6man WG S. Chakrabarti Internet-Draft Ericsson Updates: 4861 (if approved) E. Nordmark Intended status: Standards Track Arista Networks Expires:April 25,August 18, 2014 P. Thubert Cisco Systems M. Wasserman Painless SecurityOctober 22, 2013 Wired and WirelessFebruary 14, 2014 IPv6 Neighbor Discovery Optimizationsdraft-chakrabarti-nordmark-6man-efficient-nd-04for Wired and Wireless Networks draft-chakrabarti-nordmark-6man-efficient-nd-05 Abstract IPv6 Neighbor Discovery (RFC4861) protocol has been designed for neighbor's address resolution, unreachability detection, address autoconfiguration, router advertisement4861 going back to RFC 1970) was defined at a time when link-local multicast was as reliable andsolicitation. Withwith theprogress of Internet adoptionsame network cost (send a packet onvarious industries including home, wireless, M2Ma yellow-coax Ethernet) as unicast andcellular networks there iswhere the hosts were assumed to be always on and connected. Since 1996 we've seen adesiresignificant change with both an introduction of wireless networks and battery operated devices, which poses significant challenges foroptimizingthelegacyold assumptions. We are also seeing datacenter networks where virtual machines are not always on and connected, and scaling of multicast can be challenging. This specification contains extensions to IPv6 Neighbor Discoveryprotocol. This document describes a methodwhich remove most use ofoptimization by reducingmulticastmessagesandintroducing an IPv6 address Registration mechanism.make sleeping hosts more efficient. Theoptimizationspecification includes a default mixed mode where a link can have an arbitrary mix ofIPv6hosts and/or routers - some implementing legacy Neighbor Discoveryprotocol is useful for Wirless and low- power IPv6 networksand some implementing the optimizations in this specification. The optimizations provide incremental benefits to hosts aswellsoon asData Centers and Home Networks. The solution is capable of handling existing legacy IPv6 nodes inthenetwork with local mobility.first updated routers are deployed on a link. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire onApril 25,August 18, 2014. Copyright Notice Copyright (c)20132014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . .4 1.1. Problem Areas5 2. Goals and Requirements . . . . . . . . . . . . . . . . . . . . 6 2.1. Mixed-Mode Operations . . . .4 1.2. Overview of the basic ND Optimization. . . . . . . . . .5 2. Definition Of Terms. . . . 7 3. Changes to ND state management . . . . . . . . . . . . . . . . 7 4. Definition Of Terms . . . .6 3. Assumptions for efficiency-aware Neighbor Discovery. . . . .8 4. The set of Requirements for efficiency and optimization. . .8 5. Basic Operations. . . . . . . . . 7 5. Protocol Overview . . . . . . . . . . . . . . . .9 6. Applicability Statement. . . . . . 9 5.1. Proxying to handle Mixed mode . . . . . . . . . . . . .10 7.. 11 6. New Neighbor Discovery Options and Messages . . . . . . . . .10 7.1.11 6.1. Router Advertisement flag for NEARs . . . . . . . . . . . 11 6.2. Address Registration Option (ARO) . . . . . . . . . . . . 12 6.3. Registrar Address Option (RAO) . . .10 7.2. Refresh and De-registration. . . . . . . . . . . 14 7. Conceptual Data Structures . . . .12 7.3. A New Router Advertisement Flag. . . . . . . . . . . . .13 7.4. The Transaction Identification(TID). 15 8. Host Behavior . . . . . . . . . .13 8. Efficiency-aware Neighbor Discovery Messages. . . . . . . . .14 9. Efficiency-aware Host Behavior. . . . . 16 8.1. Host and/or Interface Initialization . . . . . . . . . . .15 10. The Efficiency Aware Default16 8.2. Host Receiving Router(NEAR) BehaviorAdvertisements . . . . . .16 10.1. Router Configuration Modes. . . . . 16 8.3. Timing out Registrar List entries . . . . . . . . . . . . 1710.2. Movement Detection8.4. Sending AROs . . . . . . . . . . . . . . . . . . . .17 10.2.1. Registration ownership. . . 17 8.5. Receiving Neighbor Advertisements . . . . . . . . . . . . 1811. NCE8.6. Host Managementin efficiency-aware Routersof the TID . . . . . . . . . . . . . . . . 1811.1. Handling ND DOS Attack8.7. Refreshing a Registration . . . . . . . . . . . . . . . . 18 8.8. De-registering . .20 12. Mixed-Mode Operations. . . . . . . . . . . . . . . . . . . .21 13. Bootstrapping19 8.9. Refreshing RA information . . . . . . . . . . . . . . . . 19 8.10. Sleep and Wakeup . . . . . . . .22 14. Handling Sleepy Nodes. . . . . . . . . . . . . 21 8.11. Receiving Redirects . . . . . . .23 15. Duplicate Address Detection. . . . . . . . . . . . 21 8.12. Movement Detection . . . . .23 16. Mobility Considerations. . . . . . . . . . . . . . . 21 9. Router Behavior . . . .24 17. Other Considerations. . . . . . . . . . . . . . . . . . . 21 9.1. Router and/or Interface Initialization . .24 17.1. Detecting Network Attachment(DNA). . . . . . . . 21 9.2. Receiving Router Solicitations . . . .24 17.2. Proxying. . . . . . . . . . 22 9.3. Periodic Multicast RA forEfficiency-Awarelegacy hosts . . . . . . . . . . 22 9.4. Multicast RA when new information .25 17.3. DHCPv6 Interaction. . . . . . . . . . . 22 9.5. Receiving ARO . . . . . . . . .25 18. VRRP Interaction. . . . . . . . . . . . . 23 9.6. NCE Management in NEARs . . . . . . . . . .26 19. RPL Implications. . . . . . . 23 9.7. Sending non-zero status in ARO . . . . . . . . . . . . . . 24 9.8. Timing out Registered NCEs . .26 20. Updated Neighbor Discovery Constants. . . . . . . . . . . . .26 21. Security Considerations. 24 9.9. Router Advertisement Consistency . . . . . . . . . . . . . 25 9.10. Sending Redirects . . . . .27 22. IANA Considerations. . . . . . . . . . . . . . . 25 9.11. Providing Information to Routing Protocols . . . . . .27 23. Changelog. . 25 9.12. Creating Legacy NCEs . . . . . . . . . . . . . . . . . . . 25 9.13. Proxy Address Resolution and DAD for Legacy Hosts . . . . 25 10. Handling ND DoS Attack . . . . . . . . . . . . . . . .27 24. Acknowledgements. . . . 26 11. Bootstrapping . . . . . . . . . . . . . . . . . . . . . . . . 2725. References12. Interaction with other protocols . . . . . . . . . . . . . . . 27 12.1. Detecting Network Attachment (DNA) . . . . . . . . . . . . 2825.1. Normative References12.2. DHCPv6 Interaction . . . . . . . . . . . . . . . . . . . . 2825.2. Informative References12.3. Other use of Multicast . . . . . . . . . . . . . . . . . . 28Appendix A. Usecase Analysis12.4. VRRP Interaction . . . . . . . . . . . . . . . . . .30 A.1. Data Center Routers on the link. . . 28 13. Updated Neighbor Discovery Constants . . . . . . . . . .30 A.2. Edge Routers and Home Networks. . . 29 14. Security Considerations . . . . . . . . . . . . . . . . . . . 29 15. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 30A.3. M2M Networks16. Changelog . . . . . . . . . . . . . . . . . . . . . . . . . . 30A.4. Wi-fi Networks17. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 31A.5. 3GPP Networks18. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . . 31A.6. Industrial Networks19. References . . . . . . . . . . . . . . . . . . . .31 A.7. Set and forget offline network. . . . . . 32 19.1. Normative References . . . . . . . .31. . . . . . . . . . . 32 19.2. Informative References . . . . . . . . . . . . . . . . . . 32 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . .3134 1. IntroductionConceptually,IPv6multicast messages are supposed to avoid broadcast messages, but in practice, the multicast operationNeighbor Discovery [RFC4861] was defined atthe link level is that ofabroadcast nevertheless. This did not matter much at thetimeND [ND] was originally designed,whenan Ethernet networklocal area networks had different properties than today. A common link wasmore or less a single shared wire, but since then, large scale switch fabrics, low power sleeping devices, mobile wireless/cellular devices and virtual machines have changedthelandscape dramatically. In a modern switch fabric,yellow-coax shared wire Ethernet, where anumber of intermediate devices (such as switches, routerslink-layer multicast andsecurity middle boxes) host IPv6 State Maintaining Entities (SMEs) holding information such asunicast worked thelocation of an IPv6 address or its mapping with a MAC address. Such intermediate devices include Wireless Controllers that terminate a overlay tunnelsame - send the packet on the wire andrapidly re-enable reachability for mobile devices(L2/L3), Network edge devices performing subscriber access,the interested receivers will pick it up. Thus the networkdevicescost (ignoring any processing cost on the receivers that might not completely filter out Ethernet multicast addresses thatprotectthey did not want) and theownershipreliability ofan IPv6 address, Overlay networks in data centers, Home Networks for IPv6 clients. In general, there issending aneed for enhancing the IPv6 ND [ND] to make it less chattylink-layer unicast andflexible to work with different types of networking elements, physicalmulticast was the same. Furthermore, the hosts at the time was always on andvirtual networksconnected. Powering on and off the workstation/PC hosts at thesametimemaintainingwas slow and disruptive process. Under theIPv6 statesabove assumptions it was quite efficient toavoid duplicates or denial of services. 1.1. Problem Areas Specifically,maintain thefollowing areshared state of theissues withlink such as theIPv6 deployment in many wirelessprefixes andhigh-density IPv6 subnets today: o Thetheir lifetimes using periodicRA messages in IPv6 ND [ND], and NS/NA messages require all IPv6 nodes in the link to be in listening mode even when they are in idle cycle.multicast Router Advertisement messages. Itrequires energy for the sleepy nodes which may otherwise be sleeping during the idle period. Non-sleepy nodeswas alsospends more energy since they are in continuous listening mode. With the explosion of Internet-of- things and machineefficient tomachine communication, more and more devices would be using IPv6 addresses in the near future. o With WIFI, ause multicastmessage will consume the wireless link on all Access Points aroundNeighbor Solicitations for address resolution as aswitched fabric and will be transmitted at the lowest speed possible in order to ensureslight improvement over themaximum reception by all wireless nodes. This means thatbroadcast use inan environment where bandwidth is scarce, a single multicast packet may consume the bandwidthARP. And finally, checking forhundreds of unicast packets. Sadly, IPv6 ND is a major source of multicast messages in wireless devices, since such messages are triggered each time a wireless device changes its point of attachment. o Inadatacenter, where VM mobility and VM address reslution also trigger storms ofpotential duplicate IPv6ND multicast messages, which becomeaddress using broadcast was efficient and natural. Since then we've seen amajor hassle as the number of VM may scale totremedous change with thetenswide-spread deployment ofthousands in a large Data Center. At the IETF,WiFi and other wireless network technologies. WiFi is aWG discusses such problems with Address Resolutioncase inMassive Datacenters (ARMD). The following paragraph elaborates the source of all the multicast messagespoint inIPv6 ND. Following power-on and initialization ofthat it provides the same networkin IPv6service abstraction as Ethernetnetworks, a node joinsand is often bridged with Ethernets, meaning that thesolicited-node multicast addressNeighbor Discovery software on hosts and routers might be unaware that WiFi is being used. Yet theinterfaceperformance andthen performs duplicate address detection (DAD)reliability of multicast is quite different than forthe acquired link-local address by sendingunicast on WiFi (see for instance [I-D.vyncke-6man-mcast-not-efficient]). Similarly 3GPP and M2M networks and devices will benefit from asolicited-node multicast messagestandard specification for optimized Neighbor discovery. Even wired networks have evolved substantially with modern switch fabrics using explicit packet replication logic tothe link. After that it sendshandle multicastrouter solicitation (RS) messages to the all-router addresspackets. The hosts and usage patterns has undergone radical changes as well. Hosts go tosolicit router advertisements. Once the host receives a valid router advertisement (RA) with the "A" flag, it autoconfigures the IPv6 address with the advertised prefixsleep when not inthe router advertisement (RA). Besides this, the IPv6 routers usually send router advertisements periodicallyuse to save onthe network. RAs are sentbattery power [RFC6574] or tothe all-node multicast address. The minimum RA interval range canbe3sec to 600sec depending on applications. Nodes send Neighbor Solicitation (NS)more energy efficient even with mains power. The expectation is that waking up doesn't take much time andNeighbor Advertisement (NA) messages to resolvepower otherwise theIPv6 addressbenefits ofthe destination on the link. These NS/NA messagessleeping arealso often multicast messages and it is assumed thatgreatly reduced. Initially sleeping hosts were esoteric sensor nodes, but this sleeping hosts have become mainstream in smartphones. Some of thenode isabove trends were observed early (e.g., Ohta-san commented onthe same link and reliesNeighbor Discovery being inefficient on WiFi a long time back) but thefact thatissues were not broadly understood. The issues were raised in thedestination node is always powered and generally available. 1.2. Overview of6LowPAN context where thebasic ND Optimization Indesire was to run IPv6 over low-power radio networks and battery operated devices. That lead to defining anutshell, the following basicset of optimizations [RFC6775] for that specific category of links. However, the trends aremadenot limited to such specific link types. This document applies what we have learned fromthe original IPv66LowPAN to all link types, by reusing existing support from base Neighbor Discoveryprotocol [ND]: o Adds Node Registration at the default subnet-router o Introduces a EUI-64 identifier for identification during initiation o Does not require unsolicited periodic Router Advertisements o No multicast messages required for address resolution(such as Redirect) andDAD for non-link-local IP addresses o Introduces a short-lived temporary NCE entry for unregistered nodes that turns into a regular NCE upon registration o Supports mixed mode operations where legacy IPv6 nodesfrom 6LowPAN (Address Registration Option) andenahnced optimized routers can co-exist duringadding pieces to import thetransition period. EUI-64 identifiersrobustness with redundant routers. The optimizations arerecommendeddone in a way to provide incremental benefits. As soon asunique Interface Identifiers, however if the networkthere isisolated from the Internet, uniqueness of the identifiers may be obtained by other mechanisms such asat least one router on arandom number generator with lowest collision rate. Although, the ND optimization [6LOWPAN-ND] applies to 6LoWPAN [LOWPAN] networks,link which supports these optimizations, then theconcept is mostly applicable to power-aware IPv6 networks. Therefore, this document generalizesupdated hosts on theaddress registrationlink can sleep better. 2. Goals andmulticast reduction in [6LOWPAN-ND]Requirements The goal is toall IPv6 links. Thus optimizing the regular IPv6remove as much Neighbor Discovery[ND] to minimize total number of related signaling messages without losing generality of Neighbor Discovery, autoconfiguration and reliable host-router communication, are desirable in any modern IPv6 networks suchmulticast traffic on the link asHome, Enterprise networks, Data Centerspossible, andOperator's Cellular/ Wireless networks.handle Duplicate Address Detection (DAD) without requiring the hosts to always be awake. The optimization will be highly effective for links and nodes which do not support multicast and as well as for a multicast network without MLD snooping switches. Moreover, in the MLD-snooping networks the MLD switches will deal with less number of multicasts. Thegoalproblems that will be addresses are: Remove the use ofthis document ismulticast for DAD and Address Resolution (no multicast NS messages), and remove periodic multicast RAs. Some multicast RS and RA are needed toprovide an efficient Neighbor Discovery Protocol in classic IPv6 subnets in wireless/wired links. In the process,handle thenode registration method is also deemed to be useful for preventing Neighbor Discovery denialarrival ofservice ( ND DOS) attacks. The proposed changes can be used in two different ways. In one case all thenew hosts and routers ona link implementthenew mechanisms, which giveslink since they need to bootstrap to find each other. Remove themaximum benefits. In another caseneed for hosts to always be awake to defend their addresses by responding to any DAD probes. Ensure that thelink has a mixtureprotocol is robust against single points ofnew hosts and/or routersfailure and uses soft state which is automatically rebuilt after a state loss. A router which does not support legacy[RFC4861]hostsand routers, operating inwill always maintain amixed-mode providing somecomplete set of Neighbor Cache Entries (NCEs) for all hosts on thebenefits. Inlink. Hence there is no need for it to send Neighbor Solicitations. Thus it can avoid thefollowing sectionsproblem specified in [RFC6583]. The optimized solution SHOULD be independent of thedocument describesaddresses allocation mechanism. In addition to supporting SLAAC [RFC4862] and DHCPv6 [RFC3315] it SHOULD also work with hosts with 'Privacy Extensions for Stateless Address Autoconfiguration in IPv6'[RFC4941] and with stable IPv6 private addresses [I-D.ietf-6man-stable-privacy-addresses]. 2.1. Mixed-Mode Operations Mixed-Mode operation is thebasic operations of registration methods, optimizationprotocol behavior when the IPv6 subnet is composed ofNeighbor Discovery messages, interoperability withlegacy IPv6implementationsNeighbor Discovery compliant nodes andprovides a sectionefficiency-aware IPv6 nodes implementing this specification. The mixed-mode model SHOULD support arbitrary combinations of legacy [RFC4861] hosts and/or routers with new hosts and/or routers onuse-case scenarios where it cana link. The introduction of one new router SHOULD provide improved services to a new host, allowing the new host to avoid multicast and not requring the host to betypically applicable.awake to defend its IPv6 addresses using DAD. This documentalso describesassumes that anoptional feature for enabling node mobilityimplementation will have configuration knobs to determine whether it is running inthe LLN network using backbone routers(BBR)legacy IPv6 ND [RFC4861] ormultiple default subnet routers. This optional feature generatesEfficiency Aware only mode (no-legacy mode) or both (Mixed mode). 3. Changes to ND state management These optimizations change some fundamental aspects of Neighbor Discovery. Firstly, it moves the distributed address resolution state (each node responding to asequence ID bymulticast NS for its own addresses) to a set of routers which maintain a list of Address Registrations for thehost inhosts. Secondly, theregistration message for deploying some routing protocols (example: RPL [RFC6550]) with reliabilityinformation distributed in Router Advertisements changes from being periodically flooded by theLLN. 2.routers to explicit requests from the hosts for refreshed information using Router Solicitations. 4. Definition Of Terms Thekey wordskeywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].multi-level Subnets: A wireless link determined by one IPv6 off-link prefix in a network where in order to reach a destination with same prefix a packet may have to travel through one or more 'intermediate' routers which relay the packet to the next 'intermediate' router or the host in its own. Border Router(BR): A border router is typically located at the junction of Internet and Home Network. An IPv6 router with one interface connected to an IPv6 subnet and other interface connecting to a non-classic IPv6 interface such as 6LoWPAN interface. A Border router is usually the gateway between the IPv6 network and Internet. Backbone: This is an IPv6 transit link that interconnects 2 or more Low Power Lossy Networks (LLNs). It is expected to be deployed as a high speed backbone in order to federate a potentially large set of LLN nodes. Also referred to as a LLN backbone or Backbone network in this document. Backbone Router: An IPv6 router that federates the LLN using a transit link as a backbone. A BBR acts as a 6LoWPAN Border Router (6LBR) and an Efficiency Aware Default Router (NEAR). Efficiency-Aware Network: An Efficiency-Aware network is composed of network elements that are sensitive to energy usage or number of signaling messages in the network. An efficiency-aware network may also contain links that do not support multicast or it does not have MLD snooping capabilities and yet the network likes to communicate most efficiently with minimum number of signaling messages. Data center networks with virtual machines, cellular IPv6 networks, any IPv6 networks with energy-sensitive nodes are examples of Efficiency-Aware networks.IPv6 ND-efficiency-awareRouter(NEAR): The defaultRouterof the single hop IPv6 subnet. This(NEAR): A router that implements the optimizations specified in this document. This router should be able to handle both legacy IPv6 nodes and nodes that sends registration request. Efficiency-AwareHost(EAH): A host in a IPv6 network is considered a IPv6 node without routing and forwarding capability.Host (EAH): The EAH is the host which implements the host functionality for optimized Neighbor Discovery mentioned in this document. At least initially implementations are likely to have a fallback to legacy Neighbor Discovery when no NEAR is on the link. Legacy IPv6 Host: A IPv6 host that implements [RFC4861] without the extensions inathis dociument. Legacy IPv6network is considered aRouter: A IPv6noderouter that implements [RFC4861] withoutroutingthe extensions in this dociument. Mixed mode A NEAR supports both legacy hosts andforwarding capabilityEAH, with a configuration knob to disable the support for legacy hosts. Some routers on the link can be legacy andimplements RFC 4861 host functions. Legacysome can be NEAR. No-legacy mode A mode configured on a NEAR to not support any legacy [RFC4861] hosts or routers. Opposite of mixed mode. IPv6Router: AnAddress Registrar Normally the default router(s) on the link will act as IPv6Router which implements RFC 4861 Neighbor Discovery protocols.Address Registrars tracking all the EAHs. But in some cases it is more efficient to use a different set of routers as Address Registrars. The hosts are informed of the address registrars using router advertisement messages, and register with the available registrars. EUI-64: It is the IEEE defined 64-bit extended unique identifier formed by concatenation of 24-bit or 36-bit company id value by IEEE Registration Authority and the extension identifier within that company-id assignment. The extension identifiers are 40-bit (for 24-bit company-id) or 28-bit (for the 36-bit company-id) respectively.LLN:The protocol supports EUI-64 for compatibility with [RFC6775]. DUID It is alow powerDHCP Unique ID of a device [RFC3315]. The DUID is assumed to be stable in a given IPv6 subnet. A device which does not have an EUI-64 can form andlossy network where nodes are typically constraineduse a DUID insystem resourcesits address registrations. NCE Neighbor Cache Entry. It is a conceptual data structure introduced in section 5.1 of [RFC4861] andenergy,further elaborated in [RFC6775]. TID The Transaction ID is a device generated sequence number used forinstance battery powered nodes. Alternately LLN could beregistration. This number is used to allow anetwork of line-powered nodeshost to have concurrent registrations withradio linksdifferent routers, while also being able to robustly replace a registration withlossy characteristics. Wifi, ZigBee, Celular networks are examples of suchanetwork. Extended LLN: This is the aggregation of multiple LLNs as defined in [RFC4919] interconnected bynew one. It facilitates interoperation with protocols like RPL [RFC6550] which use aBackbone Link via Backbone Routers and formingTID internally to handle host movement. 5. Protocol Overview In asinglenutshell, the following basic optimizations are made from the original IPv6link. 3. Assumptions for efficiency-awareNeighbor Discovery protocol [RFC4861]: oThe efficiency-aware nodes in the network carry unique interface ID in the network in order to formAdds Node Registration with theauto-configured IPv6 address uniquely. An EUI-64 interface ID required for global communication. o All nodes are single IPv6-hop away from theirdefaultrouter in the subnet.router(s). o/64-bit IPv6 prefix is usedAddress Resolution and DAD uses the registered addresses instead of multicast Neighbor Solicitation messages forStateless Auto-address configuration (SLAAC). Thenon-link-local IPv6Prefix may be distributed withaddresses. o Does not require unsolicited periodic RouterAdvertisement (RA) from the default router to allAdvertisements. o Supports mixed-mode operation where legacy IPv6 hosts and routers and NEARs and EAHs can co-exist on thenodes in thatsame link.o The efficiency-aware node MAY maintainThis support can be configured off. When asequence counterhost powers on it behaves conforms to legacy ND [RFC4861] by multicasting up to MAX_RTR_SOLICITATIONS Router Solicitations and receives Router Advertisements. The additional information inpermanent memory accordingthe Router Advertisements by the NEARs is used by the EAH tosection 7build a list ofRFC 6550. 4. The setIPv6 Address Registrars. As the host is forming its IPv6 addresses (using any ofRequirements for efficiency and optimization o Node Registration: Node initiated Registrationthe many statless and stateful IPv6 address allocationis done in order to avoid periodicmechanism) then, instead of using a multicastRouter Advertisement messages and oftenDAD message, it unicasts an Neighbor Solicitation with the new Addressresolution canRegistration Option (ARO) to the Registrars. Assuming an IPv6 addresses are not duplicate the EAH receives a Neighbor Advertisement with the ARO option from the NEARs. The EAH refreshes the registered addresses before they expire, thereby removing the need for the EAH to beskippedawake to defend its addresses using DAD asallspecified in [RFC4862] as the NEARs will handle DAD. The routers on the link advertise the prefixes without setting the L flag. Thus only the IPv6 link-local addresses are considered on- link. Thus the hosts will send packetsgo viato a default router, and the default routers maintain all the registrations. Hence a routerwhich now knows aboutwill know the link-layer addresses of all the registerednodes. Node Registrationhosts. This enablesreduction of all-nodethe router to forward the packet (without needing any Address Resolution with the multicast Neighbor Solicitation), andsolicited-nodealso to send a Redirect to the originating host informing the host of the link-layer address. Instead of relying on periodic multicastmessages inRAs to refresh thesubnet. o Address allocationlifetimes ofregistered nodes [ND] are performed using IPv6 Autoconfiguration [AUTOCONF]. o Host initiated Registration and Refreshprefixes etc, the model in efficiency-aware networks isdonefor the hosts to ask for refreshed information bysendingunicasting a Router Solicitationand thenbefore the information expires. The periodic multicast RAs are also used to provide new information such as additional prefixes, radical reduction in the preferred and/or valid lifetime for aNeighbor Solicitation Messageprefix. A host does not know to ask for such information. Thus a router that wishes to quickly disseminate such change can resort to a few multicast RAs, or wait for the hosts to request a refresh using a Router Solicitation. The routers can crash and loose all their state, including the AddressRegistration Option (described below). oRegistrations. On router initialization the router will multicast a few initial RAs. Thenode registration may replaceprotocol has a Router Epoch mechanism which is used by therequirementhosts to detect that the router has lost state. In that case the hosts will immediately re-register allowing the router to quickly rebuild its Address Registration state. Normally it is sufficient for the hosts to register with all the default routers on the link. However, in some cases such as simplistic VRRP deployment the hosts should register with all the VRRP routers even though they only know ofdoing Duplicateone virtual router IPv6 address. And in other cases it would be more efficient to only register with one router even though there are multiple default routers. The RAs can contain a Registrar AddressDetection. oOption to explicitly tell the hosts where to register. Sleepy hosts are supported by this Neighbor Discovery procedures as they are not woken up periodically by Router Advertisement multicast messages or Neighbor Solicitation multicast messages. Sleepy nodes may wake up in its own schedule and send unicast registration refresh messageswhen needed. o Since this document requires formation of an IPv6 address with an unique 64-bit Interface ID(EUI-64) is required for global IPv6 addresses, ifbefore thenetworkregistration lifetime expiration. The recommended procedure on wakeup isan isolated one and uses ULA [ULA] as its IPv6 address then the deployment should make sure that each MAC address in that network has unique address and can provideto unicast aunique 64-bit ID for each node in the network. o A /64-bit Prefix is requiredNeighbor Solicitation toform the IPv6 address. o MTU requirement is same as IPv6 network. 5. Basic Operations In the efficient-nd IPv6 Network, the NEAR routers arethe defaultrouters for the efficiency-aware hosts (EAH). During the startup or joining the networkrouter(s), which serves as DNA check [RFC6059] that the hostdoes not wait foris on theRouter Advertisements assame link, performs NUD against theNEAR routers do not perform periodic multicast RA as per RFC 4861. Instead,router, and includes theEAH sends a multicast RSAddress Registration Option tofind out a NEAR router in the network. The RS message isrefresh thesame as in RFC 4861. The advertisingregistration. 5.1. Proxying to handle Mixed mode When there are one or more legacy routersinon the linkrespondsthen the recommendation is to configure those to advertise theRS message with RAprefixes withPrefix Information Option and any other options configuredL=0 just as the NEARs. That results in thenetwork. If EAHhostswill look for a RA from a NEAR (E-flag) and choosesending all packets to aNEAR as itsdefault routerand consequently sendsunless/until they receive aunicast Neighbor Solicitation Message with ARO option in order to register itself withRedirect. However, thedefault router. The EAH does notlegacy routers doDuplicate Address Detection or NS Resolution of addresses. NEAR maintains a binding of registered nodes and registration life-time information along withnot maintain theneighbor Cache information. The NEAR is responsible for forwardingaddress registrations. Thus even though all themessages from its EAH including on-link messages from one EAHhosts send the packets toanother. For details of protocol operations please seethesections below. When a IPv6 network consists of both legacy hosts and EAH, and ifrouters, theNEAR is configured for 'mixed mode' operation, it should be ablelegacy routers might in turn need tohandleperform AddressRegistration Option(ARO) requests and send periodic RA. Thus it should be able to serve both efficiency-awareResolution by multicasting a Neighbor Solicitation per [RFC4861]. In addition, legacy hosts and legacyhosts. Similarly,routers will perform DAD as specified in [RFC4862] that is, by sending alegacy host compatible EAH falls back to RFC 4861 host behavior ifmulticast NS and waiting for aNEAR isNS or NA which indicates a conflict. A EAH will notpresent in the link. Seereceive and respond to such messages. If thesection on 'Mixed Mode Operations' for details below. 6. Applicability Statement This document aimsNEARs have been configured toguide implementersoperate in mixed-mode, then they will respond tochoose an appropriate IPv6 neighbor discoverymulticast NS messages from legacy nodes for both DAD and Addressconfiguration procedures suitable for any efficient IPv6 network. These optimizations are equally useful forResolution. They will respond with theenergy-sensitive, non-multicast links and for classical IPv6 networks i.e. home networks, Data-Center IPv6 overlay networks where saving Neighbor Discovery messagesTarget Link Layer Address being that of the registered host, so that subsequent communication willreduce cost and increase bandwidth availability. Thenot go via the routers. (Implementations of "Neighbor Discovery Proxies (ND Proxy)" [RFC4389] might proxy using their own MAC addressregistration mechanism and associated extension toas TLLA, but that is outside of the scope of this document.) 6. New Neighbor Discoveryprotocol allowOptions and Messages This specification introduces alow-power host to move betweennew flag in theLLNRAs, reuses and extends theclassic IPv6 networks as well as movementARO option fromone Border[RFC6775] and introduces a new Registrar Address option. 6.1. Routerregistration area to another while staying within the same IPv6 subnet. Note that the specification allows 'Mixed-mode' operation in the efficiency-aware nodesAdvertisement flag forbackward compatibility and transitioningNEARs A new Router Advertisement flag is needed in order to distinguish acomplete efficiency-aware network of hosts and routers. Though the efficiency-aware only nodesrouter advertisement sent by a NEAR, which willminimize the ND signaling and DOS attacks intrigger an EAH to register with theLAN. Applicability of this solutionNEAR. This flag islimited toignored by the legacy IPv6nodes and subnets and it optimizes the generic IPv6 signaling activities at network layer. However, further optimization at the application layers are possible for increased efficiency based on particular use- cases and applications. 7. New Neighbor Discovery Options and Messages This section will discuss the registration and de-registration procedure ofhosts. The current flags field in RA is reproduced here with thehostsadded 'E' bit. 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |M|O|H|Prf|P|E|R| +-+-+-+-+-+-+-+-+ The 'E' bit is set to 1 in a RA sent by a NEAR. In all other cases thenetwork. 7.1.E bit MUST be 0. 6.2. Address Registration Option (ARO) The Address RegistrationOption(ARO) is usefulOption was defined in [RFC6775] foravoiding Duplicate Address Detection messages sincethe purposes of 6LowPAN and this document extends itrequiresin a backwards compatible way by using some of the reserved fields. The extensions are to handle different unique identifiers than EUI-64ID for registration.(this document specifies how to use DHCP Unique Identifiers with the ability do use other identifier namespaces in the future) and a Transaction Id. Theaddress registrationUnique Interface Identifier is usedfor maintaining reachability ofby thenode orNEARs to distinguish between a refresh of an existing registration and a different host trying to register an IPv6 address which is already registered by some other host. Thus therouter. This optionrequirement isalmostthat thesame ARO as in [6LOWPAN-ND]. A Transaction ID fieldunique id is unique per link, but due to the potential for host mobility across links and subnets it should be globally unique. Both an EUI-64 and acorresponding bit have been introduced in orderDUID satisfies that requirement. The TID is used by the NEARs todetect duplicate addresshandle the case when due to packet loss one NEAR might have a old registration andlocal mobility ofanother NEAR has anode.newer registration. Therouters keep track of host IP addresses that are directly reachable and their corresponding link-layer addresses. ThisTID allows them to determine which isuseful for lossy and lowpower networks(LLN) and as well as wired IPv6 networks.more recent. The TID also facilitates the interaction with RPL. An Address Registration Option(ARO)can be included in unicast Neighbor Solicitation (NS) messages sent by hosts. Thus it can be included in the unicast NS messages that a host sends as part of Neighbor Unreachability Detection to determine that it can still reachathe defaultrouter.router(s). The ARO is used by the receiving router to reliably maintain its Neighbor Cache. The same option is included in corresponding Neighbor Advertisement (NA) messages with a Status field indicating the success or failure of the registration.This option is always host initiated. The ARO is required for reliability and power saving. The lifetime field provides flexibility to the host to register an address which should be usable (the reachability information may be propagated to the routing protocols) during its intended sleep schedule of nodes that switches to frequent sleep mode. The sender of the NS also includes the EUI-64 of the interface it is registering an address from. This is used as a unique ID for the detection of duplicate addresses. It is used to tell the difference between the same node re-registering its address and a different node (with a different EUI-64) registering an address that is already in use by someone else. The EUI-64 is also used to deliver an NA carrying an error Status code to the EUI-64 based link-local IPv6 address of the host.When the ARO isusedsent byhosts anda host then, for links which have link-layer addresses, a SLLA option MUST beincluded [ except for the point-to-point links (example: IP-in-IP tunnel)] and the targetincluded. The addressfor to-bethat is registerednode MUST beis the IPv6 source address of the Neighbor Solicitation message.Note thatTypically anode should be ablehost would have several addresses toregisterregister, with each one being registered using adefault router with multiple IPv6 addresses (including privacy addresses).separate NS containing an ARO. (This approach facilitates applying SeND [RFC3971].) 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length= 2| Status | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |ReservdRes | IDS |T| TID | Registration Lifetime | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |+ EUI-64 or equivalent +~ Unique Interface Identifier (variable length) ~ | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Fields: Type: 33( See [6LOWPAN-ND] )[RFC6775] Length: 8-bit unsigned integer. The length of the option (including the type and lenth fields) in units of 8 bytes.Always 2. Status:The value 0 is invalid. Status: 8-bit unsigned integer. Indicates the status of a registration in the NA response. MUST be set to 0 in NS messages. Seebelow.[RFC6775]. Reserved: 8 bits. This field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. Res: 4 bits. This field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. IDS: 3 bits. Identifier name Space. Indicates whether the Unique Interface Identifier is a DUID or or a IEEE assigned EUI-64 with room to define additional name spaces. T bit: One bit flag. Set if the TID octet is valid. TID: 8-bit integer. It is a transaction id maintained by the host andincremented with each registration. it is recommended that the node maintains a persistent storage for TID. TID isusedas a sequence counterby the NEARs todetectdetermine the most recentregistration request from a host and its mobility within the same subnet across multiple default Border Routers. Its operation follows section 7 of RPL [RFC6550] for sequence counters.registration. Registration Lifetime: 16-bit unsigned integer. The amount of time in a unit of 60 seconds that the router should retain the Neighbor Cache entry for the sender of the NS that includes this option.EUI-64: 64 bits. This field is usedA value of zero means touniquely identifyremove theinterfaceregistration. Unique Interface Identifier: Variable length in multiples of 8 bytes. If theregistered address by including the EUI-64 identifier assignedIDS=000, then it is an 8 byte (64 bit) unmodified EUI-64. If IDS=0011 then it is a variable length DUID. A DUID MUST be zero padded to a multiple of 8 bytes. When a node includes ARO option in a Neighbor Solicitation itunmodified. T bit: One bit flag. SetMUST, on links that have link-layer addresses, also include a SLLA option. That option is needed so that the registrar can record the link-layer address on success and send back an error if theTID octetaddress ispresent for processing.a duplicate. 6.3. Registrar Address Option (RAO) Normally the Registrars are the Default Routers. However, there are cases (like some approaches to handle VRRP, or coordinated separate routers) where there is a need to have different (and either more or less) Registrars than Default Routers. Furthermore, to robustly handle NEAR state state loss this option carries a Router Epoch which triggers the EAHs to re-register on a router epoch change. TheStatus values used in Neighbor Advertisements are: +--------+--------------------------------------------+ | Status | Description | +--------+--------------------------------------------+ |RAO contains the information for both of those. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |SuccessType | Length |1Num Addresses |Duplicate Address+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reserved |2Router Epoch |Neighbor Cache Full+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |3~ IPv6 registratr addresses ~ |Registration Ownership Response(Num Addresses) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |4-255|Allocated using Standards Action [RFC2434]~ Reserved for future extensions ~ |+--------+--------------------------------------------+ Table 1 7.2. Refresh| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Fields: Type: TBD (IANA) Length: 8-bit unsigned integer. The length of the option (including the type andDe-registration A host SHOULD send a Registration messagelenth fields) inorder to renew its registration before its registration lifetime expires in orderunits of 8 bytes. The value 0 is invalid. Num Addresses 16-bit unsigned integer. Set tocontinue its connectivity withzero if there are no addresses i.e., when thenetwork. If anytime,option is used to only carry thenode decides that it doesrouter epoch. NumAdressses*2 + 1 must notneedexceed thedefault router's service anymore, itLength. Reserved 16-bit unused field. It MUSTsend a de-registration message - i,e, a registration message with lifetime being setbe initialized tozero. A mobile host SHOULD first de- register withzero by thedefault router before it moves away fromsender and MUST be ignored by thesubnet. 7.3. A Newreceiver. RouterAdvertisement Flagepoch 16-bit integer. Anew Router Advertisement flag [RF] is needed in order to distinguish arouteradvertisement fromMUST pick aefficiency-aware default router ornew epoch after alegacy IPv6 router. This flag is ignoredstate loss, either by keeping thelegacy IPv6 hosts. EAH hosts use this flagepoch inorder to discover a NEAR router if it receives multiple RA from both legacystable storage andNEAR routers. 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |M|O|H|Prf|P|E|R| +-+-+-+-+-+-+-+-+incrementing it, or picking a good random number. IPv6 registrar addresses Zero or more IPv6 addresses, typically of link-local scope. The'E' bit abovereceiver MUSTbe 1 when asilently ignore any data after the IPv6router implements and configuresregistrar addresses field (such data is present when theefficiency-awareLength is greater than NumAdressses*2 + 1). The Registrar Addresses have their lifetime be the Default Routerbehavior for Neighbor Discovery as per this document. All other casesLifetime even when they come from theE bit MUST be 0. The legacy IPv6 hosts will ignoreRAO (thus there is no explicit lifetime in theE bitRAO). 7. Conceptual Data Structures In addition to the Conceptual Data structures inRA advertisement. All[RFC4861] a EAHMUST look for E bit in RA in orderneeds todeterminemaintain theefficiency- aware support innew Registrar List for each interface. The Registrar List contains thedefaultset of IP addresses to which the host needs to send Address Registrations. Each IP address has a Router Epoch (used to determine when a routerinmight have lost state). Also, thelink. 7.4. The Transaction Identification(TID) The TID field is used togetherhost MAY use this data structure to track when it needs to refresh its registrations withagethe registrar. The use ofa registrationexplicit registrations with lifetimes plus the desire to not multicast Neighbor Solicitation messages forarbitration betweenhosts imply that we manage the Neighbor Cache entries slightly differently than in [RFC4861]. This results in tworouters (default or backbone) to ensure freshness and ownershipdifferent types of NCEs and theregistration of a given target address. Same value of TID indicatestypes specify how those entries can be removed: Legacy: Entries thatboth states of registrationarevalid. In case of a mismatch between comparable TIDs,subject to themost recent TID wins. The TID definition usednormal rules insection 6.4.1 of RFC 6550 for DAOSequence number would be applicable for here[RFC4861] that allow forTID in ARO message. It is 8 bit field. TIDgarbage collection when low on memory. Legacy entries are created only when there isgenerated by the host atno duplicate NCE. The legacy entries are converted to thetimeregistered entries upon successful processing ofa new registraton request. This document assumesARO. Legacy type can be considered as union of garbage-collectible and Tentative Type NCEs described in [RFC6775]. Registered: Entries thatan implementation willhaveconfiguration knobs to determine whether it is running in classical IPv6 ND [ND] or Efficiency Aware ND (this document) modean explicit registered lifetime and are kept until this lifetime expires orboth(Mixed mode). 8. Efficiency-aware Neighbor Discovery Messages Router Advertisement(RA): Periodic RAs SHOULD be avoided. Only solicited RAsthey areRECOMMENDED. An RA MUST containexplicitly unregistered. Note that theSource Link-layer Address option containing Router's link-layer address (thistype of the NCE isoptionalorthogonal to the states specified in[ND]. An RA MUST carry Prefix information option with L bit being unset, so that hosts do not multicast any NS messages as part[RFC4861]. There can only be one type of NCE for an IP addressresolution.at a time. 8. Host Behavior Anew flag (E-flag) is introduced in the RAEAH follows [RFC4861] and applicable parts of [RFC6775] as follows inorderthis section./ A EAH implementation MAY be able tocharacterizefall back to [RFC4861] host behavior if there is no NEAR on theefficiency-aware mode support. Unlike RFC4861 which suggests multicastlink. 8.1. Host and/or Interface Initialization A host multicasts RouterAdvertisements, this specification optimizes the exchange by always unicasting RAsSolicitation at system startup or interface initialization as specified inresponse to RS. This is possible since[RFC4861] and its updates such as [I-D.ietf-6man-resilient-rs]. Unlike RFC4861 the RSalways includesMUST (on link layers which have addresses) include a SLLA option, which is used by the router to unicast the RA.Router Solicitation(RS): Upon system startup, the node sends a multicast or link broadcast (when multicastThe host is notsupported at the link-layer) RSrequired tofind outjoin theavailable routers insolicited-node multicast address(es) but it MUST join thelink. An RS may be sent at other timesall-nodes multicast address. 8.2. Host Receiving Router Advertisements The RA is validated and processed asdescribedspecified insection 6.3.7 of RFC 4861. A Router Solicitation MUST carry Source Link-layer Address option except[RFC4861] with additional behavior for RAO and thepoint-to-point links. SinceRegistrar List as follows. When a RA is received without a RAO (but with the E flag set), or the RAO contains noperiodic RAs are allowedRegistrar Addresses, then the IPv6 source address is added/updated in theefficiency-awareRegistrar List. When a RA is received with a RAO then the IPv6network,Registrar Addresses in that option are added/ updated in the data structure. If those Registrar List (or entries) already exist and the Router Epoch in the RAO differs from the Router Epoch in the Registrar List entry, or if the entry does not exist, then the hostmay send periodic unicast RSwill initiate sending NS messages with ARO options to therouters. The time-periodsnew/updated Registration List entries. Note that if the RA contains no RAO (but the E flag is set) then for theRS varies onpurposes of thedeployment scenarios andepoch comparison one should use a zero Router Epoch. However, if the Default Router Lifetimeadvertisedin theRAs. Default Router Selection: Same as in section 6.3.6 of RFC 4861[ND]. Neighbor Solicitation (NS): Neighbor solicitationRA isused betweenzero, then any matching Registration List entry (or entries) are instead deleted from thehosts andRegistration List. It is OPTIONAL for thedefault-routerhost to de- register when an entry is deleted from the Registration List. The host can form its IPv6 address using any available mechanism - SLAAC, DHCPv6, temporary addresses, etc - aspart of NUD and registeringthehost's address(es). An NS message MUST useregistration mechanism is orthogonal and independent of the address allocation. The Address Registrationoptionprocedure replaces the DAD procedure inorder to accomplish[RFC4862]. 8.3. Timing out Registrar List entries The lifetime for theregistration. Neighbor Advertisement (NA): As definedRegistrar List entries are taken from the Default Router Lifetime in[ND] and ARO option. Redirect Messages: A router SHOULD NOTthe RA. When an entry is removed the host MAY send AROs with aRedirect messagezero Regisration Lifetime to the removed Registrar Addresses. 8.4. Sending AROs When a hostsince the linkhasnon-transitive reachability. Theformed a new IPv6 address, or when the hostbehavior is same as described in section 8.3learns ofRFC 4861[ND], i,e.ahost MUST NOT sendnew NEAR and has existing IPv6 addresses, then it would register the new things (could be new addresses to all the existing Registrars, oraccept redirect messages when in efficiency-aware mode. Same as in RFC 4861[ND] MTU option: As pertheRFC 4861. Address Resolution: No NS/NA are sent asall theprefixesIPv6 addresses with the new Registrar. IPv6 link-local addresses aretreatedregistered as well asoff-link. Thus no address resolution is performed atthehosts. The routers keep track of Neighbor Solicitations with Address Registration options(ARO)gobals andcreate an extended neighbor cache of reachable addresses. The router also knowsULA. If thenexthop link-local address and corresponding link- layer address when it wants to routeEAH has apacket. Neighbor Unreachability Detection(NUD): NUD is performed in "forward-progress" fashion as describedTID then it sets the T-bit and includes the TID insection 7.3.1 of RFC 4861[ND].the ARO. When the host registers its addresses with multiple Registrars it uses the same TID. However, ifAddress Registration Optionthe host has moved (lost its network attachment and determines it isused,attached to a different link using e.g., DNA [RFC6059]), then it will increment theNUD SHOULD be combined withTID value and use theRe-registration ofnew value for subsequent registrations. The host places its Unique Interface Identifier (whether it is a DUID or EUI-64) in thenode.ARO. Thisway no extra message for NUDidentifier isrequired. 9. Efficiency-aware Host Behavior Atypically kept in stable storage so that the hostsends Router Solicitation atcan use thesystem startup and alsosame identifier over time. It MUST use the same identifer when itsuspects that one ofre-registers itsdefault routers have become unreachable(after NUD fails). The EAH MUST process the E-bit in RAaddress, since otherwise all those will be returned asdescribed in this document.duplicates. TheEAH MUST useNS which includes the ARO optionto registerMUST include a SLLA option on link layers that have link-layer addresses. The EAH retransmits NS messages with ARO as specified in [RFC6775] until it receives a NA message from theneighboring NEAR router. A hostRegistrar containing an ARO. The number of such retransmissions SHOULD beableconfigurable. 8.5. Receiving Neighbor Advertisements The Neighbor Advertisement are validated and processed as specified in [RFC4861] for example toautoconfigure its IPv6 addresses usinghandle Neighbor Unreachability Detection (NUD). In addition, theIPv6 prefix obtained from Router Advertisement. ThehostSHOULD form its link-local address from the EUI-64processes any received ARO asspecified by IEEE Registration Authority and RFC 2373.follows. Ifthis draft feature is implemented and configured,the ARO has status code 0 (Success), then the hostMUST NOT re-direct Neighbor Discovery messages. The host is not required to joinupdates thesolicited- node multicast address but it MUST joininformation in theall-node multicast address. A host always sends packetsRegistrar List to(one of) its default router(s). Thisknow when it next needs to refresh the registered address with this Registrar. No further processing isaccomplished byneeded of therouters never settingARO. If the'L' flag inARO has status code 1 (Duplicate), then thePrefix options.host can not use the IPv6 address. TheEAHhostmay register with more than one default routers in a subnet butfollows the address allocation protocol itSHOULD use one default primary router forused to pick asource IP-new addressat a time.- be that DHCPv6, tempororary addresses, etc. Ifan EAH receivesthe ARO has a status code 2 (Neighbor Cache Full) in response to its registration request from aNEAR router,Registrar, then the nodeMUST be able to choose another routerSHOULD continue to register the address with other Registrars (when available). TBD: What about other not yet defined status code values? 8.6. Host Management of the TID It is RECOMMENDED that the EAH MAY maintain a sequence counter (TID) instable storage according to section 7 of [RFC6550]. ThehostTID isunableused toforward routes or participate in a routing protocol. A legacyresolve conflicts between different registrations issues by the same host for the same IPv6Host compliant EAH SHOULDaddress. Conflicts can beabledue tofall backdifferent link-layer addresses, but it can also be due toRFC 4861 host behaviorregistering with different NEARs/Registrars and those routers connect use protocols like RPL for routing, and RPL uses a TID to habdle movement vs. multi-homing. Thus the same TID should be used iftherethe host isno efficiency-aware router (NEAR) inregistering its addresses with multiple Registrars at the same time. But if thelink. The efficiency-awarehostMUST NOTmight have moved to a different attachment point, then it should increment its TID for subsequent registrations. 8.7. Refreshing a Registration A host SHOULD sendor accept re-direct messages. Ita Registration message in order to renew its registration before its registration lifetime expires in order to continue its connectivity with the network. This specification does notjoin solicited node multicast address. Ifconstrain theEAHimplementation. One possible implementation strategy iscapableto attempt re-register at 1/3rd ofgenerating TIDthe registration lifetime, andconfigured for this operation,if no response try again at 2/3rd of theEAH MUST uselifetime, etc. Another possible strategy is to wait until theTID field and appropriate associated operation bits inend of theARO message duringregistration lifetime andrefresh. In some cases, hosts may need to send MAX_RTR_SOLICITATIONS(3) to receivethen do thereply back fromsame relatively rapid retransmissions as for thedefault router.initial registration [RFC6775]. In all cases the host SHOULD apply alossy link or duerandom factor tosleepy default router, the hosts may haveits re- registration timeout tosend more than 3 solicitations [Resilient-RS]. But this can easily increase the numberavoid self-synchronizing behavior across lots ofsiganling traffic inhosts. Sleeping hosts would re-register when they are waking up to do other work. 8.8. De-registering If anytime, thenetwork. Thus it is RECOMMENDEDnode decides thatthe EAH nodes start with the default MAX_RTR_SOLICITATION [ND] value init does not need alow power network. However, in some scenarios the packet loss resilient router solicitation method may be applicable [Resilient-RS]. 10. The Efficiency Aware Default Router (NEAR) Behavior The main purpose of theparticular defaultrouter in the context of this document is to receive and processrouter's service anymore, the it SHOULD send a de- registrationrequest, forward packets from one neighbormessage to that NEAR/Registrar. Similarly if theother, informs the routing protocol about the un-availability ofhost stops using a particular IPv6 address, then it SHOULD de-register that address with all the Registrars it had registerednodeswith. This applies even if therouting protocol requires this information forhost was using thepurpose of mobility or fast convergence. A default router (NEAR) behavior may be observed in one or more interfacesIPv6 address, then went to sleep, and then picked a different set of IPv6 addresses. In such aBorder Router(BR).case it is preferred if the host de-registers before going to sleep. ABorder Router normally may have multiple interfaces and connectsmobile host SHOULD first de-register its addresses before it moves away from thenodessubnet (if the mobile host can know that in advance of moving.) De-registration is performed by unicasting alinkNeighbor Solicitation with an ARO where the Registration Lifetime is zero to zero. Such an ARO should have an incremented TID. De-registration AROs are retransmitted just likea regular IPv6 subnet(s) or acts as a gateway between separate networks suchother AROs asInternet and home networks .specified above. 8.9. Refreshing RA information TheBorder RouterEAH is responsible fordistributing one or more /64 prefixes toasking thenodes to identify a packet belongingrouters for updates to theparticular network. One or more of the interfaces ofinformation contained in theBorderRoutermay be connected withAdvertisements, since theefficiency-aware hosts or a efficiency-aware router(NEAR). The efficiency-aware default router MUSTNEARs will notsend periodic RA unless itmulticast such updates. That isconfigureddone by sending unicast RSs tosupport both legacy IPv6 and efficiency-aware hosts. IftheRouterrouter(s) which will result in unicast RAs. However, significant care isconfigured for efficiency-aware hosts support, it MUST send Router Advertisements with E-bit flag ON and MUST NOT set 'L' bitrequired in determining when theadvertisements. The router SHOULD NOT garbage collect Registered Neighbor Cache entries since they need to retain them untilRSs should be transmitted. As part of normal operation theRegistration Lifetime expires. If a NEAR receivesDefault Routers, Prefixes, and other RA information have lifetimes, and there are aNS message fromfew common cases: 1. The advertised lifetimes are constant i.e., thesame host one with ARO and another without ARO thenrouters keep on advancing theNS message with ARO getstime when theprecedence andinformation will expire. 2. The routers decrement theNS without ARO is ignored. This behavior protectsadvertised lifetimes in real time i.e., the information is set to expire at a determined time and subsequent RAs have lower and lower lifetimes. 3. The routers forceably expire some information by advertising it with a zero lifetime for a while, and then stop advertising it. 4. A router crashes or is silently removed fromDenial Of Service attacks. Similarly, if Neighbor Unreachability Detection ontherouter determinesnetwork and as a result there are no more updates. For example, thatthe hostdefault router will expire and there isUNREACHABLE (based on the logiclittle benefit in[ND]),trying to refresh it by sending lots of RSs. The host's logic for refreshing theNeighbor Cache entry SHOULD NOT be deleted butinformation needs to beretained until the Registration Lifetime expires. If an ARO arrives for an NCEcareful to not send a large number of RSs, in particular if there is information that is supposed to expire at a fixed time i.e., the lifetime decrements inUNCREACHABLE state,real time. A host MUST NOT try to refresh information because its lifetime is near zero, since thatNCE shouldwould cause unnecessary RSs. Instead the refresh needs to bemarked as STALE. A default router keeps a cache for allbased on when thenodes' IP addresses, createdinformation was most recently received from the router. A lifetime of 10 minutes that was heard from theAddress Registration processing. The NEARrouterSHOULD deny registration to10 minutes ago might be normal as part of expiring some information. But anew registration requestremaining lifetime of 10 minutes for a prefix that was last heard 24 hours ago with a lifetime of 24 hours means that a refresh is in order. It is RECOMMENDED that thestatus code 2host track the expiry time (the wall clock time when some information will expire) and when itreaches the maximum capacity for handlingreceives an RA with that information check whether theneighbor cache. 10.1. Router Configuration Modes An efficiency-aware Router(NEAR) MUST be ableexpiry time is moving forward, or appears toconfigurebe frozen inefficiency-aware-only mode where it will expect all hosts register withtime. That can tell therouter following RS; thus NEAR will not support legacy hosts. However,difference between he first two cases above, and avoid unneccesary RSs as some information naturally expires. Furthermore itwill create legacy NCE for the routers inis RECOMMENDED that thenetwork assuminghost track which information was received from which router, so that it can see when a router used to provide therouters do not register withinformation no longer provides it.This mode is ableThat helps toprevent ND flooding onsee if thelink. An efficiency-aware Router(NEAR) SHOULDthird case above might beablein play. Finally, if a router has not responded tohave configuration knoba few (e.g., MAX_RTR_SOLICITATIONS) attempts toconfigure itself in Mixed-Mode where it will support both efficiency-aware hostsget a refresh, then the router might be unreachable or dead, andlegacy hosts. However eventhere is little benefit inmixed-modesending further RSs to that router. When the router comes back it will multicast a few RAs. When the hosts determines that case 1 above is likely, then it shouldcheckpick a reasonable time to ask forduplicate entriesrefreshes. The exact refresh behavior is not mandated by this specification, but the same implemention strategies as for refreshing address registrations in Section 8.7 can be considered. If theNCE before creating a new oneshost is unable to refresh the information andit should rate-limit creating new NCE based on requests fromas a result ends up with an empty default router list, or all the default routers are marked as UNREACHABLE by NUD, then thesamehostMAC address.MAY switch to sending initial multicast Router Solicitations as in Section 8.1. 8.10. Sleep and Wakeup TheRECOMMENDED default modeprotocol allows the sleepy nodes to complete its sleep schedule without waking up due to periodic Router Advertisement messages or due to Multicast Neighbor Solicitation for address resolution. The node registration lifetime SHOULD be related with its sleep interval period in order to avoid waking up in the middle ofoperationsleep for registration refresh. Depending on theefficiency-aware router is Mixed-mode. Though it cannot reapapplication, thefull benefitregistration lifetime SHOULD be equal to or integral multiple ofefficiency related optimization describeda node's sleep interval period. When a host wakes up it can combine movement detecting (DNA), NUD, and refreshing its Address Registration by sending a unicast NS with an ARO to its existing default router(s). 8.11. Receiving Redirects An EAH handles Redirect messages as specified inthis document. 10.2.[RFC4861]. 8.12. Movement Detection When a host moves from one subnet to another its IPv6 prefix changes and the movement detection is determined according to the existing IPv6 movement detection described in[DNA]. However, if the movement happens across different default routers[RFC6059]. 9. Router Behavior A NEAR follows [RFC4861] and applicable parts of [RFC6775] as follows inthe subnetthis section. A NEAR SHOULD support legacy hosts andthe node likesmixed mode as specified in this section by being able toregister with oneproxy Address Resolution and DAD. The NEAR SHOULD implement a knob to be able to disable this behavior. That knob can either be set to "mixed-mode" or to "no-legacy-mode". The RECOMMENDED default mode of operation for thedefault routers closestNEAR is Mixed-mode. A NEAR should be configured toits present location, it MUST send another registration requestadvertise prefixes without the on-link (L-bit) unset. Furthermore, any legacy routers attached to thenew default router. The new default router then first sendssame link as a NEAR should be configured the same way. That reduces the cases in mixed mode when multicast NStomessages are needed between legacy hosts and routers. 9.1. Router and/or Interface Initialization A NEAR multicasts some initial Router Advertisements at system startup or interface initialization as specified in [RFC4861] and itspeers with a link scopeupdates. The NEAR MUST join the all-nodes and all-routers multicastmessage to IPv6 address ff02::2 withaddresses. In mixed mode it MUST also join theARO option. 10.2.1. Registration ownership The subnet-local-routers check their respective NCE tablesolicited-node multicast address(es) for its addresses and also for all theparticular registration. IfRegistered NCEs. A NEAR picks a new Router Epoch if it has lost theregistration entry exists,Registered NCEs, which is typically theNEAR defaultcase for routerthen calculatesinitialization. Either the'age' ofRouter Epoch can be stored in stable storage and incremented on each router initialization, or theregistration by subtractingNEAR can pick a good random number on router initialization. The effect of occasionally picking thepresent time fromsame Router Epoch as before theregistration received time recorded atstate loss is that it will take longer for theNCE. The NEARrouterthen responds with a NA with ARO option Status being equalto3 and replacesbuild up its state of Registered NCEs. 9.2. Receiving Router Solicitations Periodic RAs SHOULD be avoided. Only solicited RAs are RECOMMENDED. An RA MUST contain the'registration lifetime' fieldSource Link-layer Address option containing Router's link-layer address (this is optional in [RFC4861]. An RA MUST carry any Prefix information option withthe 'age'L bit being unset, so that hosts do not multicast any NS messages as part ofregistration. Upon receivingaddress resolution. A new flag (E-flag) is introduced in theNA fromRA which theneighboring routershosts use to distinguish a NEAR from a legacy router. Unlike [RFC4861] which suggests multicast Router Advertisements, this specification optimizes theprospective default router determines its registration ownership. Ifexchange by always unicasting RAs in response to RSs. This is possible since theother router registration ageRS always includes a SLLA option, which ishigher than its own registration age, thenused by thecurrentrouteris consideredtohaveunicast themost recent registration ownership.RA. Ifboth routers registration age are zero or within MAX_REG_AGE_DIFFERENCE window, thentheTID field is usedNEAR has been configured todetermine the ownership. The higher valuesend an explicit set ofTID wins. Note thatIPv6 Registrar Addresses, or implements a Router Epoch, then theregistration ownership and local movement detection behavior inNEARrouter MUST be optionally configured.includes a RAO in all its RAs. 9.3. Periodic Multicast RA for legacy hosts The NEARrouters MAY implement this feature. Configuring this option is needed whenMUST NOT send periodic RA in no-legacy mode. In mixed mode the NEARrouters are usedneeds to send periodic multicast RAs as specified in [RFC4861] to support legacy hosts. 9.4. Multicast RA when new information When alow power and lossy network environment. 11. NCE Management in efficiency-aware Routers The use of explicit registrations with lifetimes plus the desirerouter has new information tonotshare (new prefixes, prefixes that should be immediately deprecated, etc) it MAY multicastNeighbor Solicitation messages for hosts implyup to MAX_INITIAL_RTR_ADVERTISEMENTS number of Router Advertisements. Note thatwe managesuch new information is not likely to reach sleeping hosts until those hosts refresh by sending a RS. 9.5. Receiving ARO The NEAR follows theNeighbor Cache entries slightly differently than in [ND]. This resultslogic intwo different types of[RFC6775] for managing the NCEs andthe types specify how those entries can be removed: Legacy: Entries that are subjectresponding to NS messages with thenormal rules in [ND]ARO option. The slight modification is thatallowinstead of using an EUI-64 as the key to check forgarbage collection when low on memory. Legacy entries are created only when there is no duplicate NCE.duplicates, the NEAR uses the IDS value plus the variable length Unique Interface Identifier value as the key. Inmixed-mode and efficiency-aware modeaddition thelegacy entries are convertedNEAR checks the new TID field as follows. The TID field is used together with age of a registration for arbitration between two routers to ensure freshness of theregistered entries upon successful processingregistration ofARO. Legacy type can be considered as uniona given target address. Same value ofgarbage-collectible and Tentative Type NCEs described in [6LOWPAN-ND]. Registered: EntriesTID indicates thathave an explicit registered lifetime and are kept until this lifetime expires or theyboth states of registration areexplicitly unregistered. Note that the typevalid. In case of a mismatch between comparable TIDs, theNCE is orthogonal to the statesmost recent TID wins. The TIDs are compared as specified in[ND].section 7 of [RFC6550]. 9.6. NCE Management in NEARs When a host interacts with a router by sending Router Solicitations that does not match with the existing NCE entry of any type, a Legacy NCE is first created. Once a node successfully registers with a Router the result is a Registered NCE. As Routers send RAs to legacy hosts, or receive multicast NS messages from other Routers the result is Legacy NCEs.There can only be one kind of NCE for an IP address at a time.A Router Solicitation might be received from a host that has not yet registered its address with the router or from alegacy[ND]legacy [RFC4861] host in the Mixed-modeofoperation.In the 'Efficiency-aware' only mode theThe router MUST NOT modify an existing Registered Neighbor Cache entry based on the SLLA option from the Router Solicitation. Thus, a router SHOULD create a tentative Legacy Neighbor Cache entry based on SLLA option when there is no match with the existing NCE. Such a legacy Neighbor Cache entry SHOULD be timed out in TENTATIVE_LEGACY_NCE_LIFETIME seconds unless a registration converts it into a Registered NCE. However, in 'Mixed-mode' operation, the router does not require to keep track of TENTATIVE_LEGACY_NCE_LIFETIME as it does not know if the RS request is from a legacy host orthe efficiency-aware hosts.from a EAH. However, it creates the legacy type of NCE and updates it to a registered NCE if the ARO NS request arrives corresponding to thelegacyLegacy NCE. Successful processing of ARO will complete the NCE creation phase. If ARO did not result in a duplicate address being detected, and the registration life-time is non-zero, the router createsandor updates theregisteredRegistered NCE for the IPv6 address. If the Neighbor Cache is full and new entries need to be created, then the router SHOULD respond with a NA with status field set to 2. For successful creation of NCE, the router SHOULD include a copy of ARO and send NA to the requestor with the status field 0. ATLLA(TargetTLLA (Target Link Layer) Option is not required with this NA. Typically for efficiency-aware routers (NEAR), theregistration life- timeRegistration Lifetime andEUI-64IDS plus Unique Interface Identifier are recorded in the Neighbor Cache Entry along with the existing information described in[ND].[RFC4861]. The registered NCE are meant to be ready and reachable for communication and no address resolution is required in the link.The efficiency-aware hostsAn EAH will renewtheirits registration tokeep maintain the state of reachability of theRegistered NCE at the router. However the router maydoperform NUDtotowards theidle or unreachableEAH hosts as per[ND]. In addition,[RFC4861]. Should NUD fail the NEARdefault routersMUSTassociateNOT remove the Registered NCE. Instead it marks it as UNREACHABLE. 9.7. Sending non-zero status in ARO If the Registration fails (due to it being arecord ofduplicate or theage ofNeighbor Cache being full), then theregistration. 'Age' isNEAR will send an NA with ARO having asimple waynon-zero status. However, it needs todetect movementsend that back to the originator of the failing ARO, and that host and link-layer address will not be present in the Neighbor Cache. The NEAR forms anode from local default routerNA with ARO, and then forms the link-layer address by using the content of the SLLA option in the NS, bypassing the Neighbor Cache toanother. 'Age' informationsend this error. 9.8. Timing out Registered NCEs The router SHOULDcontain System-time whenNOT garbage collect Registered Neighbor Cache entries since they need to retain them until theregistrationRegistration Lifetime expires. If a NEAR receives a NS message from the same host one with ARO and another without ARO then the NS message with ARO gets the precedence and the NS without ARO isfirst created or last refreshed. This system-timeignored. Similarly, if Neighbor Unreachability Detection on the router determines that the host isdeductedUNREACHABLE (based on the logic in [RFC4861]), the Neighbor Cache entry SHOULD NOT be deleted but be retained until the Registration Lifetime expires. If an ARO arrives for an NCE that is in UNCREACHABLE state, that NCE should be marked as STALE. The NEAR router SHOULD deny registration to a new registration request with the status code 2 when it reaches the maximum capacity for handling the neighbor cache. 9.9. Router Advertisement Consistency The NEAR follows section 6.2.7 in [RFC4861] by receiving RAs from other routers (NEAR and legacy) on thecurrent system-timelink. In addition todeterminethe"age"checks in that section it verifies that the prefixes to not have the L flag set, and that the Registrar Address options are consistent. Two RAOs are inconsistent if they contain the have a different Router Epoch and have some IPv6 Registration Addresses in common. 9.10. Sending Redirects A NEAR sends redirects (with target=destination) to inform the hosts of theregistrationlink-layer address of the nodes on the link. This can be disabled on specific link types for instance, radio link technologies with hidden terminal issues. 9.11. Providing Information to Routing Protocols If there is a routing protocols like RPL which wants visibility into the location of each IPv6 address, then this can be retrived from the Registered NCEs on the NEAR. 9.12. Creating Legacy NCEs In mixed-mode a NEAR will create Legacy NCEs when receiving RA, RS, and NS messages based on the source of those packets. When not itis usedmixed-mode it needs to create Legacy NCEs forage reporting withother routers by looking at those packets. 9.13. Proxy Address Resolution and DAD for Legacy Hosts This section applies in mixed mode. It does not apply in no-legacy mode. A NEAR in mixed mode MUST join all solicited-node for all Registered NCEs. The efficient-ND SHOULD continue to support the legacy IPv6 NeighboradvertisementSolicitation requests in the mixed mode. The NEAR router SHOULD act as the ND proxy on behalf of EAH hosts for the legacy nodes' NS requests forselectionEAH. This form ofregistration ownership amongproxying is to respond with a NA that has a TLLAO taken from thedefault-router contendersRegistered NCE for the target. Thus it is unlike ND Proxy as specified incase[RFC4389].(Implementations oflocal movement"Neighbor Discovery Proxies (ND Proxy)" [RFC4389] might proxy using their own MAC address as TLLA, but that is outside of thehost from one default-routerscope of this document.) In the context of this specification, proxy means: o Responding toanother inDAD probes for a registered NCE. A DAD probe from a legacy host would not contain any ARO, hence thesame subnet. 'Age'NEAR will assume it is alwaysconsidered zero forafresh registrationduplicate if the IPv6 target address has a Registered NCE. o Defending a registered address using NA messages with and ARO option and the Override bit set if the ARO option in the NS indicates either a different node (different IDS+Unique Interface Id) or a older registrationrefresh message. 11.1.(when comparing the TID). o Advertising a registered address using NA messages, asynchronously or as a response to a Neighbor Solicitation messages. o Looking up a destination on the link using Neighbor Solicitation messages in order to deliver packets arriving for the EAH. 10. Handling NDDOSDoS Attack IETF community has discussed possible issues with /64DOSDoS attacks on the ND networks when an attacker host can send thousands of packets to the router with an on-link destination address or sending RS messages to initiate a Neighbor Solicitation from the neighboring router which will create a number of INCOMPLETE NCE entries for non- existent nodes in the network resulting in table overflow and denial of service of the existing communications. The efficiency-aware behavior documented in this specification avoids the NDDOSDoS attacks by: o Having the hosts register with the defaultrouterrouter(s). o Having the hosts send their packets via the defaultrouterrouter(s). o Not resolving addresses for theRouting Solicitorrouting solicitor by mandating SLLA option along with RS o Checking for duplicates in NCE before the registration oChecking against the MAC-address and EUI-64 id is possible now for NCE matches oOn-link IPv6-destinations on a particular link must be registered else these packets are not resolved and extra NCEs are not createdIt is RECOMMENDED that Mixed-mode operation and legacy hosts SHOULD NOT be mixed in the IPv6 link inIn order toavoid the ND DOS attacks. For the general case of Mixed-mode the router does not create INCOMPLETE NCEs for the registered hosts, but it follows the [ND] steps of NCE states for legacy hosts. 12. Mixed-Mode Operations Mixed-Mode operation discusses the protocol behavior where the IPv6 subnet is composed with legacy IPv6 Neighbor Discovery compliant nodes and efficiency-aware IPv6 nodes implementing this specification. The mixed-mode model SHOULD supportget maximal benefits from thefollowing configurations inND-DoS protection from Address Registrations, theIPv6 link: o The legacy IPv6hosts andefficiency-aware-hosts in the network and a NEAR router o legacy IPv6 default-router and efficiency-aware hosts(EAH) in the link o one router is in mixed mode androuters on the linkcontains both legacy IPv6 hosts and EAH o A link contains both efficiency-aware IPv6 router and hosts and legacy IPv6 routers and hosts and each host should be ableneed tocommunicate with each other. In mixed-mode operation, a NEAR MUSTbeconfigured for mixed-mode in orderupgraded tosupport the legacy IPv6 hosts in the network. In mixed- mode, the NEAR MUST act as proxy for Neighbor Solicitation for DAD and Address Resolution on behalf of its registered hosts on that link. It should follow the NCE management for the EAH as described in this documentNEARs andfollow RFC 4861 NCE management for theEAHs, respectively. With some legacyIPv6 hosts. Both in mixed-mode and efficiency-aware mode, the NEAR sets E-bit flag in the RA and does not set 'L' on-link bit. If a NEAR receives NS message from the same host one with ARO and another without ARO then the NS message with ARO getshosts theprecedence. An efficiency-aware Host implementation SHOULD support falling back to legacy IPv6 node behavior when no efficiency-awareroutersare available in the network during the startup. If the EAH was operational in efficiency-aware modewill still need to create INCOMPLETE NCEs andit determines that the NEAR is no longer available, then it shouldsenda RS and find an alternate default router in the link. If no efficiency-aware router is indicated from the RA, then the EAH SHOULD fall back into RFC 4861 behavior. On the other hand, in the efficiency-aware mode EAH SHOULD ignore multicast Router Advertisements(RA) sent byNSs, which keeps the DoS opportunity open. However, with fewer legacyand Mixed-mode routers in the link. In mixed mode operation,hosts theRouter SHOULDlower rate limits can beable to do local movement detection basedapplied onARO from EAH hosts. For the legacy hosts, the mixed-mode router MAY follow classical IPv6 methodscreation ofmovement detection and MAY act as ND proxy by sending NA with 'O' bit.[RFC 3775] The routers that are running on efficiency-aware mode or legacy mode SHOULD NOT dynamically switch the mode without flushing the Neighbor Cache Entries. In mixed mode, the NEAR SHOULD have a configurable interval for periodic unsolicited router advertisements based on the media type. 13.INCOMPLETE NCEs. 11. Bootstrapping The bootstrapping mechanism described here is applicable for the efficiency-aware hosts and routers. At the start, the host uses its link-local address to send Router Solicitation and then it sends theNodeAddress RegistrationmessageOption as described in this document in order toformverify the IPv6 address. TheDuplicate address detection process shouldfollowing step 3 and 4 SHOULD beskipped ifrepeated for all thenetwork is guaranteed to have unique interface identifiers which is used to form anIPv6address.addresses that are used for communications. Node Router 0. |[Forms LL IPv6 addr] | 1. | ---------- Router Solicitation --------> | | [SLLAO] | 2. | <-------- Router Advertisement --------- | | [PIO + SLLAO] | | | 3. | ----- Address Registration (NS) --------> | | [ARO + SLLAO] | 4. | <-------- Neighbor Advertisement ------- | | [ARO with Status code] | 5. ====> Address Assignment Complete Figure 1: Neighbor Discovery Address Registration and bootstrappingIn the mixed mode operation, it is expected that logically there will be at least one legacy IPv6 router and another NEAR router present in the link. The legacy IPv6 router will follow RFC 4861 behavior and NEAR router will follow the efficiency-aware behavior for registration, NCE maintenance, forwarding packets from a EAH and it will also act as a ND proxy for the legacy IPv6 hosts querying to resolve a EAH node. A legacy IPv6 host and EAH are not expected to see a difference in their bootstrapping if both legacy and efficiency-aware functionalities of rotuers are available in the network. It is RECOMMENDED that the EAH implementation SHOULD be able to behave like a legacy IPv6 host if it discovers that no efficiency-aware routing support is present in the link. 14. Handling Sleepy Nodes The solution allows the sleepy nodes to complete its sleep schedule without waking up due to periodic Router Advertisement messages or due to Multicast Neighbor Solicitation for address resolution. The node registration lifetime SHOULD be synchronized with its sleep interval period in order to avoid waking up in the middle of sleep for registration refresh. Depending on the application, the registration lifetime SHOULD be equal to or integral multiple of a node's sleep interval period. 15. Duplicate Address Detection In efficiency-aware mode, there is no need for Duplicate Address Detection(DAD) assuming that the deployment ensures unique 64bit identification availability for each registered host. In the event of collision of EUI64 field of ARO by two registration requests, the later request is denied if the first one is a valid request. The denied EAH node SHOULD pick another alternative IPv6 address to register to prevent further registration denial. The method of assignment of alternate IPv6 address is out of scope of this document. In some networks there are multiple default routers and the registering node may move from one default router (where it was registered before) to another default router in the same subnet. Thus in order to differentiate between the duplicate request and the movement, the router checks the 64-bit MAC address and 'age' of the request. If there is an entry in the node already with 0 < 'age' < registration-life-time and the TID field of the existing entry and the new request is same12. Interaction withTID of the new request, it is a duplicate. If the default router does not have a registered entry for this host, it should check whether it is a local movement. Please see 'Mobility Consideration section' for details. 16. Mobility Considerations If the hosts move from one subnet to another, they MUST first de- register and then register themselves in the new subnet or network. If a node moves away without de-registration and returns to the network before the registration lifetime expires, its registration is still considered valid. For run-away nodes the registration expires after the lifetime expiry or due to unreachablity whichever comes first. Otherwise, the regular IPv6 Mobility [IPV6M]behavior applies. In the multiple default router scenario, a node may move from its current primary default router to a prospective primary default router. At this point, the default routers use Neighbor Advertisements(NA) to arbitrate the latest ownership of the registration of host. The ownership of registration is useful for the Border Routers if they participate in a routing protocol which advertises proximity preferences or adjusts its own forwarding preference based on the host registration. This kind of forwarding or routing mechanisms are useful for energy efficiency and performance of the networks. See 'Movement Detection' section for details. 17. Other Considerations 17.1.other protocols 12.1. Detecting NetworkAttachment(DNA)Attachment (DNA) IPv6DNA[DNA]DNA [RFC6059] uses unicastNDNS probes and link-layer indications to detect movement of its network attachments.Upon detecting link- layer indication, it sends a all-routers Solicitation message. WhenThat is consistent with thenode implementsmechanism in thisdocument along with DNA, it MUST send ARO option with its Neighbor Solicitationspecification to unicastmessage if the candidate router advertisement indicates that the router isaNEAR router. If the candiate router isNS when alegacy router then and it is the only choice then the EAHhostSHOULD adapt towakes up - this document recommends adding thelegacy behavior. However if EAH node implements DNA host capability as well, then it SHOULD give preferenceARO tothe NEAR routers in its candidate list of routers.that NS message. Thus the ND optimization solution will work seamlessly with DNA implementations and no change is required in DNA solution because of Neighbor Discovery updates. It is a deployment and configuration consideration as to run the network in mixed mode or efficient-mode.17.2. Proxying for Efficiency-Aware hosts12.2. DHCPv6 Interaction Theefficient-ND SHOULD continue to support the legacy IPv6 Neighbor Solicitation requestsprotocol mechanisms inthe mixed mode. The NEAR router SHOULD act as the ND proxy on behalf of EAH hosts for the legacy nodes' NS requests for EAH. In the context ofthisspecification, proxy ND means: defending a registered address over the backbone using NA messages with and ARO option and the Override bit set if the ARO option in the NS indicates either a different node (different EUI-64) or a older registration (when comparing the TID). o advertising a registered address over the backbone using NA messages, asynchronously or as a response to a Neighbor Solicitation messages. o Looking up a destination over the backbone in order to deliver packets arriving from the EAH host using Neighbor Solicitation messages. o Forwarding packets from the EAH over the backbone, and the other way around at a time if the devide has known sleeping periods or resides on a different link such as an LLN attacheddocument are orthogonal to thebackbone. Eventually triggering a look-up for a destination EAH that would not be registered at a given point of time, or as a verification of a registration. 17.3. DHCPv6 Interaction Co-existence with DHCP: For classical IPv6, if DHCPv6 or centraladdressallocationassignment mechanism in use. If DHCPv6 isused, then Neighbor Discovery autoconfiguration is notused forglobal address allocation. However, link-local duplicateaddressdetection, Neighbor solicitation, Neighbor unreachability detection are still used. Uponassignmentofby an EAH then, if there are one or more NEARs on the subnet, theIPv6-address from DHCPv6, aEAHnode SHOULD then registerwill replace theIP-addressDAD check specified in [RFC3315] withthe default router for avoiding Duplicate address detection andAddressResolution. For Legacy DHCPv6 nodes there is no changeRegistration as specified inbehavior. NOTE: DHCPv6 Server MUST be notified by NEAR for its efficiency-aware service interfaces. DHCPv6 server then SHOULD inform the DHCP requestor node about the default-rotuer capability during the address assignment period.this document. 12.3. Other use of Multicast Although the solution described in this document prevents unnecesary multicast messages in the IPv6 ND procedure, it does not affect normal IPv6 multicast packetsandnor the ability of nodes to join and leave the multicast group or forwarding multicast traffic or responding to multicast queries.18.12.4. VRRP InteractionTBD: This section will discuss if efficient ND mixed mode and efficiency mode require any special consideration withA VRRPfunction. 19. RPL Implications RPL [RFC6550] does not provide means for duplicate address detection and in particular does not have a conceptset ofunique identifier. Onrouters can operate with efficient-nd in two different ways: o Provide theother hand, RPL is designedillusion todiscover and resolve conflictshosts thatarise whenthey are amobile device changes its pointsingle router for the purposes ofattachment, with a sequence counter thatregistrations. No RAO isowned byneeded in that case. But thedevice and incremented at each new registration, called a DAOSequence. As we extend 6LoWPAN ND operation overpair needs some mechanism to synchronize their neighbor caches. Such abackbone and scale, theremechanism isa similar need to resolve the latest pointout ofattachmentscope ofa device, whetherthisdevice moves at layer 2 over a WIFI infrastructure, or at layer 3 within a RPL DODAG or from a DODAG to another one attached todocument. o Have thesame backbone.hosts register with each router independently. Inorder to cover all cases in a consistent fashion, this document requiresthata sequence counter call TID for Transaction ID and withcase thesimilar rules asVRRP router includes theRPL DAOSequence is added toRAO with theND registration. This document definesindividual IP addresses of theTID operations and RPL may userouters in thereserved fields for their purpose insidepair. No synchronization of theLLN. 20.neighbor caches are needed in that case. 13. Updated Neighbor Discovery Constants This section discusses the updated default values of ND constants based on[ND][RFC4861] section 10. New and changed constants are listed only for efficiency-aware-nd implementation. These values SHOULD be configurable and tunable to fit implementations and deployment. Router Constants: MAX_RTR_ADVERTISEMENTS(NEW) 3 transmissions MIN_DELAY_BETWEEN_RAS(CHANGED) 1 second TENTATIVE_LEGACY_NCE_LIFETIME(NEW) 30 secondsMAX_REG_AGE_DIFFERENCE(NEW) 50 msecondsHost Constants: MAX_RTR_SOLICITATION_INTERVAL(NEW) 60 seconds Also refer to[ENH-ND][RFC6583] ,[IMPAT-ND][RFC7048] and[6LOWPAN-ND][RFC6775] for further tuning of ND constants.21.14. Security Considerations These optimizations are not known to introduce any new threats against Neighbor Discovery beyond what is already documented for IPv6[RFC 3756].[RFC3756]. Section 11.2 of[ND][RFC4861] applies to this document as well. This mechanism minimizes the possibility of ND /64DOSDoS attacks in efficiency-aware mode. See Section11.1. 22.10. The mechanisms in this document work with SeND [RFC3971] in the no- legacy mode. In the mixed mode operation when a NEAR needs to respond to a legacy host sending a NS for a EAH, then SeND would not automatically fit. Potentially proxy SeND [RFC6496] could be used, but that would require explicit awareness and setup between the proxy and the proxied EAHs which seems impractical. The mechanisms in this specification are orthogonal to the address allocation thus works as well with SLAAC and DHCPv6 as the various privacy-enhanced address allocation specifications. In particular, using an EUI-64 for the Unique Interface Identifier in this protocol does not require or assume that the IPv6 addresses will be formed using the modified EUI-64 format. The mechanism uses a Unique Interface Identifier for the purposes of telling apart a re-registration from the same host and a duplicate/ conflicting registration from a different host. That unique ID is not globally visible. Currently the protocol supports DHCPv6 DUID and EUI-64 format for this I-D, but other formats which facilitate non-linkability (such as strong random numbers large enough to be unlikely to cause collisions) can be defined. 15. IANA Considerations A new flag (E-bit) in RA has been introduced. IANA assignment of the E-bit flag is required upon approval of this document.23.This document needs a new Neighbor Discovery option type for the RAO. 16. Changelog Changes fromdraft-chakrabarti-nordmark-energy-aware-nd-02:draft-chakrabarti-nordmark-energy-aware-nd-04: o Significantly simplified the description of the protocol. o Added clarificationthat SLLA is not required for ARO in a point-to-point linkon problem statement o Clarified that privacy and temporary addresses will be supported o Added an IDS field in thedocument is indeedARO to allow a DHCP Unique ID (DUID) as anoptimizationalternative to EUI-64, with room to define other (pseudo) unique identifiers. o Allowed router redirects forlegacy IPv6 NDNEAR. oAdressed editorialAddressed some of comments made in the 6man list. o Added RAO to handle VRRP andfixed typoes. Some more editorial work is neededsimilar cases when the default router list and registrar list needs to be different. o Addedanother usecase for Z-Wave example. Clarified 3GPP Networks related commentsRouter Epoch to cause re-registration onexisting ND optimizations. 24.NEAR state loss. o Specified considerations for when to refresh address registrations. o Specified considerations for when to refresh RA information. 17. Acknowledgements The primary idea of this document are from 6LoWPAN Neighbor Discovery document[6LOWPAN-ND][RFC6775] and the discussions from the 6lowpan working group members, chairs Carsten Bormann and Geoff Mulligan and through our discussions with Zach Shelby, editor of the[6LOWPAN-ND].[RFC6775]. The inspiration of such a IPv6 generic document came from Margaret Wasserman who saw a need for such a document at the IOT workshop at Prague IETF. The authors acknowledge the ND denial of service issues and key causes mentioned in the draft-halpern-6man-nddos-mitigation document by Joel Halpern. Thanks to Joel Halpern for pinpointing the problems that are now addressed in the NCE managementsection.discussion in this document. The authors like to thank Dave Thaler, Stuart Cheshire, Jari Arkko, Ylva Jading, Niklas J. Johnsson, Reda Nedjar, Purvi Shah, Jaume Rius Riu, Fredrik Garneij, Andrew Yourtchenko, Jouni Korhonen, Suresh Krishnan, Brian Haberman, Anders Brandt, Mark Smith, Lorenzo Colitti, DavidMilesMiles, Eric Vyncke, Mark ZZZ Smith, Mikael Abrahammsson, Eric Levy-Abignoli, and Carsten Bormann for their useful comments and suggestions on this work.25.18. Open Issues The known open issues are: o IPv6 link-local addresses are always on-link and in this version of the document that results in multicast NS messages. The techique used in 6LowPAN-ND is too restrictive (extract the link- layer address from the IID). Should we send link-locals to routers and depend on Redirect? o If the Router Epoch is critical then we will see a RAO in all the RAs sent by NEARs. In such a case we don't need the E-bit in the RA. o Editorial: Add Comparison with 6lowpan-nd and 4861? o When a router has new information for the RA, currently it takes a while to dissemitate that to sleeping nodes as this depends on when the hosts send a RS. We could potentially improve this is we could have an "information epoch number" in the ARO sent in the NA. But that only helps if the registrations are refreshed more frequently that the RA information. o Future? Currently if a router changes its information, a sleeping host would not find out when it wakes up and sends the NS with ARO. That could be improved if we fit the Router Epoch in NA/ARO. But there is no room for 16 bits. o A separate but related problem is with unused NCEs due to frequent IPv6 address change e.g., hosts which pick a different set of addresses each time they wake up. This document recommends that they be de-registered by the host. That could be made simpler by introducing some Host Epoch counter in the NS/ARO. 19. References25.1.19.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.[6LOWPAN-ND] Shelby, Z., Chakrabarti, S., Nordmark, E.,[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., andC. Bormann, "ND OptimizationsM. Carney, "Dynamic Host Configuration Protocol for6LoWPAN",IPv6 (DHCPv6)", RFC6775, November 2012. [ND]3315, July 2003. [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, "Neighbor Discovery for IP version6",6 (IPv6)", RFC 4861, September 2007.[LOWPAN][RFC4944] Montenegro,G. and N.G., Kushalnagar, N., Hui, J., and D. Culler, "Transmission of IPv6 Packets over IEEE 802.15.4networks",Networks", RFC 4944, September 2007.[LOWPANG] Kushalnagar, N. and G. Montenegro, "6LoWPAN: Overview, Assumptions, Problem Statement[RFC6775] Shelby, Z., Chakrabarti, S., Nordmark, E., andGoals",C. Bormann, "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)", RFC4919, August 2007. 25.2.6775, November 2012. 19.2. Informative References[IPV6][I-D.ietf-6man-resilient-rs] Krishnan, S., Anipko, D., and D. Thaler, "Packet loss resiliency for Router Solicitations", draft-ietf-6man-resilient-rs-02 (work in progress), October 2013. [I-D.ietf-6man-stable-privacy-addresses] Gont, F., "A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)", draft-ietf-6man-stable-privacy-addresses-17 (work in progress), January 2014. [I-D.vyncke-6man-mcast-not-efficient] Vyncke, E., Thubert, P., Levy-Abegnoli, E., and A. Yourtchenko, "Why Network-Layer Multicast is Not Always Efficient At Datalink Layer", draft-vyncke-6man-mcast-not-efficient-01 (work in progress), February 2014. [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6(IPv6),(IPv6) Specification", RFC 2460, December 1998.[DNA] Krishnan, S. and G. Daley, "Simple Procedures for Detecting Network Attachments in IPv6", RFC 6059, November 2010. [RFC6550] "RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks", RFC 6550, March 2012. [AUTOCONF] Thomson, S., Narten, T.,[RFC3756] Nikander, P., Kempf, J., andT. Jinmei,E. Nordmark, "IPv6Stateless Autoconfiguration",Neighbor Discovery (ND) Trust Models and Threats", RFC4862, September 2007. [SEND]3756, May 2004. [RFC3971] Arkko, J., Kempf, J., Zill, B., and P. Nikander,"Secure"SEcure NeighborDiscovery",Discovery (SEND)", RFC 3971, March 2005.[AUTOADHOC] Baccelli, E.[RFC4193] Hinden, R. andM. Townsley, "IP Addressing Model in Adhoc Networks",B. Haberman, "Unique Local IPv6 Unicast Addresses", RFC5889, September 2010. [NDDOS-halpern] Halpern, J., "IP Addressing Model in Adhoc Networks", draft-halpern-6man-nddos-mitigation-00.txt (work in progress),4193, October2011. [ENH-ND] Kumari, W., Gashinsky, I., Jaeggli, J.,2005. [RFC4389] Thaler, D., Talwar, M., andK. Chittimaneni,C. Patel, "Neighbor DiscoveryEnhancement for DOS mitigation", draft-gashinsky-6man-v6nd-enhance-02 (work in progress), October 2012. [IMPAT-ND] Nordmark, E. and I. Gashinsky, "Neighbor Unreachability Detection is too impatient", draft-ietf-6man-impatient-nud-05 (work in progress), October 2012. [IEEE] IEEE Computer Society, "IEEE Std. 802.15.4-2003", , October 2003. [PD] Miwakawya,Proxies (ND Proxy)", RFC 4389, April 2006. [RFC4862] Thomson, S.,"RequirementsNarten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, September 2007. [RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy Extensions forPrefix Delegation",Stateless Address Autoconfiguration in IPv6", RFC3769, June 2004. [RF]4941, September 2007. [RFC5175] Haberman, B. andB.R. Hinden, "IPv6 Router Advertisement Flagsoption",Option", RFC 5175, March 2008.[ULA] "Unique Local IPv6 Addresses", RFC 4193. [Resilient-RS][RFC6059] Krishnan,S., Anipko, D.,S. andD. Thaler, "Packet loss resiliencyG. Daley, "Simple Procedures forRouter Solicitations", draft-ietf-6man-resilient-rs-01 (workDetecting Network Attachment inprogress), May 2013. [IPV6M] Johnson, D.,IPv6", RFC 6059, November 2010. [RFC6275] Perkins, C., Johnson, D., and J. Arkko, "Mobility Support in IPv6", RFC 6275, July 2011.Appendix A. Usecase Analysis This section provides applicability scenarios where the efficiency- aware Neighbor Discovery will be most beneficial. Most likely the usecases will be detailed in a separate document. A.1. Data Center Routers on the link Efficiency-aware Routers and hosts are useful in IPv6 networks in the Data Center as they produce less signaling[RFC6496] Krishnan, S., Laganier, J., Bonola, M., andalso provides ways to minimize theA. Garcia- Martinez, "Secure Proxy NDflood of messages. Moreover, this mechanism will work with data-center nodes which are deliberately in sleep modeSupport forsaving energy. This solution will work well in Data Center Virtual network and VM scenarios where number of VLANs are very high and ND signalings are undesirably high due the multicast messaging and periodic Router Advertisments and Neighbor Unreachability detections. A.2. Edge Routers and Home Networks An Edge Router in the network will also benefit implementing the efficiency-aware Neighbor Discovery behavior in order to save the signaling and keeping track of the registered nodes in its domain. A BNG sits at the operator's edge network and often the BNG has to handle a large number of home CPEs. If a BNG runsSEcure Neighbor Discoveryprotocol and acts as the default router for the CPE at home, this solution will be helpful for reducing the control messages and improving network performances. The same solution can be run on CPE or Home Residential Gateways to assign IPv6 addresses to the wired and wireless home devices without the problem of ND flooding issues and consuming less power. It provides mechanism for the sleepy nodes to adjust their registration lifetime according to their sleep schedules. A.3. M2M Networks Any Machine-to-machine(M2M) networks such as IPv6 surveilance networks, wireless monitoring networks and other m2m networks desire for efficiency-aware control protocols and dynamic address allocation. The in-built address allocation(SEND)", RFC 6496, February 2012. [RFC6550] Winter, T., Thubert, P., Brandt, A., Hui, J., Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur, JP., andautoconfiguration mechanism inR. Alexander, "RPL: IPv6along with the default router capability will be useful for the simple small-scale networks without having the burden of DHCPv6 service andRoutingProtocols. A.4. Wi-fi Networks In Wi-fi networks, a multicast message will consume the wireless link on all Access Points around a switched fabric and will be transmitted at the lowest speed possible in order to ensure the maximum reception by all wireless nodes. This means that in an environment where bandwidth is scarce, a single multicast packet may consume the bandwidth for hundreds of unicast packets. The Wi-fi IPv6 hosts can act as efficiency-aware hosts and register with their nearest default router with NEAR behavior. This method reduces multicast operations in the wireless access points or routers by using this optimization. A.5. 3GPP Networks Section 9.2.1.1 of TS23.060 allows periodic RA and TS 123.401 stays silent about periodic RA while 3GPP TS29.061 recommends large values for minimum and maximum periodic router advertisements for reduced periodic mesages. Though RFC6459 describes best practices about IPv6 3GPP systems behavior, this ND optimization standard specification will be a helpful reference for 3GPP documents. LTE terminals (cell phones) may also benefit with reduced multicast messages described in this document in the wireless mode. A.6. Industrial Networks RPL [RFC6550] is usedProtocol forIndustrial wireless networks. A.7. SetLow-Power andforget offline network Home control modules designed for networked environments may be deployed in very simple settings like garden path lighting controlled by wireless lightLossy Networks", RFC 6550, March 2012. [RFC6574] Tschofenig, H. andmotion sensors. OnceJ. Arkko, "Report from thenetwork has been createdSmart Object Workshop", RFC 6574, April 2012. [RFC6583] Gashinsky, I., Jaeggli, J., andsensors have been associated with the light modules, the installer takes away the configuration tool which was used to set up the network. Most likely a ULA prefix is used, since multiple hops may be needed. None of the sensorsW. Kumari, "Operational Neighbor Discovery Problems", RFC 6583, March 2012. [RFC7048] Nordmark, E. andlight modules has the capability of handing out fresh prefixes. Thus, for a set-and-forget style off-line network to work, the nodes must be provided an infinite prefix lifetime since they have nowhere to ask for a fresh one.I. Gashinsky, "Neighbor Unreachability Detection Is Too Impatient", RFC 7048, January 2014. Authors' Addresses Samita Chakrabarti Ericsson San Jose, CA USA Email: samita.chakrabarti@ericsson.com Erik Nordmark Arista NetworksSan Jose,Santa Clara, CA USA Email: nordmark@sonic.net Pascal Thubert Cisco Systems Email: pthubert@cisco.com Margaret Wasserman Painless Security Email: mrw@lilacglade.org