Re: Limit the number of Router Advertisements processed on an interface

--=-=-=
Content-Type: text/plain


Dheeraj Kandula <[email protected]> wrote:
    > *Why?*
    > This is to avoid DOS attacks using RAs from being bombarded onto a linux
    > machine.

Well, you might be able to rate limit them with ip6tables/nftables, but I see
no point in only listening to the first X of them. You might as well just
disable them and configure a static IPv6.

You should also check out "RAGuard" functionality on your L2 switch.
RFC6105.


--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQFFBAEBCgAvFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmKqASURHG1jckBzYW5k
ZWxtYW4uY2EACgkQgItw+93Q3WXWjAf9GUteQR1ZARLr4PkEngVFZjX9893y0Ul7
jHMJzHH2q+bQDffiiGLqOojf5NOm2BDoLj24B5vB53D8BjovytwvD38LOrpwk+Ts
pr6Bj8Rd5qk8Dhv+2IL/lSCrse+BbxPpjtvDakO+fXhcWD3C/eYaKhjFjV5qqFob
PZ2p6fuNxtnKJTa1PS3rre63jRqYZYKoColQgyASTPwukTO7MdLGlm/Xlaa55anz
+6RiH3xwWYr4c1VKKSi2gcNDwL/zR7jOtiS6moh6KXtb2JzPfBHo4C7bMrxR7Ft7
x33dE2TO/HmOLGri9kSl/mz6wH6XNBI4bOTT5vqtIQU2KproXO+dsg==
=T60x
-----END PGP SIGNATURE-----
--=-=-=--