Or: When Cisco ACL Can Count Up to Five 🙂
This is a guest post by Antonios Atlasis.
Hi all,
RA Guard Evasion is well-known in the IPv6 “circles”; there is
RFC 7113 Advice for IPv6 Router
Advertisement Guard (RA-Guard) and many interesting blog-posts like this
one here,
here,
and this excellent write-up
here that discuss
this issue.
Moreover, as Jim Smalls states in his comprehensive
“IPv6 Attacks and Countermeasures”
presentation given at the
North American IPv6 Summit 2013,
DHCPv6 Guard or a corresponding IPv6 ACL can stop a DHCPv6 Rogue Servers, but
(only?) for non-malicious/non-fragmented DHCPv6 packets (slide 35). However, at
that time there wasn’t any known attack tool in the wild that had the
fragmentation evasion built in.