Analysis of IPv6 redirection Protocol Security Risks

In IPv6, the main function of redirection packets is to provide the correct route selection for nodes in the LAN. The host has certain routing information when it is started, but it is not necessarily optimal. The IPv6 redirection protocol router detects that IP data is transmitted through an unoptimal route, it notifies the host of the Optimal Path to the destination.

In an IPv6 network, a node in the LAN allows multiple routes to exist. The priority is determined as to who forwards the routes to. However, for packets sent to different destinations, the selection of the first hop route will affect the packet sending efficiency.

How IPv6 redirection works:

This type of message is sent from the router to the node in the LAN. Assume that the internal node A sends the data packet to the external node X. When router B receives the data packet and forwards it, B finds that he and A are out of A LAN, but this packet is not directly sent by A, but sent by another route C in the LAN, B will tell A that if you want to send the packet to X, it is better to send it directly to B. This is the meaning of target and destination in the message. In this example, target is the IPv6 address of B, and destination is the IPv6 address of X. Options can include the Mac address of B or the original IP packet forwarded by B for A. This IP packet may be helpful for the protocol at the transport layer. After receiving the Redir packet, A naturally changes the original route table and forwards the packet sent to X to B for forwarding.

Analysis of Security Risks of IPv6 redirection Protocol

The main function of the IPv6 redirection protocol is to ensure that the host has a dynamic, small, and optimal route table to improve the forwarding efficiency of packets. However, IPv6 redirection Protocol also lacks source address authentication. for malicious LAN nodes, IPv6 redirection packets can be used to achieve illegal redirection of data packets, thus implementing multiple attack measures. For example, it first disguise the router and then sends a Redir packet to inform the attacker that it is better to use its own route to send data packets to an Internet node, then the attacked node will forward the data packets to the malicious node, and the malicious node will not forward the packets to prohibit communication or perform some tampering.

The basic steps for malicious nodes to use IPv6 route redirection packets to achieve datagram redirection:

(1) disguised vro for malicious nodes

(2) Send Redir packets

(3) inform the attacker that the datagram sent to an Internet node is better than the one specified by the attacker.

(4) The attacked node modifies the route table and forwards the datagram to a malicious node.

(5) malicious nodes control the datagram of attackers

(6) implement other attack measures, such as discarding and tampering.