Ubuntu Manpage: flow6 - A security assessment tool for the IPv6 Flow Label field

name
synopsis
description
options
examples
author
copyright

NAME

       flow6 - A security assessment tool for the IPv6 Flow Label field

SYNOPSIS

       flow6 [-i INTERFACE] -d DST_ADDR [-S LINK_SRC_ADDR] [-D LINK_DST_ADDR] [-s SRC_ADDR[/LEN]] [-A HOP_LIMIT]
       [-P PROTOCOL] [-p PORT] [-W] [-v] [-h]

DESCRIPTION

flow6 performs a security assessment of the Flow Label generation policy of a target node. It is part of
the SI6 Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols.

flow6 sends a number of probe packets to the target node, and samples the Flow Label values of the
corresponding response packets. Based on the sampled values, it tries to infer the Flow Label generation
policy of the target.

The tool will first send a number of probe packets from single IPv6 address, such that the per-
destination policy is determined. The tool will then send probe packets from random IPv6 addresses (from
the same prefix as the first probes) such that the "global" Flow Label generation policy can be
determined.

The tool computes the expected value and the standard deviation of the difference between consecutive-
sampled Flow Label values (Labeln - Labeln-1) with the intent of inferring the Flow Label generation
algorithm of the target node.

If the standard deviation of [Labeln - Labeln-1] is 0, the Flow Label is assumed to be set to a constant
value, and the corresponding value is informed to the user. For small values of the standard deviation,
the Flow Label is assumed to be a monotonically-increasing function with increments of the "expected
value", and such "expected value" together with the standard deviation, are informed to the user. For
large values of the standard deviation, the Flow Label is assumed to be randomized, and the expected
value and standard deviation are informed to the user, as indicators of the "quality" of the Flow Label
generation algorithm.

OPTIONS

flow6 takes it parameters as command-line options. Each of the options can be specified with a short name
(one character preceded with the hyphen character, as e.g. "-i") or with a long name (a string preceded
with two hyphen characters, as e.g. "--interface").

-i INTERFACE, --interface INTERFACE
This option specifies the network interface that the tool will use. If the destination address
("-d" option) is a link-local address, the interface must be explicitly specified. The interface
may also be specified alon with a destination address, with the "-d" option.

-s SRC_ADDR, --src-address SRC_ADDR

This option specifies the IPv6 source address (or IPv6 prefix) to be used for the Source Address
of the probe packets. If an IPv6 prefix is specified, the IPv6 Source Address of the ICMPv6
packets will be randomized from that prefix.

-d DST_ADDR, --dst-address DST_ADDR

This option specifies the IPv6 Destination Address of the target node. This option cannot be left
unspecified.

-A HOP_LIMIT, --hop-limit HOP_LIMIT

This option specifies the Hop Limit to be used for the IPv6 packets. By default, the Hop Limit is
randomized.

-S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR

This option specifies the link-layer Source Address of the probe packets (currently, only Ethernet
is supported). If left unspecified, the link-layer Source Address of the packets is set to the
real link-layer address of the network interface.

-D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR

This option specifies the link-layer Destination Address of the probe packets (currently, only
Ethernet is supported). By default, the link-layer Destination Address is automatically set to the
link-layer address of the destination host (for on-link destinations) or to the link-layer address
of the first-hop router.

-P PROTOCOL, --protocol PROTOCOL

This option specifies the protocol type of the probe packets. Currently, both "UDP" and "TCP" are
supported. If this option is left unspecified, the protocol type defaults to "TCP".

-p PORT, --dst-port PORT

This option specifies the Destination Port of the probe packets. If left unspecified, the
Destination Port defaults to "80" when the IPv6 payload is TCP, and to 53 if the IPv6 payload is
UDP.

Note: Since it is vital for the tool to receive response packets to be able to infer the Flow
Label algorithm of the target, the protocol type and Destination Port should be carefully selected
(i.e., the corresponding protocol and Destination Port should not be filter, and the target should
respond to packets sent to that protocol/port).

-W, --flow-label-policy
This option instructs the tool to determine the Flow Label generation policy. As of this version
of the tool, this option must be specified.

-v, --verbose

This option instructs the flow6 tool to be verbose. If this option is set twice, the tool is
"very verbose", and outputs the sampled Flow Label values (in addition to other information).

-h, --help

Print help information for the flow6 tool.

EXAMPLES

       The following sections illustrate typical use cases of the flow6 tool.

       Example #1

       # flow6 -i eth0 --flow-label-policy -d fe80::1 -v

       Assess  the Flow Label generation policy of the host "fe80::1", using the network interface "eth0". Probe
       packets are TCP segments directed to port 80 (default). Be verbose.  In  this  example,  since  the  IPv6
       destination address is a link-local address, the network interface ccard must be explicitly specified.

       Example #2

       # flow6 -d 2001:db8::1 --flow-label-policy -P TCP -p 22 -vv

       Assess  the  Flow  Label  generation  policy  of  the  host "2001:db8::1". Probe packets are TCP segments
       directed to port 22. Be very verbose (i.e., list the sampled Flow Label values).

AUTHOR

       The flow6 tool and the corresponding manual pages were produced by Fernando Gont  <fgont@si6networks.com>
       for SI6 Networks <http://www.si6networks.com>.

COPYRIGHT

       Copyright (c) 2011-2013 Fernando Gont.

       Permission  is  granted  to  copy, distribute and/or modify this document under the terms of the GNU Free
       Documentation License, Version 1.3 or any later version published by the Free Software  Foundation;  with
       no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.  A copy of the license is available
       at <http://www.gnu.org/licenses/fdl.html>.

                                                                                                        FLOW6(1)