+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence # | Lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Mobility options .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 9: Fast Binding Acknowledgment (FBack) Message
IP fields:
Source Address
The IP address of the Previous Access Router.
Destination Address
The NCoA
Status 8-bit unsigned integer indicating the disposition
of the Fast Binding Update. Values of the Status
field that are less than 128 indicate that the
Binding Update was accepted by the receiving node.
The following such Status values are currently
defined:
0 Fast Binding Update accepted
1 Fast Binding Update accepted but NCoA is
invalid. Use NCoA supplied in "alternate" CoA
Values of the Status field that are greater than or
equal to 128 indicate that the Binding Update was
rejected by the receiving node. The following such
Status values are currently defined:
128 Reason unspecified
129 Administratively prohibited
130 Insufficient resources
131 Incorrect interface identifier length
`K’ flag See RFC 3775 [3].
Reserved An unused field. MUST be set to zero.
Sequence Number
Copied from the FBU message for use by the MN in
matching this acknowledgment with an outstanding
FBU.
Lifetime The granted lifetime in seconds for which the
sender of this message will retain a binding for
traffic redirection.
Mobility Options
MUST contain an "alternate" CoA if Status is 1.
6.3.3. Fast Neighbor Advertisement (FNA)
A MN sends a Fast Neighbor Advertisement to announce itself to the
NAR. When the Mobility Header Type is FNA, the Payload Proto field
may be set to IPv6 to assist FBU encapsulation.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. Mobility Options .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 10: Fast Neighbor Advertisement (FNA) Message
IP fields:
Source Address
NCoA
Destination Address
NAR’s IP Address
Mobility Options
MUST contain the Mobility Header Link-Layer Address
of the MN in the MH-LLA option format. See Section
6.4.4.
The MN sends a Fast Neighbor Advertisement to the NAR, as soon as it
regains connectivity on the new link. Arriving or buffered packets
can be immediately forwarded. If NAR is proxying NCoA, it creates a
neighbor cache entry in REACHABLE state. If there is no entry, it
creates one and sets it to REACHABLE. If there is an entry in the
INCOMPLETE state without a Link-Layer Address, it sets it to
REACHABLE. During the process of creating a neighbor cache entry,
NAR can also detect if NCoA is in use, thus avoiding address
collisions. Since the FBU is encapsulated within the FNA when sent
from NAR’s link, NAR drops the FBU if it detects a collision.
The combination of NCoA (present in source IP address) and the Link-
Layer Address (present as a Mobility Option) SHOULD be used to
distinguish the MN from other nodes.
6.4. New Options
All the options are of the form shown in Figure 11.
The Type values are defined from the Neighbor Discovery options
space. The Length field is in units of 8 octets, except for the
Mobility Header Link-Layer Address option, whose Length field is in
units of octets in accordance with Section 6.2 in [3]. Option-Code
provides additional information for each of the options (See
individual options below).
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Option-Code | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ ... ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 11: Option Format
6.4.1. IP Address Option
This option is sent in the Proxy Router Advertisement, the Handover
Initiate, and Handover Acknowledge messages.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Option-Code | Prefix Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ IPv6 Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 12: IPv6 Address Option
Type 17
Length The size of this option in 8 octets including the
Type, Option-Code, and Length fields.
Option-Code 1 Old Care-of Address
2 New Care-of Address
3 NAR’s IP address
Prefix Length
The Length of the IPv6 Address Prefix.
Reserved MUST be set to zero by the sender and MUST be
ignored by the receiver.
IPv6 Address The IP address for the unit defined by the Type
field.
6.4.2. New Router Prefix Information Option
This option is sent in the PrRtAdv message to provide the prefix
information valid on the NAR.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Option-Code | Prefix Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Prefix +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 13: New Router Prefix Information Option
Type 18
Length The size of this option in 8 octets including the
Type, Option-Code, and Length fields.
Option-Code 0
Prefix Length
8-bit unsigned integer. The number of leading bits
in the Prefix that are valid. The value ranges
from 0 to 128.
Reserved MUST be set to zero by the sender and MUST be
ignored by the receiver.
Prefix An IP address or a prefix of an IP address. The
Prefix Length field contains the number of valid
leading bits in the prefix. The bits in the prefix
after the prefix length are reserved and MUST be
initialized to zero by the sender and ignored by
the receiver.
6.4.3. Link-Layer Address (LLA) Option
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Option-Code | LLA...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 14: Link-Layer Address Option
Type 19
Length The size of this option in 8 octets including the
Type, Option-Code, and Length fields.
Option-Code
0 wildcard requesting resolution for all nearby
access points
1 Link-Layer Address of the New Access Point
2 Link-Layer Address of the MN
3 Link-Layer Address of the NAR (i.e., Proxied
Originator)
4 Link-Layer Address of the source of the RtSolPr
or PrRtAdv message
5 The access point identified by the LLA belongs
to the current interface of the router
6 No prefix information available for the access
point identified by the LLA
7 No fast handovers support available for the
access point identified by the LLA
LLA The variable length Link-Layer Address.
Depending on the size of the individual LLA option, appropriate
padding MUST be used to ensure that the entire option size is a
multiple of 8 octets.
The New Access Point Link-Layer Address contains the Link-Layer
Address of the access point for which handover is about to be
attempted. This is used in the Router Solicitation for the Proxy
Advertisement message.
The MN Link-Layer Address option contains the Link-Layer Address of
an MN. It is used in the Handover Initiate message.
The NAR (i.e., Proxied Originator) Link-Layer Address option contains
the Link-Layer Address of the Access Router to which the Proxy Router
Solicitation message refers.
6.4.4. Mobility Header Link-Layer Address (MH-LLA) Option
This option is identical to the LLA option, but is carried in the
Mobility Header messages (i.e., FNA). In the future, other Mobility
Header messages may also make use of this option. For instance,
including this option in FBU allows PAR to obtain the MN’s LLA
readily. The format of the option when the LLA is 6 bytes is shown
in Figure 15. When the LLA size is different, the option MUST be
aligned appropriately. See Section 6.2 in [3].
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option-Code | Pad0=0 | LLA |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LLA |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 15: Mobility Header Link-Layer Address Option
Type 7
Length The size of this option in octets not including the
Type, Length, and Option-Code fields.
Option-Code 2 Link-Layer Address of the MN
LLA The variable length Link-Layer Address.
6.4.5. Neighbor Advertisement Acknowledgment (NAACK)
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Option-Code | Status |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 16: Neighbor Advertisement Acknowledgment Option
Type 20
Length 8-bit unsigned integer. Length of the option, in 8
octets. The length is 1 when NCoA is not supplied.
The length is 3 when NCoA is supplied (immediately
following the Reserved field).
Option-Code 0
Status 8-bit unsigned integer indicating the disposition
of the Fast Neighbor Advertisement message. The
following Status values are currently defined:
1 The New CoA is invalid.
2 The New CoA is invalid; use the supplied CoA.
The New CoA MUST be present following the
Reserved field.
128 Link Layer Address unrecognized.
Reserved MUST be set to zero by the sender and MUST be
ignored by the receiver.
The NAR responds to the FNA with the NAACK option to notify the MN to
use a different NCoA if there is address collision. If the NCoA is
invalid, the Router Advertisement MUST use the NCoA as the
destination address but use the L2 address present in the FNA. The
MN SHOULD use the NCoA if it is supplied with the NAACK option. If
the NAACK indicates that the Link-Layer Address is unrecognized, the
MN MUST NOT use the NCoA or PCoA and SHOULD start the process of
acquiring an NCoA at the NAR immediately.
New option types may be defined in the future.
7. Configurable Parameters
Parameter Name Default Value Definition
------------------- ---------------------- -------
RTSOLPR_RETRIES 3 Section 6.1.1
MAX_RTSOLPR_RATE 3 Section 6.1.1
FBU_RETRIES 3 Section 4
PROXY_ND_LIFETIME 1.5 seconds Section 6.2.2
HI_RETRIES 3 Section 6.2.1
8. Security Considerations
The following security vulnerabilities are identified, and suggested
solutions are mentioned.
1. Insecure FBU: In this case, packets meant for one address could be
stolen, or redirected to some unsuspecting node. This concern is
the same as that in an MN and Home Agent relationship.
Hence, the PAR MUST ensure that the FBU packet arrived from a node
that legitimately owns the PCoA. The access router and its hosts
may use any available mechanism to establish a security
association that MUST be used to secure FBU. The current version
of this protocol does not specify how this security association is
established. However, future work may specify this security