Network Working Group F. Xia Internet-Draft B. Sarikaya Expires: December 7, 2006 Huawei USA June 5, 2006 Duplicate Address Detection Optimization Using Enhanced Neighbor Discovery draft-xia-16ng-end-00 Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on December 7, 2006. Copyright Notice Copyright (C) The Internet Society (2006). Abstract This draft describes a possible optimization to Duplicate Address Detection (DAD) which can be used to successfully terminate DAD early. The method is based on a positive RA message sent by an access router that knows all the IPv6 addresses of the nodes currently attached to it. Xia & Sarikaya Expires December 7, 2006 [Page 1] Internet-Draft Enhanced Neighbor Discovery June 2006 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Existing Alternatives . . . . . . . . . . . . . . . . . . . . 5 3.1. A-DAD . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2. Optimistic DAD . . . . . . . . . . . . . . . . . . . . . . 5 3.3. MLD-DAD . . . . . . . . . . . . . . . . . . . . . . . . . 5 4. Scenario of Enhanced Neighbor Discovery . . . . . . . . . . . 6 4.1. Address cache . . . . . . . . . . . . . . . . . . . . . . 6 4.2. Relay DAD procedure . . . . . . . . . . . . . . . . . . . 6 4.3. Modifications to RFC-Mandated behavior . . . . . . . . . . 6 4.3.1. Neighbor Solicitation Message Format . . . . . . . . . 7 4.3.2. Router Advertisement Message Format . . . . . . . . . 7 4.4. Host (MS) Behavior . . . . . . . . . . . . . . . . . . . . 8 4.5. Access Router Behavior . . . . . . . . . . . . . . . . . . 9 4.6. Stateful Address Configuration . . . . . . . . . . . . . . 9 4.7. Timing Analysis . . . . . . . . . . . . . . . . . . . . . 9 5. Security Considerations . . . . . . . . . . . . . . . . . . . 10 6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11 6.1. Normative References . . . . . . . . . . . . . . . . . . . 11 6.2. Informative References . . . . . . . . . . . . . . . . . . 11 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 13 Intellectual Property and Copyright Statements . . . . . . . . . . 14 Xia & Sarikaya Expires December 7, 2006 [Page 2] Internet-Draft Enhanced Neighbor Discovery June 2006 1. Introduction IPv6 nodes can statelessly auto configure their own IP addresses on a network, based on the information sent by the IPv6 router of that network. When a node wishes to create a new address on an interface, it combines the network prefix obtained from the router with a suffix generated from its 64-bit Interface Identifier. This new untested address is referred to as a Tentative Address (TA). The node joins the appropriate solicited-node multicast group for this address, then sends a Neighbor Solicitation (NS) message containing the TA. If the TA is already in use by another node, that node will reply with a Neighbor Advertisement (NA) defending the TA. Once it has sent the NS, the node waits for RetransTimer [DISCOVERY] milliseconds to see if a defending NA is forthcoming, and this solicit-and-wait process is repeated DupAddrDetectTransmits [DISCOVERY] times. The default value of RetransTimer is 1000ms and by default the process is only done once, resulting a delay of 1000ms or 1s. This procedure provides a reasonable approach to checking address uniqueness in situations such as fixed installation, or even mobile web-browsing where 1s is not a significant delay. However, it is not tolerable for some time-critical mobile applications like Voice Over IP (VoIP). Xia & Sarikaya Expires December 7, 2006 [Page 3] Internet-Draft Enhanced Neighbor Discovery June 2006 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [STANDARDS]. node - a device that implements IPv6. host - a node that is not a router. router - a node that forwards IPv6 packets not explicitly addressed to itself MS - mobile station BRAS - Broadband Remote Access Server ASN-GW - Access Service Network Gateway, defined in WiMAX System Architecture access router - a router knowing all access hosts information about IP address, accounting, QoS and so on, e.g. BRAS, or ASN-GW END - Enhanced Neighbor Discovery MLD - Multicast Listener Discovery A-DAD - Advanced Duplicate Address Detection Xia & Sarikaya Expires December 7, 2006 [Page 4] Internet-Draft Enhanced Neighbor Discovery June 2006 3. Existing Alternatives 3.1. A-DAD An A-DAD capable router as per [draft-han-mobileip-adad-01] supplies address to a node from a pool of addresses which are known to be unique on the link. A host can safely configure this address without performing DAD, as the router has ensured that the address is unique. In order to provide the addresses for this pool, the router must create addresses based on random suffixes as per [PESAA] and undertake standard DAD on them. In essence, DAD is done in advance by the router. 3.2. Optimistic DAD The standard DAD strategy can be described as pessimistic, since the node delays all communication until it is confident that a new address is not a duplicate. [DISCOVERY] introduces the concept of Tentative (in Section 5.4) and Deprecated (in Section 5.5.4) addresses. Addresses that are neither are said to be Preferred. Tentative addresses may not be used for communication, and Deprecated addresses should not be used for new communications. [OPTDAD] introduces a new address state, 'Optimistic', that is used to mark an address that is available for use but that has not completed DAD. Unless noted otherwise, components of the IPv6 protocol stack should treat addresses in the Optimistic state equivalently to those in the Deprecated state, indicating that the address is available for use but should not be used if another suitable address is available. In essence, DAD is done in parallel. 3.3. MLD-DAD The Multicast Listener Discovery (MLD) [MLD] requires a node to send an MLD report before listening to the solicited-node multicast address. This process requires informing the router on a link about the presence of listeners for the address, so that a multicast group can be managed. The optimization described in [draft-daley-ipv6-mcast-dad-02] document allows a node to ask the router to tell it if it is the first node to enter this multicast group. If it is the first to enter the group, then it follows that no one else is currently performing DAD defense against the required unicast address. In essence, DAD is done in a positive way. Xia & Sarikaya Expires December 7, 2006 [Page 5] Internet-Draft Enhanced Neighbor Discovery June 2006 4. Scenario of Enhanced Neighbor Discovery In WiMAX architecture, an access router (ASN-GW) is the first IP attachment point for an MS. The ASN-GW knows all the IPv6 addresses of the nodes currently attached to it. The ASN-GW maintains an Address Cache containing all addresses on the IP link. The ASN-GW can receive all the packets sent by MSs irrespective of the destination address type (unicast/multicast). 4.1. Address cache Address Cache is a conceptual data structure managed by an ASN-GW that contains a list of addresses that are being used by the MSs. The entries can be created from information received in DAD Neighbor Solicitations or other way. The entries in the address cache can be deleted when there is an explicit deregistration message from the corresponding MS or another entity that is authorized to deregister on behalf of the MS 4.2. Relay DAD procedure Relay DAD is the procedure to perform when address collision occurs in architectures like WiMAX Network Architecture. To check an address, an MS sends Neighbor Solicitations as per [DISCOVERY] and [ADDRCONF]. Upon receiving the NS, the ASN-GW compares the tentative address in the NS against the entries in its Address Cache. If there is no match, the ASN-GW makes an entry for the (tentative) address in its Address Cache and sends a special Router Advertisement to the MS indicating the address's uniqueness, as will be descripted later. If there exists a match which indicates that the address is duplicate, the ASN-GW relays the NS to the address owner without any modification. Upon receiving the NS, the address owner replies with an NA to defend its address. The NA's Target Address is copied from the Target Address of the NS, the IP Source Address is also set to the Target Address of the NS and the IP Destination Address is set to the all-node multicast address. The ASN-GW relays the NA to the soliciting MS without any modification. Upon receiving the defending NA, the soliciting MS perceives the address conflict and refrains from assigning the tentative address to the interface. 4.3. Modifications to RFC-Mandated behavior 1. A "P" indication bit is added to the reserved section of NS. Xia & Sarikaya Expires December 7, 2006 [Page 6] Internet-Draft Enhanced Neighbor Discovery June 2006 2. A "P" indication bit is added to the reserved section of RA. 3. Some procedures change to deal with these bits. 4.3.1. Neighbor Solicitation Message Format The new NS message format is shown in Figure 1 where the extension proposed in this document is P bit. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Code | Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |P| Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | + + | | + Target Address + | | + + | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options ... +-+-+-+-+-+-+-+-+-+-+-+- Figure 1: Neighbor Solicitation Format The fields are as defined in [DISCOVERY]. P is one bit, SHOULD be set if an MS wants to get a positive reply. 4.3.2. Router Advertisement Message Format The new RA message format is shown in Figure 2 where the extension proposed in this document is P bit. Xia & Sarikaya Expires December 7, 2006 [Page 7] Internet-Draft Enhanced Neighbor Discovery June 2006 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Code | Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Cur Hop Limit |M|O|P|Reserved | Router Lifetime | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reachable Time | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Retrans Timer | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Prefix Information Option | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Other Options ... +-+-+-+-+-+-+-+-+-+-+-+- Figure 2: Router Advertisement Format The fields are as defined in [DISCOVERY], one bit (P bit) is added to the Reserved field. When an access router (ASN-GW) receives a NS with P bit set for DAD, it checks the Target Address in it's address cache, and finds that the address is unique, the access router SHOULD send a solicited RA. In this message, the P bit MUST be set, and a prefix information option MUST be included. The prefix information option is as defined in [DISCOVERY]. The prefix length MUST be set to 128. The prefix field MUST be filled with the Target Address of the NS used for DAD. When the MS(host) performing DAD receives this message, it SHOULD stop DAD process, and configure the address on it's interface. 4.4. Host (MS) Behavior With the P bit in NS and RA, a host(MS) can work in a very active way. That is, the host SHOULD send NS with P bit set, wait for a reply which could be an NA or RA, and set a timer. It SHOULD resend the NS if an NA or RA is not received in a given time interval, RetransTimer. This process SHOULD repeat a configurable number of times, DupAddrDetectTransmits. After retrying configured times, if there is still no reply, the host SHOULD stop retrying and abandon the address. In the WiMAX environment, END is an improvement to the normal DAD [ADDRCONF] and optimistic DAD defined in [OPTDAD]. Both of them are working in a passive mode, that is, if no defending NA is received, the detected address is considered unique. In fact, there are some other possibilities why a defending NA is not received, such as the solicited NS is lost, or the defending NA is lost. Xia & Sarikaya Expires December 7, 2006 [Page 8] Internet-Draft Enhanced Neighbor Discovery June 2006 A host which implements the enhanced neighbor discover (END) can interoperate with other nodes implementing [ADDRCONF] or [OPTDAD]. In a host, END and [OPTDAD] modes of operation MAY be enabled simultaneously. 4.5. Access Router Behavior When an access router (ASN-GW) receives an NS with P bit set for DAD, if it finds there is no such address in it's address cache, it SHOULD send a positive RA message with "P" bit set, else it MUST relay the message to the IP address owner. When a access router receives a normal NS without P bit set, if it finds that there is a such address in the address cache, it MUST relay the message to the IP address owner using Relay DAD, else it SHOULD ignore the message. 4.6. Stateful Address Configuration If a host configures its address using stateful address configuration and if DHCP server assures the uniqueness of the IPv6 address assigned, then ND procedure is not necessary, so END is not applicable. However if the address assigned may not be unique then the host MUST follow the procedure defined in Section 4.4 above. 4.7. Timing Analysis In normal DAD, the process defined in [DISCOVERY] and [ADDRCONF], takes DupAddrDetectTransmits*RetransTimer before the host can start using the address. In Optimistic DAD process [OPTDAD], as soon as an address is configured on an interface, the address can be used. That is, it takes 0 ms to use a tentative address with the risk of address collision. In case of END described in this memo, it takes a NS and RA round trip time so that an address can be determined unique in most cases. The round trip duration is much less than DupAddrDetectTransmits*RetransTimer. If END and [OPTDAD] are enabled, the host will benefit from both the reliability and time advantages. Xia & Sarikaya Expires December 7, 2006 [Page 9] Internet-Draft Enhanced Neighbor Discovery June 2006 5. Security Considerations There are existing security concerns with Neighbor Discovery and Stateless Address Auto configuration. Secure Neighbor Discovery (SEND) [SEND] provides protection against the threats to Neighbor Discovery described in [NDTM]. This memo does not introduce any additional threats to Neighbor Discovery. In Relay DAD, access routers relay NS and NA between MSs without modifying any contents of messages. The target address in Neighbor Advertisement and in solicited Router Advertisement is equal to the source address of the packet. MS can use CGAs for it's own address as defined [SEND]. MS can also use Authorization Delegation Discovery [SEND] to find an authorized access router (ASN-GW). Xia & Sarikaya Expires December 7, 2006 [Page 10] Internet-Draft Enhanced Neighbor Discovery June 2006 6. References 6.1. Normative References [ADDRCONF] Thomson, S. and T. Narten, "IPv6 Stateless Address Autoconfiguration", RFC 2462, December 1998, . [DISCOVERY] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998, . [MLD] Deering, S., Fenner, W., and B. Haberman, "Multicast Listener Discovery for IPv6", RFC 2710, October 1999, . [NDTM] Nikander, P., Kempf, J., and E. Nordmark, "IPv6 Neighbor Discovery (ND) Trust Models and Threats", RFC 3756, May 2004, . [OPTDAD] Moore, N., "Optimistic Duplicate Address Detection (DAD) for IPv6", RFC 4429, April 2006, . [PESAA] Narten, T. and R. Draves, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 3041, January 2001, . [SEND] Arkko, J., Kempf, J., Zill, B., and P. Nikander, "Secure Neighbor Discovery (SEND)", RFC 3971, March 2005, . [STANDARDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997, . 6.2. Informative References [draft-daley-ipv6-mcast-dad-02] Daley, G. and R. Nelson, "Duplicate Address Detection Optimization using IPv6 Multicast Listener Discovery", September 2003, . [draft-han-mobileip-adad-01] Xia & Sarikaya Expires December 7, 2006 [Page 11] Internet-Draft Enhanced Neighbor Discovery June 2006 Han, Y., Choi, J., Jang, H., and S. Park, "Advance Duplicate Address Detection", December 2003, . Xia & Sarikaya Expires December 7, 2006 [Page 12] Internet-Draft Enhanced Neighbor Discovery June 2006 Authors' Addresses Frank Xia Huawei USA 1700 Alma Dr. Suite 100 Plano, TX 75075 Phone: +1 972-509-5599 Email: xiayangsong@huawei.com Behcet Sarikaya Huawei USA 1700 Alma Dr. Suite 100 Plano, TX 75075 Phone: +1 972-509-5599 Email: sarikaya@ieee.org Xia & Sarikaya Expires December 7, 2006 [Page 13] Internet-Draft Enhanced Neighbor Discovery June 2006 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Xia & Sarikaya Expires December 7, 2006 [Page 14]