Re: {SPAM?} Re: IPv6 Deployment for the LAN

["David W. Hankins" <David_Hankins () isc org>]

On Fri, Oct 23, 2009 at 12:50:47PM +1300, Perry Lorier wrote:
> I've implemented myself a system which firewalled all ARP within the AP and 
> queried the DHCP server asking for the correct MAC for that lease then sent 
> the ARP back (as well as firewalling DHCP servers and the like).  It's 
> quite easily doable, and quite reliable.  If nodes were to send packets 
> directly when associated to an AP then the 802.11 protocol would fall 
> apart, I've never met an implementation that broke this requirement of the 
> standard.

It had not occurred to me to intercept ARP (or ND) as a transition
mechanism, that is pretty clever, but the idea of using DHCPv*
leasequery as a way to make IP->MAC resolution both secure and unicast
is something I've heard many times.

I don't know about my peers, but I would be very interested to see an
RFC that describes and examines your results.

> You can of course pretend you're the AP and send a packet if you're wanting 
> to be vicious enough.

Yes, of course, that is much simpler.  If the attacker can associate
with the real wireless network, they can always bridge and provide a
rogue AP to insert themselves in the middle.

Sometimes in focusing on packet exchanges, we miss the forest for the
trees.

-- 
David W. Hankins        "If you don't do it right the first time,
Software Engineer                    you'll just have to do it again."
Internet Systems Consortium, Inc.               -- Jack T. Hankins

Attachment: _bin
Description: