<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body dir="auto">
Hello Jordi,
<div><br>
</div>
<div>Thank you for your feedback on both lists.</div>
<div>It’s important to note that the filter suggestion is not about the protocol, but about the 2002::/16 prefix.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
<div id="AppleMailSignature" dir="ltr">
<div style="text-align: left;direction: ltr; ">Amos</div>
<div><br>
</div>
Sent from my iPhone</div>
<div dir="ltr"><br>
On 14 May 2019, at 18:52, JORDI PALET MARTINEZ <<a href="mailto:jordi.palet@consulintel.es">jordi.palet@consulintel.es</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Cuerpo en alfa";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EstiloCorreo18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EstiloCorreo19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal"><span lang="ES-TRAD" style="mso-fareast-language:EN-US">Hi Amos,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ES-TRAD" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Just responded in another mailing list on this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">6to4 is still a valid protocol. IT SHOULD NOT be filtered. 6to4 uses the same protocol as other tunnels such as 6in4 (protocol 41).</span><span lang="EN-US" style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"><a href="https://www.ietf.org/rfc/rfc3056.txt"><span lang="EN-US" style="color:#954F72">https://www.ietf.org/rfc/rfc3056.txt</span></a></span><span lang="EN-US" style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black">It works fine for peer to peer applications.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black">What the IETF deprecated is anycast for 6to4 relays:<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"><a href="https://tools.ietf.org/html/rfc7526"><span lang="EN-US" style="color:#954F72">https://tools.ietf.org/html/rfc7526</span></a></span><span lang="EN-US" style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span lang="EN-US" style="color:black">I believe Hurricane Electric still hosts 6to4 relays.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;color:black"><br>
Regards,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US" style="font-size:10.5pt;color:black;mso-fareast-language:EN-US">Jordi<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US" style="font-size:10.5pt;color:black;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">El 14/5/19 17:32, "NANOG en nombre de Amos Rosenboim" <<a href="mailto:nanog-bounces@nanog.org">nanog-bounces@nanog.org</a> en nombre de
<a href="mailto:amos@oasis-tech.net">amos@oasis-tech.net</a>> escribió:<span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">Hello,</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">As we are trying to tighten the security for IPv6 traffic in our network, I was looking for a reference IPv6 ingress filter.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">I came up with Job Snijders suggestion (thank you Job) that can be conveniently found at whois -h
<a href="http://whois.ripe.net">whois.ripe.net</a> fltr-martian-v6</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">After applying the filter I noticed some traffic from 6to4 addresses (2002::/16) to our native IPv6 prefixes (residential users in this case).</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">The traffic is a mix of both UDP and TCP but all on high port numbers on both destination and source.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">It seems to me like some P2P traffic, but I really can’t tell.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">This got me thinking, why should we filter these addresses at all ?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">I know 6to4 is mostly dead, but is it inherently bad ?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">And if so, why is the prefix (2002::/16) still being routed ?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">I would love to hear some thoughts on this, and understand if others are actually filtering this at both data plane and control plane.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">Amos Rosenboim</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-size:11.0pt;color:black">-- </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
<br>
**********************************************<br>
IPv4 is over<br>
Are you ready for the new Internet ?<br>
<a href="http://www.theipv6company.com">http://www.theipv6company.com</a><br>
The IPv6 Company<br>
<br>
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of
the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents
of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br>
<br>
</div>
</blockquote>
</div>
</body>
</html>