Routing Loop Attack Using IPv6 Automatic Tunnels: Problem Statement and Proposed Mitigations (RFC 6324) Po-Kang Chen Oct 19,

Introduction Internet Protocol Version 6 (IPv6) – Because of the IPv4 exhaustion Transition Mechanisms – Dual Stack – Tunneling – Translator Transition Mechanisms Dual Stack TunnelingTranslator 2

Introduction (cont.) Tunneling mechanism 3 IPv6 Header Transport Layer Header Data IPv6 Header Transport Layer Header Data IPv4 Header Encapsulating IPv6 in IPv4

Introduction (cont.) Protocol-41 (RFC 4213) – ISATAP – 6to4 – 6RD 4

Routing Loop Attack Denial of Service Attack (DoS - RFC 4732) How can it occur? – Misconfiguration – Malicious attack 5

Routing Loop Attack (cont.) IPv6IPv4 Router 1 Router 2 src = Prf1 + IP2 dst = Prf2 + IP1 IPv6 src = Prf1 + IP2 dst = Prf2 + IP1 IPv6 src = IP2 dst = IP1 IPv4 src = Prf1 + IP2 dst = Prf2 + IP1 IPv6 6

Routing Loop Attack (cont.) Mitigations – Verification of Endpoint Existence – Operational Measures – Destination and Source Address Checks Security Issue – The mitigation checks do not introduce new security threats. 7

Reference RFC 4213 RFC