Changing the Default for Directed Broadcasts in Routers
draft-senie-directed-broadcast-03

INTERNET-DRAFT                                                  D. Senie
Category: BCP                                     Amaranth Networks Inc.
Updates: RFC 1812                                             March 1999
Expires in six months

        Changing the Default for Directed Broadcasts in Routers

Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups. Note that other
   groups may also distribute working documents as Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time. It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

Copyright Notice

   Copyright (C) The Internet Society (1999). All Rights Reserved.

1. Introduction

   Router Requirements [1] specifies that routers must receive and
   forward directed broadcasts. It also specifies that routers MUST have
   an option to disable this feature, and that this option MUST default
   to permit the receiving and forwarding of directed broadcasts.  While
   directed broadcasts have uses, their use on the Internet backbone
   appears to be comprised entirely of malicious attacks on other
   networks.

   Changing the required default for routers would help ensure new
   routers connected to the Internet do not add to the problems already
   present.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119.

2. Discussion

Senie                                                           [Page 1]

Internet-Draft    Default Change for Directed Broadcast     October 1998

   Damaging denial of service attacks led to the writing of [2] on
   Ingress Filtering. Many network providers and corporate networks have
   endorsed the use of these methods to ensure their networks are not
   the source of such attacks.

   A recent trend in Smurf Attacks [3] is to target networks which
   permit directed broadcasts from outside their networks. By permitting
   directed broadcasts, these systems become "Smurf Amplifiers."

   While the continued implementation of ingress filters remains the
   best way to limit these attacks, restricting directed broadcasts
   should also receive priority.

   Network service providers and corporate network operators are urged
   to ensure their networks are not susceptible to directed broadcast
   packets originating outside their networks.

   Mobile IP [4] had provisions for using directed broadcasts in a
   mobile node's use of  dynamic agent discovery. While some
   implementations support this feature, it is unclear whether it is
   useful. Other methods of achieving the same result are documented in
   [5]. It may be worthwhile to consider removing the language on using
   directed broadcasts as Mobile IP progresses on the standards track.

3. Recommendation

   Router Requirements [1] is updated as follows:

   Section 4.2.2.11 (d) is replaced with:

      (d) { <Network-prefix>, -1 }

      Directed Broadcast - a broadcast directed to the specified network
      prefix.  It MUST NOT be used as a source address.  A router MAY
      originate Network Directed Broadcast packets.  A router MAY have a
      configuration option to allow it to receive directed broadcast
      packets, however this option MUST be disabled by default, and thus
      the router MUST NOT receive Network Directed Broadcast packets
      unless specifically configured by the end user.

   Section 5.3.5.2, second paragraph replaced with:

      A router MAY have an option to enable receiving network-prefix-
      directed broadcasts on an interface and MAY have an option to
      enable forwarding network-prefix-directed broadcasts.  These
      options MUST default to blocking receipt and blocking forwarding
      of network-prefix-directed broadcasts.

Senie                                                           [Page 2]

Internet-Draft    Default Change for Directed Broadcast     October 1998

4. Security Considerations

   The goal of this document is to reduce the efficacy of certain types
   of denial of service attacks.

5. References

   [1] F. Baker, "Requirements for IP Version 4 Routers", RFC1812, June
   1995.

   [2] P. Ferguson, D. Senie, "Ingress Filtering", RFC 2267, January
   1998.

   [3] See the pages by Craig Huegen at:
   http://www.quadrunner.com/~chuegen/smurf.txt.

   [4] C. Perkins, "IP Mobility Support", RFC 2002, October 1996.

   [5] P. Calhoun, C. Perkins, "Mobile IP Dynamic Home Address
   Allocation Extensions", <draft-ietf-mobileip-home-addr-alloc-00.txt>,
   Work in progress, November 1998.

6. Acknowledgements

   The author would like to thank Brandon Ross of Mindspring and Gabriel
   Montenegro of Sun for their input.

6. Author's Address

   Daniel Senie
   Amaranth Networks Inc.
   324 Still River Road
   Bolton, MA 01740

   Phone: (978) 779-6813

   EMail: dts@senie.com

Senie                                                           [Page 3]