Guang Yao wrote:
Many kinds of attacks can be designed in this situation. For instance, send spoofing NA to prevent other hosts behind SAVI devices to get stateless addresses.
I don't agree. The attack you mention is impossible if SAVI devices drop NA packets for which the target address has no corresponding binding -- as I described in an earlier email. It is irrelevant whether the attacker is the only node on its SAVI switch port, or whether the attacker is on a link segment that connects to a SAVI switch port via legacy switches. - Christian
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.