Is IPv6 more or less secure than IPv4? What attacks are new, and how do you defend against them?
Show the answer
Say this first
Neither. It has a different attack surface. The old myths are that IPsec makes it secure and that /64s cannot be scanned. The new risks are NDP spoofing and rogue RAs, NDP cache exhaustion on routers, extension header and fragment tricks to slip past filters, tunnels that bypass IPv4 policy, and IPv6 running unmanaged on "IPv4-only" networks. The defense is policy parity with IPv4, first hop security on the switches, /127s on links, NDP cache limits and a deliberate ICMPv6 policy.
Go deeper
Myths
- IPsec: support was once a MUST for nodes, never use. It is a SHOULD now.
- Unscannable: a /64 is too big to sweep blindly, but addresses leak. Low numbers (
::1,::10), EUI-64 with a known vendor OUI, DNS records, and NDP caches on a compromised host all narrow the search.
New or changed attacks
| Attack | How it works | Defense |
|---|---|---|
| Rogue RA | becomes the default gateway or adds a prefix | RA Guard |
| NA spoofing | claims another host's address (override flag) | ND inspection, SISF |
| DAD denial | answers every DAD probe | ND inspection |
| NDP cache exhaustion | scans a /64 so the router fills its cache with incomplete entries | /127 on links, ipv6 nd cache interface-limit, Destination Guard |
| Extension header evasion | hides the transport header beyond what the filter parses | drop undetermined-transport, drop RH0, rate-limit Hop-by-Hop |
| Tunnel bypass | 6in4 (protocol 41) or Teredo (UDP 3544) carry IPv6 through IPv4 policy | block them at the edge unless used |
The quiet one: IPv6 on an IPv4-only network
Windows prefers IPv6 and asks for DHCPv6 even when the network team never deployed IPv6. Tools such as mitm6 answer those requests, make themselves the DNS server and redirect traffic. Either deploy IPv6 properly with FHS, or block RAs and DHCPv6 server messages on access ports. Do not just hope it is unused.
Parity checklist
- Every IPv4 ACL and firewall rule has an IPv6 twin.
- Logging, NetFlow and IDS see IPv6.
- Management plane access lists cover IPv6 (VTY, SNMP, NTP).
They will ask next
Should we just disable IPv6 on Windows clients?
Microsoft does not recommend it and parts of Windows assume IPv6 is present. Controlling it on the network (RA Guard, DHCPv6 Guard, firewall policy) is the supported way.
Why does NDP cache exhaustion not happen with ARP?
It can, but an IPv4 /24 has 254 addresses and a /64 has 2^64. The router has to hold state while it resolves each scanned address, so a /64 can be used to fill the cache and starve real neighbors.
Traps
- Saying IPv6 cannot be scanned.
- Deploying IPv6 routing with no matching firewall policy.