IPv6 Security Threats and Vulnerabilities: NDP, Rogue RA, DHCPv6 and Defense

IPv6 provides a much larger address space and introduces mechanisms such as Neighbor Discovery Protocol (NDP), Stateless Address Autoconfiguration (SLAAC), multicast-based discovery, and IPv6 extension headers.

These features are fundamental to IPv6 operation, but they also create security considerations that administrators must understand.

Common IPv6 security risks include:

• Neighbor Discovery spoofing
• Rogue Router Advertisements
• Router Advertisement flooding
• Rogue DHCPv6 servers
• IPv6 source-address spoofing
• Extension-header and fragmentation abuse
• ICMPv6 misuse
• Reconnaissance
• Dual-stack security gaps
• Uncontrolled transition mechanisms

IPv6 itself should not be considered inherently insecure.

The larger operational risk often appears when organizations deploy IPv6 while continuing to secure and monitor only IPv4.

For example, a workstation may have working IPv6 connectivity even though:

• IPv6 firewall rules were never reviewed.
• The IDS does not inspect IPv6.
• Vulnerability scans cover only IPv4.
• Network monitoring ignores IPv6.
• First-hop security is not enabled.

A secure deployment therefore requires IPv6 to be treated as a first-class production protocol.

Understanding the IPv6 Security Model

Several IPv6 mechanisms work differently from their IPv4 equivalents.

Understanding these differences is important before applying security controls.

Neighbor Discovery Protocol

IPv6 does not use ARP.

Instead, Neighbor Discovery Protocol, defined by RFC 4861, uses ICMPv6 to perform functions including:

• Neighbor discovery
• Link-layer address resolution
• Router discovery
• Neighbor reachability detection
• Duplicate Address Detection
• Redirect processing

Important Neighbor Discovery messages include:

Because these messages affect how hosts communicate on the local network, forged messages can cause significant disruption.

Stateless Address Autoconfiguration

SLAAC allows an IPv6 host to configure an address based on information advertised by routers.

Router Advertisements can communicate information such as:

• IPv6 prefixes
• Prefix lifetimes
• Default-router availability
• Hop-limit information
• Whether hosts should use DHCPv6 for additional configuration

This makes RA security especially important.

DHCPv6 and Router Advertisements Have Different Roles

A common IPv6 misconception is that DHCPv6 provides everything an IPv4 DHCP server traditionally provides.

It does not.

In normal IPv6 operation:

The default router is learned through Router Advertisements.

DHCPv6 may provide information such as:

• IPv6 addresses
• Prefix delegation
• DNS configuration
• Other DHCPv6 options

depending on the deployment.

NDP, Router Advertisement and DHCPv6 Attacks

Most important IPv6 first-hop attacks occur between systems sharing the same local Layer 2 network.

Neighbor Discovery Spoofing

Neighbor Discovery performs several functions that ARP and router-discovery mechanisms perform in IPv4.

An attacker on the same network segment may attempt to send forged Neighbor Advertisement messages.

For example, an attacker could falsely associate:

2001:db8:10::20

with the attacker’s own MAC address.

If another host accepts the false neighbor information, traffic intended for the legitimate system may be redirected.

Possible impacts include:

• Traffic interception
• Traffic redirection
• Denial of service
• Neighbor-cache poisoning

This is often described as:

NDP spoofing

or:

Neighbor Advertisement spoofing

NDP Is Primarily a Local-Link Attack Surface

Neighbor Discovery includes an important protection.

Valid ND messages use an IPv6 Hop Limit of:

255

A router forwarding a packet decreases the Hop Limit.

Therefore, an ND packet received with Hop Limit 255 provides evidence that the packet originated on the local link rather than being routed from a remote network.

This does not protect against a malicious host already connected to the local Layer 2 network.

NDP Inspection

Enterprise switches may provide IPv6 Neighbor Discovery inspection or equivalent first-hop-security capabilities.

These controls can build or use trusted IPv6 bindings and reject invalid ND traffic.

The exact implementation is vendor dependent.

Secure Neighbor Discovery

SEND — Secure Neighbor Discovery, defined by RFC 3971, adds cryptographic protections to Neighbor Discovery.

SEND includes mechanisms such as:

• Cryptographically Generated Addresses
• Digital signatures
• Router authorization mechanisms

SEND is a standards-defined option, but network administrators should verify actual operating-system and infrastructure support before designing their security architecture around it.

Rogue Router Advertisements

A malicious or incorrectly configured system can transmit fake Router Advertisements.

A rogue RA might cause hosts to:

• Select an unauthorized default router.
• Install an incorrect prefix.
• Change autoconfiguration behavior.
• Send traffic through an unintended system.
• Lose normal IPv6 connectivity.

A rogue host could therefore attempt an on-path attack by presenting itself as an IPv6 router.

Router Advertisement Flooding

An attacker can also send large numbers of Router Advertisements containing changing or bogus information.

Depending on the operating system and attack pattern, this can create:

• Multiple prefixes
• Multiple default-router entries
• Resource consumption
• Host configuration instability
• Connectivity problems
• Denial of service

RA Guard

Router Advertisement Guard protects Layer 2 access networks by allowing Router Advertisements only from approved router-facing interfaces.

The basic policy is:

Router ports → RA permitted

Host ports → Unauthorized RA blocked

RA Guard Must Understand Modern Evasion Techniques

Older RA Guard implementations could sometimes be bypassed using:

• IPv6 extension headers
• Fragmentation
• Complex header chains

RFC 7113 provides implementation guidance intended to address these evasion techniques.

RFC 6980 also restricts fragmentation of Neighbor Discovery messages.

Therefore, administrators should use current switch software and verify that their RA Guard implementation properly handles IPv6 extension-header chains rather than relying on outdated first-generation filtering behavior.

Rogue DHCPv6 Servers

A malicious host may attempt to operate as an unauthorized DHCPv6 server.

Depending on the environment, a rogue server could provide false:

• IPv6 addresses
• DNS server information
• DHCPv6 options
• Prefix-related information

Possible impacts include:

• DNS redirection
• Incorrect host configuration
• Connectivity loss
• Traffic redirection through services controlled by an attacker

Again, the IPv6 default router itself is normally learned through Router Advertisements rather than DHCPv6.

DHCPv6 Guard

RFC 7610 defines DHCPv6-Shield, while network vendors commonly provide features called:

DHCPv6 Guard

The concept is similar:

• DHCPv6 client messages are permitted from access ports.
• DHCPv6 server messages are accepted only from authorized server or relay-facing ports.

This prevents ordinary user ports from introducing rogue DHCPv6 servers.

Extension Headers, ICMPv6 and Source Spoofing

IPv6 also introduces security considerations beyond the first-hop network.

IPv6 Extension Headers

The IPv6 base header has a fixed structure.

Additional functionality can be carried using extension headers.

Examples include:

• Hop-by-Hop Options
• Destination Options
• Routing Header
• Fragment Header
• Authentication Header
• Encapsulating Security Payload

Extension headers are legitimate IPv6 protocol features.

However, attackers may attempt to use unusual header combinations to:

• Evade poorly implemented filtering
• Hide transport-layer information deeper in a packet
• Trigger implementation bugs
• Consume processing resources

Do Not Simply Block Every Extension Header

A blanket rule such as:

Drop all IPv6 extension headers

can break legitimate protocols and future IPv6 functionality.

A better approach is to:

• Permit required extension headers.
• Block clearly unnecessary or prohibited combinations according to policy.
• Use firewalls capable of processing the complete IPv6 header chain.
• Keep network-device software current.
• Test IDS/IPS visibility through extension headers.

Fragmentation

IPv6 handles fragmentation differently from IPv4.

Intermediate routers do not fragment ordinary IPv6 packets.

Fragmentation is performed by the source node using the IPv6 Fragment Header.

Attackers have historically used fragmentation to challenge:

• Firewalls
• IDS/IPS systems
• RA Guard implementations

Security controls should perform standards-compliant fragment handling and avoid making policy decisions without enough information to identify the relevant upper-layer protocol.

ICMPv6 Attacks

ICMPv6 is significantly more important to IPv6 operation than ICMP is often treated in IPv4 networks.

ICMPv6 supports functions including:

• Neighbor Discovery
• Router Discovery
• Error reporting
• Duplicate Address Detection
• Path MTU Discovery
• Multicast operations

Attackers can still abuse ICMPv6 through:

• Flooding
• Reconnaissance
• Malicious redirects
• Resource-exhaustion attempts
• Forged first-hop messages

Do Not Block All ICMPv6

Blocking ICMPv6 broadly can break legitimate IPv6 communication.

For example:

Packet Too Big

messages are important for Path MTU Discovery.

Neighbor Discovery also relies on ICMPv6.

RFC 4890 provides detailed recommendations for filtering ICMPv6 while preserving messages required for correct IPv6 operation.

A better strategy is:

• Allow required ICMPv6 types.
• Restrict link-local control messages to appropriate interfaces.
• Apply targeted filtering.
• Use control-plane protection where required.
• Monitor abnormal ICMPv6 volume.

Avoid indiscriminate rate limiting that interferes with required IPv6 control traffic.

IPv6 Source Address Spoofing

Like IPv4, IPv6 packets can contain forged source addresses unless controls prevent them.

Source spoofing can be used to:

• Hide the attack source
• Bypass poorly designed source-based policies
• Participate in denial-of-service attacks
• Generate misleading logs

Ingress and Egress Filtering

Networks should verify that source addresses are topologically valid.

At network boundaries:

Ingress filtering

can reject packets claiming impossible internal or external source addresses.

Egress filtering

can prevent internal systems from sending traffic using unauthorized source prefixes.

BCP 38 principles apply to IPv6 as well as IPv4.

IPv6 Source Guard

Some enterprise switches provide:

IPv6 Source Guard

This feature can validate source addresses against IPv6 binding information learned through mechanisms such as:

• Neighbor Discovery
• DHCPv6
• Device tracking

Unknown or unauthorized source addresses can then be blocked.

Reconnaissance, Dual-Stack and Hidden IPv6 Risk

IPv6’s enormous address space changes reconnaissance, but does not eliminate it.

IPv6 Network Scanning

A typical IPv6 /64 contains an enormous number of possible addresses.

Sequentially scanning every address is generally impractical.

However, attackers do not need to scan every address.

They can identify targets using:

• DNS records
• Application logs
• Public services
• Common addressing conventions
• Predictable interface identifiers
• Known router addresses
• Multicast discovery on the local link
• Addresses exposed by other protocols

RFC 7707 documents multiple IPv6 reconnaissance techniques.

IPv6 Privacy Addresses

IPv6 privacy extensions can generate temporary interface identifiers that change over time.

They can help reduce:

• Long-term client tracking
• Predictable client addressing

However, privacy addresses are not a replacement for:

• Firewall controls
• NAC
• Endpoint security
• Authentication
• Segmentation

They may also make security logging and asset correlation more complicated.

Dual-Stack Security Gaps

Many enterprise environments operate:

IPv4 + IPv6

simultaneously.

This is called:

Dual Stack

A major risk occurs when an organization protects IPv4 carefully but assumes IPv6 is unused.

An endpoint may still:

• Generate a link-local IPv6 address.
• Accept Router Advertisements.
• Communicate with IPv6 services.
• Prefer IPv6 for some destinations.

An attacker may therefore use IPv6 to bypass security controls that inspect only IPv4.

Examples include:

• IPv4-only firewall rules
• IPv4-only vulnerability scanning
• IPv4-only IDS signatures
• IPv4-only access controls
• Incomplete logging

Unknown IPv6 Assets

NIST specifically highlights the difficulty of detecting unauthorized or unmanaged IPv6 systems during IPv6 deployment.

Organizations should maintain inventory for:

• IPv6-enabled endpoints
• Routers
• Firewalls
• Servers
• Cloud networks
• Security appliances

Transition and Tunneling Mechanisms

IPv6 may also be transported through tunnels or transition mechanisms.

If an organization does not require a particular transition mechanism, leaving it enabled can create unnecessary complexity.

Security teams should determine:

• Which IPv6 transition technologies are actually required.
• Whether tunneled IPv6 is inspected.
• Whether endpoints can establish unmanaged tunnels.
• Whether firewall policy applies to encapsulated traffic.

RA Guard itself may not protect traffic hidden inside an IPv6 tunnel, so tunnel visibility requires separate security controls.

Securing and Monitoring an IPv6 Network

IPv6 security should be designed into the network rather than added after deployment.

Apply Security Policy to Both IPv4 and IPv6

For every IPv4 control, ask:

What is the equivalent IPv6 policy?

Review:

• Firewall policies
• ACLs
• IDS/IPS
• WAF
• Vulnerability scanning
• Endpoint controls
• NAC
• Network monitoring
• SIEM
• DDoS protection

Protect the First Hop

On enterprise access networks, evaluate:

• RA Guard
• DHCPv6 Guard
• ND inspection
• IPv6 Source Guard
• Device tracking

The exact feature names differ between network vendors.

Control Router Advertisements

Only legitimate router-facing ports should normally be allowed to originate RAs.

Host-facing ports should not become unauthorized IPv6 routers.

Protect DHCPv6

Allow DHCPv6 server or relay messages only from expected locations.

Filter IPv6 at the Network Boundary

IPv6 firewalls should enforce explicit inbound and outbound security policy.

Do not assume that IPv6’s lack of widespread NAT provides security.

Security should come from:

• Stateful firewall policy
• Network segmentation
• Access control
• Authentication
• Endpoint protection

rather than relying on address translation.

Handle ICMPv6 Correctly

Follow standards-based ICMPv6 filtering guidance.

Do not use a simplistic:

Block ICMPv6

policy.

Monitor IPv6 Neighbor Information

On Linux:

ip -6 neigh show

Display IPv6 addresses:

ip -6 addr show

Display IPv6 routes:

ip -6 route show

Unexpected default routes or neighbors can help identify configuration problems.

Capture ICMPv6

sudo tcpdump -ni any icmp6

This can help investigate:

• Router Advertisements
• Neighbor Discovery
• ICMPv6 errors
• Unexpected IPv6 control traffic

Useful Wireshark Filters

Display ICMPv6:

icmpv6

Router Advertisements:

icmpv6.type == 134

Neighbor Advertisements:

icmpv6.type == 136

DHCPv6:

dhcpv6

Key Takeaways and Summary

Key Takeaways

1. IPv6 is not inherently less secure than IPv4, but it introduces different protocols and operational risks.
2. Neighbor Discovery replaces several IPv4 mechanisms, including ARP-related address-resolution functionality.
3. Forged Neighbor Advertisements can be used for neighbor-cache poisoning and traffic redirection on the local link.
4. Rogue Router Advertisements can install incorrect routers, prefixes and configuration information.
5. RA Guard should be deployed on appropriate access ports and should handle modern extension-header and fragmentation evasion techniques.
6. DHCPv6 can provide addresses and configuration options, but the IPv6 default router is normally learned through Router Advertisements.
7. DHCPv6 Guard or DHCPv6-Shield can prevent unauthorized DHCPv6 server messages from untrusted ports.
8. ICMPv6 is fundamental to IPv6 operation and should not be indiscriminately blocked.
9. IPv6 extension headers are legitimate protocol features but must be correctly parsed by firewalls and IDS/IPS systems.
10. IPv6 source spoofing should be controlled using ingress/egress filtering and first-hop source-validation features where appropriate.
11. IPv6’s large address space makes exhaustive scanning harder but does not eliminate reconnaissance.
12. Dual-stack environments must provide equivalent security visibility and policy for both IPv4 and IPv6.

Summary

IPv6 changes several important areas of network operation.

Instead of ARP and traditional IPv4 router-discovery behavior, IPv6 relies heavily on:

• Neighbor Discovery
• Router Advertisements
• ICMPv6
• SLAAC
• DHCPv6
• IPv6 extension headers

These mechanisms introduce attack surfaces such as:

• NDP spoofing
• Rogue Router Advertisements
• RA flooding
• Rogue DHCPv6
• Source-address spoofing
• Extension-header evasion
• ICMPv6 abuse
• Reconnaissance

The strongest IPv6 security strategy is not to disable important IPv6 functionality.

It is to apply controls designed specifically for IPv6.

A well-protected IPv6 network should combine:

RA Guard + DHCPv6 Guard + ND inspection + Source Guard + Stateful Firewalling + Correct ICMPv6 Filtering + IDS/IPS + Monitoring + Segmentation

Dual-stack environments require particular attention.

Security teams should never assume that protecting IPv4 automatically protects IPv6.

Both protocol families need:

• Asset inventory
• Security policy
• Visibility
• Logging
• Vulnerability management
• Incident detection

The key principle is simple:

If IPv6 traffic can exist in the environment, IPv6 security controls and monitoring must exist too.

Useful Links and References

SanchitGurukul Static Resources

Official External References