Ubuntu Manpage: rd6 - A security assessment tool for attack vectors based on ICMPv6 Redirect messages

NAME

       rd6 - A security assessment tool for attack vectors based on ICMPv6 Redirect messages

SYNOPSIS

       rd6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR]
       [-A  HOP_LIMIT]  [-y  FRAG_SIZE]  [-u  DST_OPT_HDR_SIZE]   [-U   DST_OPT_U_HDR_SIZE]   [-H
       HBH_OPT_HDR_SIZE]  [-r  RD_DESTADDR/LEN]  [-t  RD_TARGETADDR/LEN]  [-p  PAYLOAD_TYPE]  [-P
       PAYLOAD_SIZE] [-n] [-c HOP_LIMIT] [-x SRC_ADDR] [-a SRC_PORT] [-o DST_PORT] [-X TCP_FLAGS]
       [-q TCP_SEQ] [-Q TCP_ACK] [-V TCP_URP] [-w TCP_WIN] [-M] [-O] [-N] [-E LINK_ADDR] [-e] [-j
       PREFIX[/LEN]] [-k PREFIX[/LEN]]  [-J  LINK_ADDR]  [-K  LINK_ADDR]  [-b  PREFIX[/LEN]]  [-g
       PREFIX[/LEN]]  [-B  LINK_ADDR]  [-G  LINK_ADDR]  [-f]  [-R  N_DESTS]  [-T  N_TARGETS]  [-F
       N_SOURCES] [-L | -l] [-z] [-v] [-h]

DESCRIPTION

rd6 allows the assessment of IPv6 implementations with respect to a variety of attack
vectors based on ICMPv6 Redirect messages. This tool is part of the SI6 Networks' IPv6
Toolkit: a security assessment suite for the IPv6 protocols.

This tool has two modes of operation: active and passive. In active mode, the tool attacks
a specific target, while in passive mode the tool listens to traffic on the local network,
and launches an attack in response to such traffic. Active mode is employed if an IPv6
Destination Address, a Redirect Destination Address, and a Redirect Target Address are
specified. Passive mode is employed if the "-L" option (or its long counterpart
"--listen") is set. If both an attack target and the "-L" option are specified, the attack
is launched against the specified target, and then the tool enters passive mode to respond
incoming packets with ICMPv6 Redirect messages.

The tool supports filtering of incoming packets based on the Ethernet Source Address, the
Ethernet Destination Address, the IPv6 Source Address, and the IPv6 Destination Address.
There are two types of filters: "block filters" and "accept filters". If any "block
filter" is specified, and the incoming packet matches any of those filters, the message is
discarded (and thus no Redirect messages are sent in response). If any "accept filter" is
specified, incoming packets must match the specified filters in order for the tool to
respond with Redirect messages.

OPTIONS

rd6 takes it parameters as command-line options. Each of the options can be specified with
a short name (one character preceded with the hyphen character, as e.g. "-i") or with a
long name (a string preceded with two hyphen characters, as e.g. "--interface").

Depending on the amount of information (i.e., options) to be conveyed into the ICMPv6
Redirect messages, it may be necessary for the rd6 tool to split that information into
more than one Redirect message. Also, if the tool is instructed to e.g. flood the victim
with Redirect messages from different sources ("--flood-sources" option), multiple packets
may need to be generated. rd6 supports IPv6 fragmentation, which might be of use to
circumvent layer-2 filtering and/or Network Intrusion Detection Systems (NIDS). However,
IPv6 fragmentation is not enabled by default, and must be explicitly enabled with the "-y"
option.

-i INTERFACE, --interface INTERFACE
This option specifies the network interface that the tool will use. If the
destination address ("-d" option) is a link-local address, or the "listening"
("-L") mode is selected, the interface must be explicitly specified. The interface
may also be specified along with a destination address, with the "-d" option.

-s SRC_ADDR, --src-address SRC_ADDR

This option specifies the IPv6 source address (or IPv6 prefix) to be used for the
Source Address of the attack packets. This address typically corresponds to the
IPv6 link-local address of the default router. If the "-F" ("--flood-sources")
option is specified, this option includes an IPv6 prefix, from which random
addresses are selected. See the description of the "-F" option for further
information on how the "-s" option is processed in that specific case.

Note: Instead of specifying the "Source Address" with this option, the
"--learn-router" option could be set, such that the tool automatically learns the
IPv6 link-local address of the default router, and uses this address for the
"Source Address" of the Redirect messages.

-d DST_ADDR, --dst-address DST_ADDR

This option specifies the IPv6 Destination Address of the victim. It can be left
unspecified only if the "-L" option is selected (i.e., if the tool is to operate in
"Passive" mode).

When operating in passive mode ("-L" option), the IPv6 Destination Address is
selected according to the IPv6 Source Address of the incoming packet.

--hop-limit, -A

This option specifies the Hop Limit to be used for the Redirect messages. It
defaults to 255. Note that IPv6 nodes are required to check that the Hop Limit of
incoming Redirect messages is 255. Therefore, this option is only useful to assess
whether an IPv6 implementation fails to enforce the aforementioned check.

-y SIZE, --frag-hdr SIZE

This option specifies that the resulting packet must be fragmented. The fragment
size must be specified as an argument to this option.

-u HDR_SIZE, --dst-opt-hdr HDR_SIZE

This option specifies that a Destination Options header is to be included in the
resulting packet. The extension header size must be specified as an argument to
this option (the header is filled with padding options). Multiple Destination
Options headers may be specified by means of multiple "-u" options.

-U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE

This option specifies a Destination Options header to be included in the
"unfragmentable part" of the resulting packet. The header size must be specified as
an argument to this option (the header is filled with padding options). Multiple
Destination Options headers may be specified by means of multiple "-U" options.
This option is only valid if the "-y" option is specified (as the concept of
"unfragmentable part" only makes sense when fragmentation is employed).

-H HDR_SIZE, --hbh-opt-hdr HDR_SIZE

This option specifies that a Hop-by-Hop Options header is to be included in the
resulting packet. The header size must be specified as an argument to this option
(the header is filled with padding options). Multiple Hop-by-Hop Options headers
may be specified by means of multiple "-H" options.

-S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR

This option specifies the link-layer Source Address of the Redirect messages (this
option is only valid for Ethernet interfaces). If left unspecified, the link-layer
Source Address is randomized. However, if this option is left unspecified, but the
"--learn-router" option is set, the link-layer Source Address is set to that of the
default router for the local network.

-D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR

This option specifies the link-layer Destination Address of the Redirect messages
(this option is only valid for Ethernet interfaces). If left unspecified, it is set
to the "all-nodes link-local multicast" address (ff02::1).

When operating in passive mode, the link-layer Destination Address is set according
to the link-layer Source Address of the incoming packet.

--redir-target, -t

This option specifies the Target Address of the Redirect messages. If the "-T"
("--flood-targets") option is specified, this option specifies an IPv6 prefix in
the form "-t prefix/prefixlen". See the description of the "-T" option for further
information on how the "-t" option is processed in that specific case.

This option can be left unspecified only if the "--make-onlink" option is selected,
in which case the Redirect Target Address is set to the same value as the Redirect
Destination address.

--redir-dest, -r

This option specifies the Redirect Destination Address. If the "-R"
("--flood-dests") option is specified, this option specifies an IPv6 prefix in the
form "-r prefix/prefixlen". See the description of the "-R" option for further
information on how the "-t" option is processed in that specific case.

--payload-type, -p

This option specifies the payload type to be included in the Redirect Payload.
Currently supported payloads are "TCP", "UDP", and "ICMP6". The payload-type
defaults to "TCP".

--payload-size, -P

Size of the payload to be included in the Redirect message (with the payload type
being specified by the "-p" option). By default, as many bytes as possible are
included, without exceeding the minimum IPv6 MTU (1280 bytes).

--no-payload, -n

This option specifies that no payload (i-e-, no Redirected Header option) should be
included in the Redirect message.

--ipv6-hlim, -c

This option specifies the Hop Limit of the IPv6 packet included in the payload of
the Redirect message. It defaults to 255.

--peer-addr, -x

This option specifies the IPv6 Source Address of the Redirect payload. If left
unspecified, the IPv6 Source Address of the Redirect payload is set to the same
value as the IPv6 Destination Address of the packet. This option is only employed
for packets sent in "active" mode.

Note: this option might be useful to check whether an implementation validates the
contents of the Redirect message.

--redir-port, -o

This option specifies the Destination Port of the TCP or UDP packet contained in
the Redirect payload.

Note: This option is meaningful only if "TCP" or "UDP" have been specified with the
"-p" option.

--peer-port, -a

This option specifies the Source Port of the TCP or UDP packet contained in the
Redirect payload.

Note: This option is meaningful only if "TCP" or "UDP" have been specified with the
"-p" option.

--tcp-flags, -X

This option specifies the flags of the TCP header contained in the Redirect
payload. The flags are specified as "F" (FIN), "S" (SYN), "R" (RST), "P" (PSH), "A"
(ACK), "U" (URG), "X" (no flags). If left uspecified, only the "ACK" bit is set.