Skip to content

Rogue Router Advertisement (IPv6)

1. Context & stakes

The IPv6 equivalent of rogue DHCP: forge RA/SLAAC messages.

IPv6 hosts autoconfigure from Router Advertisements, which are unauthenticated by default - the L3 twin of rogue DHCP. A forged RA makes every host on the link install the attacker as its default router and DNS, even on IPv4-only networks where IPv6 is merely enabled and unmonitored. RA Guard on switch ports is the countermeasure.

2. Theory

IPv6 hosts autoconfigure from Router Advertisement messages announcing the prefix, default gateway and (RDNSS) DNS. Like DHCP, RAs are unauthenticated, so a rogue RA makes the attacker the default router/DNS for the segment - the IPv6 twin of a rogue DHCP server. Even IPv4-only networks are exposed if hosts have IPv6 enabled.

3. Attack (PoC)

netlab-ipv6-ra attack --i-own-this-network --iface veth-host
  1. Emit forged RAs -> attacker gateway/DNS
  2. Malicious RDNSS option

4. Detection

netlab-ipv6-ra detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • RA Guard on access ports
  • SEND (Secure Neighbor Discovery)

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading