |
| Set | identified for NS based probing. | | Set | identified for NS-based probing. |
+---------------------+---------------------------------------------+ +---------------------+---------------------------------------------+
Table 1: Simple DNA Terminology Table 1: Simple DNA Terminology
4. The Simple DNA Address Table (SDAT) 4. The Simple DNA Address Table (SDAT)
In order to correctly perform the procedure described in this In order to correctly perform the procedure described in this
document the host needs to maintain a data structure called the document, the host needs to maintain a data structure called the
Simple DNA address table (SDAT). The host needs to maintain this Simple DNA address table (SDAT). The host needs to maintain this
data structure for each interface on which it performs Simple DNA. data structure for each interface on which it performs Simple DNA.
Each entry in the SDAT table will be indexed by the router identifier Each entry in the SDAT table will be indexed by the router identifier
(link-local + link layer address of the router) and consists of at (link-local + link-layer address of the router) and consists of at
least the following parameters. Fields tagged as [S] are used for least the following parameters. Fields tagged as [S] are used for
addresses configured using SLAAC. Fields tagged as [D] are used for addresses configured using SLAAC. Fields tagged as [D] are used for
addresses obtained using DHCPv6. Fields tagged as [S+D] are used in addresses obtained using DHCPv6. Fields tagged as [S+D] are used in
both cases. both cases.
o [S+D]Link-local IPv6 address of the router(s) o [S+D] Link-local IPv6 address of the router(s)
o [S+D]Link-layer (MAC) address of the router(s) o [S+D] Link-layer (MAC) address of the router(s)
o [S+D]Flag indicating whether the address was obtained using SLAAC o [S+D] Flag indicating whether the address was obtained using SLAAC
or DHCPv6.(The D-Flag) or DHCPv6. (The D-Flag)
o [S+D]IPv6 address and its related parameters like valid lifetime, o [S+D] IPv6 address and its related parameters like valid lifetime,
preferred lifetime etc. preferred lifetime, etc.
o [S]Prefix from which the address was formed. o [S] Prefix from which the address was formed.
o [S]Flag indicating whether SEND was used.(The S-Flag) o [S] Flag indicating whether SEND was used. (The S-Flag)
o [D]DHCP specific information in case DHCPv6 [RFC3315] was used to o [D] DHCP-specific information in case DHCPv6 [RFC3315] was used to
acquire the address. This information includes DUID, IA_ID, a acquire the address. This information includes the DUID, the
flag indicating IA_NA/IA_TA, configuration information such as DNS IAID, a flag indicating IA_NA/IA_TA, and configuration information
server address, NTP server address etc. such as DNS server address, NTP server address, etc.
o [S+D]Flag indicating whether the address is operable.(The O-Flag) o [S+D] Flag indicating whether the address is operable. (The
O-Flag)
5. Host Operations 5. Host Operations
On connecting to a new point of attachment, the host performs the On connecting to a new point of attachment, the host performs the
detecting network attachment procedure in order to determine whether Detecting Network Attachment procedure in order to determine whether
the existing addressing and configuration information are still the existing addressing and configuration information are still
valid. valid.
5.1. On receipt of a Router Advertisement 5.1. On Receipt of a Router Advertisement
When the host receives a Router Advertisement and the router When the host receives a Router Advertisement and the router
identifier of the sending router is not present in the SDAT, the host identifier of the sending router is not present in the SDAT, the host
processes the Router Advertisement as specified in Section 6.3.4. of processes the Router Advertisement as specified in Section 6.3.4 of
[RFC4861]. Additionally, the host performs the following operations. [RFC4861]. Additionally, the host performs the following operations.
If the Router Advertisement is protected by SEND the S-Flag MUST be If the Router Advertisement is protected by SEND, the S-Flag MUST be
set to 1 in the SDAT entries created/modified by this RA. set to 1 in the SDAT entries created/modified by this RA.
o The host configures addresses out of the autoconfigurable prefixes o The host configures addresses out of the autoconfigurable prefixes
advertised in the RA, as specified in [RFC4862]. The host MUST advertised in the RA, as specified in [RFC4862]. The host MUST
add an SDAT entry (indexed by this router identifier) for each add an SDAT entry (indexed by this router identifier) for each
such address the host configures. such address the host configures.
o The host might have already configured addresses out of the o The host might have already configured addresses out of the
autoconfigurable prefixes advertised in the RA. This could be a autoconfigurable prefixes advertised in the RA. This could be a
result of receiving the prefix in an RA from another router on the result of receiving the prefix in an RA from another router on the
same link. The host MUST add an SDAT entry (indexed by this same link. The host MUST add an SDAT entry (indexed by this
router identifier) for each such address the host had already router identifier) for each such address the host had already
configured. configured.
o The host might have DHCPv6 assigned addresses that are known to be o The host might have DHCPv6-assigned addresses that are known to be
operable on the link. The host MUST add an SDAT entry (indexed by operable on the link. The host MUST add an SDAT entry (indexed by
this router identifier) for each such DHCPv6 address. this router identifier) for each such DHCPv6 address.
5.2. After assignment of a DHCPv6 address 5.2. After Assignment of a DHCPv6 Address
After the host is assigned an address by a DHCPv6 server, it needs to After the host is assigned an address by a DHCPv6 server, it needs to
associate the address with the routers on link. The host MUST create associate the address with the routers on link. The host MUST create
one SDAT entry for each of the on-link routers associated with the one SDAT entry for each of the on-link routers associated with the
DHCPv6 assigned address. DHCPv6-assigned address.
5.3. Steps involved in detecting link change 5.3. Steps Involved in Detecting Link Change
The steps involved in basic detection of network attachment are: The steps involved in basic detection of network attachment are:
o Link-Layer Indication o Link-layer indication
o Sending of neighbor discovery probes o Sending of neighbor discovery probes
o Response gathering and assessment o Response gathering and assessment
These steps are described below. These steps are described below.
5.4. Link-Layer Indication 5.4. Link-Layer Indication
In order to start Detection of network attachment procedures, a host In order to start detection of network attachment procedures, a host
typically requires a link-layer indication that the medium has become typically requires a link-layer indication that the medium has become
available [RFC4957]. available [RFC4957].
After the indication is received, the host MUST mark all currently After the indication is received, the host MUST mark all currently
configured (non-tentative) IP addresses as inoperable until the configured (non-tentative) IP addresses as inoperable until the
change detection process completes. It MUST also set all Neighbor change detection process completes. It MUST also set all Neighbor
Cache entries for the routers on its Default Router List to STALE. Cache (NC) entries for the routers on its Default Router List to
STALE. This is done to speed up the acquisition of a new default
This is done to speed up the acquisition of a new default router in router in case the host attaches to a previously unvisited link.
case the host attaches to a previously unvisited link.
5.5. Sending Neighbor Discovery probes 5.5. Sending Neighbor Discovery probes
5.5.1. Sending Router Solicitations 5.5.1. Sending Router Solicitations
When a host receives a link-layer "up" indication, it SHOULD When a host receives a link-layer "up" indication, it SHOULD
immediately send a Router Solicitation (as specified in as specified immediately send a Router Solicitation (as specified in Section 6.3.7
in section 6.3.7 of [RFC4861]). The Router Solicitation is sent to of [RFC4861]). The Router Solicitation is sent to the all-routers
the All-routers multicast address using a link-local address as the multicast address using a link-local address as the source address
source address [RFC4861]. Even if the host is in possession of more [RFC4861]. Even if the host is in possession of more than one valid
than one valid IPv6 address, it MUST send only one router IPv6 address, it MUST send only one router solicitation using a valid
solicitation using a valid link-local address as the source address. link-local address as the source address.
5.5.2. Sending Neighbor Solicitations 5.5.2. Sending Neighbor Solicitations
The host iterates through the SDAT to identify a set of candidate The host iterates through the SDAT to identify a set of candidate
routers for NS based probing. Each router in the SDAT that is routers for NS-based probing. Each router in the SDAT that is
associated with at least one valid address is added to the candidate associated with at least one valid address is added to the candidate
router set exactly once. For each router in the candidate router set router set exactly once. For each router in the candidate router
the host MUST send an unicast Neighbor Solicitation to the router's set, the host MUST send a unicast Neighbor Solicitation to the
link-local address it obtained from the lookup on the SDAT. The host router's link-local address it obtained from the lookup on the SDAT.
MUST set link-layer destination address in each of these neighbor The host MUST set the link-layer destination address in each of these
solicitations to the link-layer address of the router stored in the neighbor solicitations to the link-layer address of the router stored
SDAT. The host MUST NOT send unicast Neighbor Solicitations to a in the SDAT. The host MUST NOT send unicast Neighbor Solicitations
router that is not associated to a valid address in the SDAT. If at to a router that is not associated to a valid address in the SDAT.
least one entry in the SDAT for a given router had the S-Flag set, If at least one entry in the SDAT for a given router had the S-Flag
the host SHOULD use SEND to secure the NS probe being sent to the set, the host SHOULD use SEND to secure the NS probe being sent to
router. the router.
5.5.3. Concurrent sending of RS and NS probes 5.5.3. Concurrent Sending of RS and NS Probes
The host SHOULD send the Neighbor Solicitation based unicast probes The host SHOULD send the Neighbor-Solicitation-based unicast probes
in parallel with the multicast Router Solicitation. Since sending in parallel with the multicast Router Solicitation. Since sending
NSs is just an optimization, doing the NSs and the RS in parallel NSs is just an optimization, doing the NSs and the RS in parallel
ensures that the procedure does not run slower than it would if it ensures that the procedure does not run slower than it would if it
only used an Router Solicitation. only used a Router Solicitation.
NOTE: A Simple DNA implementation SHOULD limit its NS based probing NOTE: A Simple DNA implementation SHOULD limit its NS-based probing
to at most six previously seen routers to at most six previously seen routers.
5.5.4. Initiating DHCPv6 exchange 5.5.4. Initiating DHCPv6 Exchange
On receiving a link-layer "up" indication, the host will initiate a On receiving a link-layer "up" indication, the host will initiate a
DHCPv6 exchange when and as specified in [RFC3315] in order to verify DHCPv6 exchange (with the timing and protocol as specified in
whether the addresses and configuration obtained using DHCPv6 are [RFC3315]) in order to verify whether the addresses and configuration
still usable on the link. Note that DHCPv6, as specified today, only obtained using DHCPv6 are still usable on the link. Note that
attempts to confirm addresses obtained on the most recently attached DHCPv6, as specified today, only attempts to confirm addresses
link. obtained on the most recently attached link.
5.6. Contents of the Neighbor Discovery messages 5.6. Contents of the Neighbor Discovery Messages
5.6.1. Neighbor Solicitation messages 5.6.1. Neighbor Solicitation Messages
This section describes the contents of the neighbor solicitation This section describes the contents of the neighbor solicitation
probe messages sent during the probing procedure. probe messages sent during the probing procedure.
Source Address: A link-local address assigned to the Source Address: A link-local address assigned to the
probing host. probing host.
Destination Address: The link-local address of the router being Destination Address: The link-local address of the router being
probed as learned from the SDAT. probed as learned from the SDAT.
Hop Limit: 255 Hop Limit: 255
ND Options: ND Options:
Target Address: The link-local address of the router being Target Address: The link-local address of the router being
probed as learnt from the SDAT. probed as learnt from the SDAT.
Link Layer Header: Link-Layer Header:
Destination Address: The link-layer (MAC) address of the router Destination Address: The link-layer (MAC) address of the router
being probed as learnt from the SDAT. being probed as learnt from the SDAT.
The probing node SHOULD include the Source link-layer address option The probing node SHOULD include the source link-layer address option
in the probe messages. in the probe messages.
5.6.2. Router Solicitation messages 5.6.2. Router Solicitation Messages
This section describes the contents of the router solicitation probe This section describes the contents of the router solicitation probe
message sent during the probing procedure. message sent during the probing procedure.
Source Address: A link-local address assigned to the Source Address: A link-local address assigned to the
probing host. probing host.
Destination Address: The all-routers multicast address. Destination Address: The all-routers multicast address.
Hop Limit: 255 Hop Limit: 255
The probing node SHOULD NOT include the Source link-layer address The probing node SHOULD NOT include the source link-layer address
option in the probe messages. option in the probe messages.
5.7. Response Gathering 5.7. Response Gathering
5.7.1. Receiving Neighbor Advertisements 5.7.1. Receiving Neighbor Advertisements
When a Neighbor Advertisement is received from a router in response When a Neighbor Advertisement is received from a router in response
to a NS probe, the host MUST verify that both the IPv6 and link layer to an NS probe, the host MUST verify that both the IPv6 and link-
(MAC) addresses of the router match the expected values before layer (MAC) addresses of the router match the expected values before
utilizing the configuration associated with the detected network utilizing the configuration associated with the detected network
(prefixes, MTU etc.). The host MUST then go through the SDAT and (prefixes, MTU, etc.). The host MUST then go through the SDAT and
mark the addresses (both SLAAC and DHCPv6 acquired) associated with mark the addresses (both SLAAC and DHCPv6 acquired) associated with
the router as operable. the router as operable.
5.7.2. Receiving Router Advertisements 5.7.2. Receiving Router Advertisements
On reception of a Router Advertisement the host MUST go through the On reception of a Router Advertisement, the host MUST go through the
SDAT and mark all the addresses associated with the router (both SDAT and mark all the addresses associated with the router (both
SLAAC and DHCPv6 acquired) as inoperable. The host MUST then process SLAAC and DHCPv6 acquired) as inoperable. The host MUST then process
the Router Advertisement as specified in Section 6.3.4. of [RFC4861]. the Router Advertisement as specified in Section 6.3.4 of [RFC4861].
5.7.3. Conflicting results 5.7.3. Conflicting Results
5.7.3.1. Conflicting results between RS and NS probes 5.7.3.1. Conflicting Results between RS and NS Probes
Where the conclusions obtained from the Neighbor Solicitation/ Where the conclusions obtained from the Neighbor Solicitation/
Advertisement from a given router and the RS/RA exchange with the Advertisement from a given router and the RS/RA exchange with the
same router differ, the results obtained from the RS/RA will be same router differ, the results obtained from the RS/RA will be
considered definitive. In case the Neighbor Advertisement was considered definitive. In case the Neighbor Advertisement was
secured using SEND and the Router Advertisement was not, the host secured using SEND and the Router Advertisement was not, the host
MUST wait for SEND_NA_GRACE_TIME to see if a SEND-secured RA is MUST wait for SEND_NA_GRACE_TIME to see if a SEND-secured RA is
received. If a SEND-secured RA is not received, the conclusions received. If a SEND-secured RA is not received, the conclusions
obtained from the NS/NA exchange will be considered definitive. obtained from the NS/NA exchange will be considered definitive.
5.7.3.2. Conflicting results between DHCPv6 and NS probes 5.7.3.2. Conflicting Results between DHCPv6 and NS Probes
Where the conclusions obtained from the Neighbor Solicitation/ Where the conclusions obtained from the Neighbor Solicitation/
Advertisement for a given DHCPv6-assigned address and the conclusions Advertisement for a given DHCPv6-assigned address and the conclusions
obtained from the DHCPv6 exchange differ, the results obtained from obtained from the DHCPv6 exchange differ, the results obtained from
the DHCPv6 exchange will be considered definitive. the DHCPv6 exchange will be considered definitive.
5.8. Further Host Operations 5.8. Further Host Operations
Operations subsequent to detecting network attachment depend upon Operations subsequent to Detecting Network Attachment depend upon
whether or not the host has reconnected to a previously visited whether or not the host has reconnected to a previously visited
network. network.
After confirming the reachability of the associated router using an After confirming the reachability of the associated router using an
NS/NA pair, the host performs the following steps. NS/NA pair, the host performs the following steps.
o The host SHOULD rejoin any solicited nodes' multicast groups for o The host SHOULD rejoin any solicited nodes' multicast groups for
addresses it continues to use. addresses it continues to use.
o The host SHOULD select a default router as described in Section o The host SHOULD select a default router as described in Section
6.3.6 of [RFC4861]. 6.3.6 of [RFC4861].
If the host has determined that it has reattached to a previously If the host has determined that it has reattached to a previously
visited link, it SHOULD NOT perform duplicate address detection on visited link, it SHOULD NOT perform duplicate address detection on
the addresses that have been confirmed to be operable. the addresses that have been confirmed to be operable.
If the NS based probe with a router did not complete or if the RS If the NS-based probe with a router did not complete or if the RS-
based probe on the same router completed with different prefixes than based probe on the same router completed with different prefixes than
the ones in the SDAT the host MUST begin address configuration the ones in the SDAT, the host MUST begin address configuration
techniques, as indicated in a received Router Advertisement techniques, as indicated in a received Router Advertisement [RFC4861]
[RFC4861][RFC4862]. [RFC4862].
5.9. On connecting to a new point of attachment 5.9. On Connecting to a New Point of Attachment
A host usually maintains SDAT entries from some number of previously A host usually maintains SDAT entries from some number of previously
visited networks. When the host attaches to a previously unknown visited networks. When the host attaches to a previously unknown
network it MAY need to discard some older SDAT entries. network, it MAY need to discard some older SDAT entries.
5.10. Periodic Maintenance of the SDAT 5.10. Periodic Maintenance of the SDAT
The host SHOULD maintain the SDAT table by removing entries when the The host SHOULD maintain the SDAT table by removing entries when the
valid lifetime for the prefix and address expires, that is, at the valid lifetime for the prefix and address expires, that is, at the
same as as the prefix is removed from the Prefix List in [RFC4861]. same time that the prefix is removed from the Prefix List in
The host SHOULD also remove a router from a SDAT entry when that [RFC4861]. The host SHOULD also remove a router from an SDAT entry
router stops advertising a particular prefix. When three consequtive when that router stops advertising a particular prefix. When three
RAs from a particular router have not included a prefix, then the consecutive RAs from a particular router have not included a prefix,
router should be removed from the corresponding SDAT entry. then the router should be removed from the corresponding SDAT entry.
Likewise, if a router starts advertising a prefix for which there Likewise, if a router starts advertising a prefix for which there
already exists a SDAT entry then that router should be added to the already exists an SDAT entry,then that router should be added to the
SDAT entry. SDAT entry.
5.11. Recommended retransmission behavior 5.11. Recommended Retransmission Behavior
Where the NS probe does not complete successfully, it usually implies Where the NS probe does not complete successfully, it usually implies
that the host is not attached to the network whose configuration is that the host is not attached to the network whose configuration is
being tested. In such circumstances, there is typically little value being tested. In such circumstances, there is typically little value
in aggressively retransmitting unicast neighbor solicitations that do in aggressively retransmitting unicast neighbor solicitations that do
not elicit a response. not elicit a response.
Where unicast Neighbor Solicitations and Router Solicitations are Where unicast Neighbor Solicitations and Router Solicitations are
sent in parallel, one strategy is to forsake retransmission of sent in parallel, one strategy is to forsake retransmission of
Neighbor Solicitations and to allow retransmission only of Router Neighbor Solicitations and to allow retransmission only of Router
Solicitations or DHCPv6. In order to reduce competition between Solicitations or DHCPv6. In order to reduce competition between
unicast Neighbor Solicitations and Router Solicitations and DHCPv6 unicast Neighbor Solicitations and Router Solicitations and DHCPv6
retransmissions, a DNAv6 implementation that retransmits may utilize retransmissions, a DNAv6 implementation that retransmits may utilize
the retransmission strategy described in the DHCPv6 specification the retransmission strategy described in the DHCPv6 specification
[RFC3315], scheduling DNAv6 retransmissions between Router [RFC3315], scheduling DNAv6 retransmissions between Router
Solicitations or DHCPv6 retransmissions. Solicitations or DHCPv6 retransmissions.
If a response is received to any unicast Neighbor Solicitation, If a response is received to any unicast Neighbor Solicitation,
pending retransmissions of the same MUST be canceled. A Simple DNA pending retransmissions of the same MUST be canceled. A Simple DNA
implementation SHOULD NOT retransmit a Neighbor Solicitation more implementation SHOULD NOT retransmit a Neighbor Solicitation more
than twice. To provide damping in the case of spurious Link Up than twice. To provide damping in the case of spurious link-up
indications, the host SHOULD NOT perform the Simple DNA procedure indications, the host SHOULD NOT perform the Simple DNA procedure
more than once a second. more than once a second.
6. Pseudocode for Simple DNA 6. Pseudocode for Simple DNA
/* Link up indication received on INTERFACE */ /* Link-up indication received on INTERFACE */
/* Start Simple DNA process */ /* Start Simple DNA process */
/* Mark All Addresses as inoperable */
Configured_Address_List=Get_Address_List(INTERFACE);
foreach Configured_Address in Configured_Address_List
{
if (Get_Address_State(Configured_Address)!=AS_TENTATIVE)
{
Set_Address_State(Configured_Address,AS_INOPERABLE);
}
}
/* Mark all routers' NC entries as STALE to speed up */
/* acquisition of new router if link change has occurred */
foreach Router_Address in DEFAULT_ROUTER_LIST
{
NCEntry=Get_Neighbor_Cache_Entry(Router_Address);
Set_Neighbor_Cache_Entry_State(NCEntry,NCS_STALE);
}
/* Thread A : Send Router Solicitation */ /* Mark all addresses as inoperable */
RS_Target_Address=FF02::2; Configured_Address_List=Get_Address_List(INTERFACE);
RS_Source_Address=Get_Any_Link_Local_Address(INTERFACE); for each Configured_Address in Configured_Address_List
Send_Router_Solicitation(RS_Source_Address,RS_Target_Address); {
if (Get_Address_State(Configured_Address)!=AS_TENTATIVE)
{
Set_Address_State(Configured_Address,AS_INOPERABLE);
}
}
/* Thread B : Send Neighbor Solicitation(s) */ /* Mark all routers' NC entries as STALE to speed up */
Previously_Known_Router_List=Get_Router_List_from_SDAT(); /* acquisition of new router if link change has occurred */
NS_Source_Address=Get_Any_Link_Local_Address(INTERFACE); for each Router_Address in DEFAULT_ROUTER_LIST
{
NCEntry=Get_Neighbor_Cache_Entry(Router_Address);
Set_Neighbor_Cache_Entry_State(NCEntry,NCS_STALE);
}
foreach Router_Address in Previously_Known_Router_List /* Thread A : Send Router Solicitation */
{ RS_Target_Address=FF02::2;
if (Get_Any_Valid_Address_from_SDAT(Router_Address)) RS_Source_Address=Get_Any_Link_Local_Address(INTERFACE);
{ Send_Router_Solicitation(RS_Source_Address,RS_Target_Address);
Send_Neighbor_Solicitation(NS_Source_Address,Router_Address.L3_Address,
Router_Address.L2_Address);
}
}
/* Thread C : Response collection of RAs */ /* Thread B : Send Neighbor Solicitation(s) */
Previously_Known_Router_List=Get_Router_List_from_SDAT();
NS_Source_Address=Get_Any_Link_Local_Address(INTERFACE);
for each Router_Address in Previously_Known_Router_List
{
if (Get_Any_Valid_Address_from_SDAT(Router_Address))
{
Send_Neighbor_Solicitation(NS_Source_Address,
Router_Address.L3_Address,
Router_Address.L2_Address);
}
}
/* Received Router Advertisement processing */ /* Thread C : Response collection of RAs */
/* Only for RAs received from routers in the SDAT */
L3_Source=Get_L3_Source(RECEIVED_MESSAGE); /* Received Router Advertisement processing */
L2_Source=Get_L2_Source(RECEIVED_MESSAGE); /* Only for RAs received from routers in the SDAT */
SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source));
/* Mark all the addresses associated with the router as inoperable */ L3_Source=Get_L3_Source(RECEIVED_MESSAGE);
foreach SDAT_Entry in SDAT_Entry_List L2_Source=Get_L2_Source(RECEIVED_MESSAGE);
{ SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source));
Set_Address_State(SDAT_Entry,AS_INOPERABLE);
}
/* Ignore further NAs from this router */ /* Mark all the addresses associated with the router as inoperable */
/* after delaying for x milliseconds */ for each SDAT_Entry in SDAT_Entry_List
Add_Router_to_NA_Ignore_List(L3_Source,SEND_NA_GRACE_PERIOD); {
Set_Address_State(SDAT_Entry,AS_INOPERABLE);
}
/* Perform Standard RA processing as per RFC4861/RFC4862 */ /* Ignore further NAs from this router */
/* after delaying for x milliseconds */
Add_Router_to_NA_Ignore_List(L3_Source,SEND_NA_GRACE_PERIOD);
/* Thread D : Response collection of NAs */ /* Perform Standard RA processing as per RFC 4861 / RFC 4862 */
/* Received Neighbor Advertisement processing */ /* Thread D : Response collection of NAs */
/* Only for NAs received as response to DNA NSs */
L3_Source=Get_L3_Source(RECEIVED_MESSAGE); /* Received Neighbor Advertisement processing */
L2_Source=Get_L2_Source(RECEIVED_MESSAGE); /* Only for NAs received as response to DNA NSs */
if (Is_Router_on_NA_Ignore_List(L3_Source)) { L3_Source=Get_L3_Source(RECEIVED_MESSAGE);
/* Ignore message and wait for next message */ L2_Source=Get_L2_Source(RECEIVED_MESSAGE);
continue;
}
SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source)); if (Is_Router_on_NA_Ignore_List(L3_Source)) {
/* Ignore message and wait for next message */
continue;
}
foreach SDAT_Entry in SDAT_Entry_List SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source));
{ for each SDAT_Entry in SDAT_Entry_List
/* Address is operable. */ {
Set_Address_State(SDAT_Entry,AS_OPERABLE); /* Address is operable. */
/* Configure on Interface */ Set_Address_State(SDAT_Entry,AS_OPERABLE);
} /* Configure on Interface */
}
Figure 1: Pseudocode for Simple DNA Figure 1: Pseudocode for Simple DNA
NOTE: This section does not include any pseudo-code for sending of NOTE: This section does not include any pseudocode for sending of the
the DHCPv6 packets since the DHCPv6 exchange is orthogonal to the DHCPv6 packets since the DHCPv6 exchange is orthogonal to the Simple
simple DNA process. DNA process.
7. Constants 7. Constants
SEND_NA_GRACE_TIME SEND_NA_GRACE_TIME
Definition: An optional period to wait after Neighbor Definition: An optional period to wait after Neighbor
Solicitation before adopting a non-SEND RA's link change Solicitation before adopting a non-SEND RA's link change
information. information.
Value: 40 milliseconds Value: 40 milliseconds
8. Relationship to DNAv4 8. Relationship to DNAv4
skipping to change at page 17, line 15 skipping to change at page 15, line 30
Definition: An optional period to wait after Neighbor Definition: An optional period to wait after Neighbor
Solicitation before adopting a non-SEND RA's link change Solicitation before adopting a non-SEND RA's link change
information. information.
Value: 40 milliseconds Value: 40 milliseconds
8. Relationship to DNAv4 8. Relationship to DNAv4
DNAv4 [RFC4436] specifies a set of steps that optimize the (common) DNAv4 [RFC4436] specifies a set of steps that optimize the (common)
case of re-attachment to an IPv4 network that one has been connected case of reattachment to an IPv4 network that a host has been
to previously by attempting to re-use a previous (but still valid) connected to previously by attempting to reuse a previous (but still
configuration. This document shares the same goal as DNAv4 (that of valid) configuration. This document shares the same goal as DNAv4
minimizing the handover latency in moving between points of (that of minimizing the handover latency in moving between points of
attachment) but differs in the steps it performs to achieve this attachment) but differs in the steps it performs to achieve this
goal. Another difference is that this document also supports goal. Another difference is that this document supports stateless
stateless autoconfiguration of addresses in addition to addresses autoconfiguration of addresses in addition to addresses configured
configured using DHCPv6. using DHCPv6.
9. IANA Considerations
There are no changes to IANA registries required in this document.
10. Security Considerations 9. Security Considerations
A host may receive Router Advertisements from non-SEND devices, after A host may receive Router Advertisements from non-SEND devices, after
receiving a link-layer indications. While it is necessary to assess receiving a link-layer indication. While it is necessary to assess
quickly whether a host has moved to another network, it is important quickly whether a host has moved to another network, it is important
that the host's current secured SEND [RFC3971] router information is that the host's current secured SEND [RFC3971] router information is
not replaced by an attacker which spoofs an RA and purports to change not replaced by an attacker that spoofs an RA and purports to change
the link. the link.
As such, the host SHOULD send a Neighbor Solicitation to the existing As such, the host SHOULD send a Neighbor Solicitation to the existing
SEND router upon link-up indication as described above in SEND router upon link-up indication as described above in
Section 5.4. The host SHOULD then ensure that unsecured router Section 5.4. The host SHOULD then ensure that unsecured router
information does not cause deletion of existing SEND state, within information does not cause deletion of existing SEND state, within
MIN_DELAY_BETWEEN_RAS, in order to allow for a present SEND router to MIN_DELAY_BETWEEN_RAS, in order to allow for a present SEND router to
respond. respond.
If the current default router is a SEND-secured router, the host If the current default router is a SEND-secured router, the host
SHOULD wait SEND_NA_GRACE_TIME after transmission before adopting a SHOULD wait SEND_NA_GRACE_TIME after transmission before adopting a
new default router. new default router.
Even if SEND signatures on RAs are used, it may not be immediately Even if SEND signatures on RAs are used, it may not be immediately
clear if the router is authorized to make such advertisements. As clear if the router is authorized to make such advertisements. As
such, a host SHOULD NOT treat such devices as secure until and unless such, a host SHOULD NOT treat such devices as secure until and unless
authorization delegation discovery is successful. authorization delegation discovery is successful.
Unless SEND or other form of secure address configuration is used, Unless SEND or another form of secure address configuration is used,
the DNA procedure does not in itself provide positive, secure the DNA procedure does not in itself provide positive, secure
authentication of the router(s) on the network, or authentication of authentication of the router(s) on the network, or authentication of
the network itself, as e.g. would be provided by mutual the network itself, as would be provided, e.g., by mutual
authentication at the link layer. Therefore when such assurance is authentication at the link layer. Therefore, when such assurance is
not available, the host MUST NOT make any security-sensitive not available, the host MUST NOT make any security-sensitive
decisions based on the DNA procedure alone. In particular, it MUST decisions based on the DNA procedure alone. In particular, it MUST
NOT decide that it has moved from an untrusted to a trusted network, NOT decide that it has moved from an untrusted to a trusted network,
and MUST NOT make any security decisions that depend on the and MUST NOT make any security decisions that depend on the
determination that such a transition has occurred. determination that such a transition has occurred.
11. Acknowledgments 10. Acknowledgments
This document is the product of a discussion the authors had with This document is the product of a discussion the authors had with
Bernard Aboba, Thomas Narten, Erik Nordmark and Dave Thaler at IETF Bernard Aboba, Thomas Narten, Erik Nordmark, and Dave Thaler at IETF
69. The authors would like to thank them for clearly detailing the 69. The authors would like to thank them for clearly detailing the
requirements of the solution and the goals it needed to meet and for requirements of the solution and the goals it needed to meet and for
helping to explore the solution space. The authors would like to helping to explore the solution space. The authors would like to
thank the authors and editors of the complete DNA specification for thank the authors and editors of the complete DNA specification for
detailing the overall problem space and solutions. The authors would detailing the overall problem space and solutions. The authors would
like to thank Jari Arkko for driving the evolution of a simple and like to thank Jari Arkko for driving the evolution of a simple and
probabilistic DNA solution. The authors would like to thank Bernard probabilistic DNA solution. The authors would like to thank Bernard
Aboba, Thomas Narten, Jari Arkko, Sathya Narayan, Julien Laganier, Aboba, Thomas Narten, Jari Arkko, Sathya Narayan, Julien Laganier,
Domagoj Premec, Jin Hyeock-Choi, Alfred Hoenes, Frederic Rossi, Ralph Domagoj Premec, Jin Hyeock-Choi, Alfred Hoenes, Frederic Rossi, Ralph
Droms, Ted Lemon, Erik Nordmark, Lars Eggert, Brian Carpenter and Droms, Ted Lemon, Erik Nordmark, Lars Eggert, Brian Carpenter, and
Yaron Sheffer for performing reviews on the document and providing Yaron Sheffer for performing reviews on the document and providing
valuable comments to drive the document forward. valuable comments to drive the document forward.
12. References 11. References
12.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 11.1. Normative References
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3736] Droms, R., "Stateless Dynamic Host Configuration Protocol [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
(DHCP) Service for IPv6", RFC 3736, April 2004. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins,
and M. Carney, "Dynamic Host Configuration Protocol for C., and M. Carney, "Dynamic Host Configuration
IPv6 (DHCPv6)", RFC 3315, July 2003. Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
[RFC3971] Arkko, J., Kempf, J., Zill, B., and P. Nikander, "SEcure [RFC3971] Arkko, J., Kempf, J., Zill, B., and P. Nikander,
Neighbor Discovery (SEND)", RFC 3971, March 2005. "SEcure Neighbor Discovery (SEND)", RFC 3971, March
2005.
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H.
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, Soliman, "Neighbor Discovery for IP version 6
September 2007. (IPv6)", RFC 4861, September 2007.
12.2. Informative References 11.2. Informative References
[I-D.ietf-dna-protocol] [DNA-PROTOCOL] Narayanan, S., Ed., "Design Alternative for Detecting
Narayanan, S., "Detecting Network Attachment in IPv6 Network Attachment in IPv6 Networks (DNAv6 Design
Networks (DNAv6)", draft-ietf-dna-protocol (work in Alternative)", Work in Progress, November 2009.
progress), June 2007.
[RFC4957] Krishnan, S., Montavont, N., Njedjou, E., Veerepalli, S., [RFC4436] Aboba, B., Carlson, J., and S. Cheshire, "Detecting
and A. Yegin, "Link-Layer Event Notifications for Network Attachment in IPv4 (DNAv4)", RFC 4436, March
Detecting Network Attachments", RFC 4957, August 2007. 2006.
[RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6
Address Autoconfiguration", RFC 4862, September 2007. Stateless Address Autoconfiguration", RFC 4862,
September 2007.
[RFC4436] Aboba, B., Carlson, J., and S. Cheshire, "Detecting [RFC4957] Krishnan, S., Montavont, N., Njedjou, E., Veerepalli,
Network Attachment in IPv4 (DNAv4)", RFC 4436, March 2006. S., and A. Yegin, "Link-Layer Event Notifications for
Detecting Network Attachments", RFC 4957, August
2007.
Appendix A. Issues with confirming manually assigned addresses Appendix A. Issues with Confirming Manually Assigned Addresses
Even though DNAv4 [RFC4436] supports verification of manually Even though DNAv4 [RFC4436] supports verification of manually
assigned addresses this feature of DNAv4 has not been widely assigned addresses, this feature of DNAv4 has not been widely
implemented or used. There are two major issues that come up with implemented or used. There are two major issues that come up with
confirming manually assigned addresses using Simple DNA. confirming manually assigned addresses using Simple DNA.
o When DHCPv6 or SLAAC addresses are used for probing, there is no o When DHCPv6 or SLAAC addresses are used for probing, there is no
need to aggressively retransmit lost probes. This is because the need to aggressively retransmit lost probes. This is because the
address configuration falls back to vanilla DHCPv6 or SLAAC and address configuration falls back to vanilla DHCPv6 or SLAAC, and
the host will eventually obtain an address. This is not the case the host will eventually obtain an address. This is not the case
with manually assigned addresses. If the probes are lost, the with manually assigned addresses. If the probes are lost, the
host runs the risk of ending up with no addresses at all. Hence host runs the risk of ending up with no addresses at all. Hence,
agressive retransmissions are necessary. aggressive retransmissions are necessary.
o Another issue comes up when the host moves between two networks, o Another issue comes up when the host moves between two networks,
one where manual addressing is being used (say NET1)and the other one where manual addressing is being used (say, NET1) and the
where dynamic addressing (stateless autoconfig or DHCPv6) is being other where dynamic addressing (stateless autoconfiguration or
used (say NET2). Since the host can obtain a dynamic address in DHCPv6) is being used (say, NET2). Since the host can obtain a
some situations, it will need to send simple DNA probes and may dynamic address in some situations, it will need to send Simple
also engage in a DHCPv6 exchange. In a situation where the host DNA probes and may also engage in a DHCPv6 exchange. In a
moves to NET1 and the NS probes are lost and in addition an RA is situation where the host moves to NET1 and the NS probes are lost
not received, the host will not be able to confirm that it and in addition an RA is not received, the host will not be able
attached to NET1, and therefore that it should use the manual to confirm that it attached to NET1, and therefore that it should
configuration for that network. As a result, if DHCPv6 is enabled use the manual configuration for that network. As a result, if
on NET1, then the host could mistakenly obtain a dynamic address DHCPv6 is enabled on NET1, then the host could mistakenly obtain a
and configuration instead of using the manual configuration. To dynamic address and configuration instead of using the manual
prevent this problem, simple DNA probing needs to continue even configuration. To prevent this problem, Simple DNA probing needs
after the DHCPv6 exchange has completed, and DNA probes need to to continue even after the DHCPv6 exchange has completed, and DNA
take precedence over DHCPv6, contrary to the advice provided in probes need to take precedence over DHCPv6, contrary to the advice
Section 5.7.3 provided in Section 5.7.3.
Given these issues, it is NOT RECOMMENDED to use manual addressing Given these issues, it is NOT RECOMMENDED to use manual addressing
with Simple DNA. with Simple DNA.
Authors' Addresses Authors' Addresses
Suresh Krishnan Suresh Krishnan
Ericsson Ericsson
8400 Decarie Blvd. 8400 Decarie Blvd.
Town of Mount Royal, QC Town of Mount Royal, QC
Canada Canada
Phone: +1 514 345 7900 x42871 Phone: +1 514 345 7900 x42871
Email: suresh.krishnan@ericsson.com EMail: suresh.krishnan@ericsson.com
Greg Daley Greg Daley
NetStar Networks Netstar Logicalis
Level 9/636 St Kilda Rd Level 6/616 St Kilda Road
Melbourne, Victoria 3004 Melbourne, Victoria 3004
Australia Australia
Phone: +61 3 8532 4042 Phone: +61 401 772 770
Email: gdaley@netstarnetworks.com EMail: hoskuld@hotmail.com
 End of changes. 143 change blocks. 
349 lines changed or deleted 341 lines changed or added

This html diff was produced by rfcdiff 1.40. The latest version is available from http://tools.ietf.org/tools/rfcdiff/