New Protocol, New Attack Surface
IPv6 was designed with security improvements over IPv4 — IPsec support is mandatory in the specification, and the elimination of broadcast removes certain amplification attack vectors. However, IPv6 also introduces new attack surfaces that security teams must understand.
NDP Spoofing (The New ARP Spoofing)
Just as ARP spoofing allowed man-in-the-middle attacks in IPv4, NDP spoofing allows the same in IPv6. An attacker can send unsolicited Neighbor Advertisements claiming to be the router, redirecting traffic through their machine. The mitigation is SEND (Secure Neighbor Discovery, RFC 3971), which uses cryptographic signatures to authenticate NDP messages — but SEND is complex to deploy and rarely used in practice.
The practical mitigation is RA Guard (RFC 6105) — a switch-level feature that blocks Router Advertisement messages from ports that are not designated router ports. This prevents rogue devices from advertising themselves as routers and hijacking traffic.
IPv6 Extension Headers
IPv6 uses extension headers to add optional functionality (routing, fragmentation, authentication). While elegant in design, extension headers have been abused for evasion — some firewalls fail to inspect packets with unusual extension header chains, allowing attackers to bypass security controls. Modern firewalls should be configured to drop packets with unrecognized or excessive extension headers.
Dual-Stack Bypass
In dual-stack environments, an attacker who controls a rogue IPv6 router can advertise themselves as the default IPv6 gateway. If the victim's OS prefers IPv6 (which it does by default), traffic flows through the attacker even if IPv4 security controls are properly configured. Security teams must apply equivalent controls to both IPv4 and IPv6 paths — a firewall rule that only filters IPv4 traffic provides no protection against IPv6-based attacks.
Scanning Challenges
IPv4 networks can be fully scanned in minutes (2³² addresses). IPv6 subnets are /64 by default — 2⁶⁴ addresses. Brute-force scanning is computationally infeasible. However, attackers use smarter techniques: scanning well-known addresses (like EUI-64 derived from known MAC OUI prefixes), scanning multicast groups (ff02::1 reaches all hosts on the link), and using DNS zone transfers to enumerate addresses. The lesson: do not rely on obscurity — use proper firewall rules and network segmentation.
Key Point: IPv6 security is not automatic. NDP spoofing replaces ARP spoofing as the primary Layer 2 attack vector. Dual-stack environments must apply security controls to both protocols equally — an IPv4-only firewall policy leaves IPv6 traffic completely uncontrolled. RA Guard is the most practical first defense against rogue router advertisements.