We’re currently involved in a number of IPv6 activities in different
organizations and one of the questions we are still facing – even in cases where
there’s already a (in most cases networking team driven/originated) “project”
(incl. budget, project sponsor, milestones etc.) – is along the lines of “How to
sell IPv6 to our management?”.
In the following I will shortly lay out the line of reasoning and the
terminology we usually employ for the task. Furthermore I’ve anonymized a
presentation which we recently prepared as “input” for the network team of an
enterprise organization;
it can be found here. In
case you want to get this as a PPT (for recyling purposes) pls send me a direct
email (in exchange, we might ask you for a small donation of your will to the
Troopers charity project…
).
Some weeks ago, at RIPE 68 in Warsaw,
Sander Steffann gave a
presentation about revising RIPE 554
which, in his own words, “is a template guideline for procurement of stuff that
should do IPv6” (here’s the
steganography transcript of the IPv6 working group session). Some of you will
probably know RIPE 554 as a quite
helpful document for identifying reasonable real-world requirements for IPv6
capable network devices (in particular at times when vendors quite willingly put
an “IPv6 ready” sticker on all their gear…).
Last October I had a quick look at pfSense 2.1
regarding the IPv6 support that it offers. It was the first stable support of
pfSense that offered the capability for IPv6 network connectivity (a few
comments about it can be found
here). However,
I knew that m0n0wall supported IPv6 quite a long time
ago and that their developers had incorporated the support of IPv6 features
which are not available in pfSense yet, so today I decided to have a look at it
too.
As it is well known to the IPv6 enthusiasts, one of the most significant changes
that IPv6 brings with it, apart from supporting a really huge address space, is
the improved support for Extensions and Options, which is achieved by the usage
of IPv6 Extension headers. According to
RFC 2460, “changes in the way IP
header options are encoded allows for more efficient forwarding, less stringent
limits on the length of options, and greater flexibility for introducing new
options in the future.” So, by adding IPv6 Extension headers, according to the
designers of the protocol, flexibility and efficiency in the IP layer is
improved.
I recently stumbled over a
document from
Microsoft which lists all services/applications that support IPv6. Most of the
content wasn’t new for me, but one item caught my attention. Windows Update. I
haven’t heard before that Windows Update can be done over IPv6 (but this could
just be me not looking hard enough ;)), so I was eager to test it out seeing if
this is really the case. I was also curious why Microsoft referenced this
document
in the respective column.
This is the third – and hence presumably last – part of the series of posts on
IPv6 address planning (first part can be found
here,
second one
here).
It’s split into three main pieces. In the beginning I will lay out some general
objectives to be considered when designing an address plan. Then I’ll have a
look at potential hierarchy levels and finally I’ll discuss some real-life
samples we’ve seen recently.
my name is Antonios and I am an independent IT Security Researcher from Greece.
One of my latest “hobbies” is IPv6 and its potential insecurities so, please let
me talk to you about my latest experience on this.
This week, I had the opportunity to work together with the ERNW guys at their
premises. They had built an IPv6 lab that included several commercial IPv6
security devices (firewalls, IDS/IPS and some high-end switches) and they kindly
offered their lab to me to play with (thank you guys 🙂 – I always liked
…expensive toys). The goal of this co-operation was two-fold: First, to test my
new (not yet released) IPv6 pen-testing tool and secondly, to try to find out
any IPv6-related security or operational issues on these devices (after all,
they all claim that they are “IPv6-Ready”, right?).
Within the last months I had some time to work on my code and today I’m
releasing some of that: a new version of dizzy as well as two new loki modules.
Dizzy is able to use neighbor
travis’ facedancer
to emulate a client device. Two fuzzing modes are available for USB descriptor
fuzzing and USB endpoint fuzzing.
Here is an example cmd to start usb configuration descriptor fuzzing:
Some of you may already know (the ones who are following Enno on
Twitter) that Enno and I had our lab day
in preparation for the
IPv6 Security Summit
at Troopers. We had a brand new and shiny Cat4948E
as our lab device to do some testing of the current generation of Cisco’s IPv6
First Hop Security (FHS) mechanisms. The Catalyst was running the latest image
available (15.1(2)SG3).
In this small blog post, we will take a look at the configuration and behavior
of IPv6 Snooping and DHCPv6 Guard. So let’s start with IPv6 Snooping:
This is the second part of the – presumably – three-part series on IPv6 address
planning which I started
here.
Before an enterprise organization (strictly speaking “their internal service
provider acting as LIR”, as laid out in the first part) starts assigning
prefix[es]/lengths to their networks usually another discussion has to be
undertaken & solved: “go with one /32 [PI space] from one RIR or apply for
/32s from several RIRs”.