Re: [ssm] Document Action: An Overview of Source-Specific Multicast(SSM) Deployment to Informational

[Jean-Jacques Pansiot <Jean-Jacques.Pansiot@crc.u-strasbg.fr>]

Jon Zeeff wrote:
> 
> 
>> From my experience, windows XP does send IGMPv2 reports if it sees 
>> IGMPv2 queries.
>> It MUST do this according to the IGMPv3 spec.
> 
> 
> So if I do manage to get my LAN completely IGMPv3 capable and thus allow 
> the use of SSM, all it takes is one person
> plugging in a machine running IGMPv2 and SSM breaks.  This probably 
> means that SSM is unimplementable except
> in some special cases (example: one host per vlan).

Hi
this is not my understanding of IGMPv3 (and MLDv2).
The problem you describe occurs only if a router runs IGMPv2,
which should not be the case in a well managed network.
If all routers are running IGMPv3 (or MLDv2)
then the compatibility "downgrade" is per group (ie per multicast address) :
that is a group may use IGMPv2 if one member host is IGMPv2 only,
and another group on the same LAN may use IGMPv3 if all member hosts use IGMPv3.
Moreover, although it is not completely clear to me,
I think IGMPv3 capable hosts and routers should not downgrade to IGMPv2
for a multicast address in the SSM range.

I suppose that the main problem arises when a malicious user
runs a fake IGMPv2 router.

Jean-Jacques


> 
>> So, as far as easy gradual migration to SSM with DoS attack prevention 
>> is concerned,
>> this has almost completely been ignored by the IETF process.
> 
> 
> I see similar lack of concern about real world security in wireless 
> routing protocols (and DHCP and IPv6 and PIM and ...).
> 
> Thanks for the info.
> 
> _______________________________________________
> ssm mailing list
> ssm@ietf.org
> https://www1.ietf.org/mailman/listinfo/ssm



_______________________________________________
ssm mailing list
ssm@ietf.org
https://www1.ietf.org/mailman/listinfo/ssm