Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 10
Abstract: This document analyzes the security implications of employing IPv6 fragmentation with Neighbor Discovery (ND) messages. It updates RFC 4861 such that use of the IPv6 Fragmentation Header is forbidden in all Neighbor Discovery messages, thus allowing for simple and effective countermeasures for Neighbor Discovery attacks. Finally, it discusses the security implications of using IPv6 fragmentation with SEcure Neighbor Discovery (SEND) and formally updates RFC 3971 to provide advice regarding how the aforementioned security implications can be mitigated.
Publication Date: 2013-08-01
Status Note: Proposed Standard
DOI: 10.17487/RFC6980
Link: https://doi.org/10.17487/RFC6980
Author(s): Fernando Gont
Keyword(s): Vulnerabilities, Monitoring

Latest version of IETF RFC 6980

Document Versions — IETF RFC 6980

▶ IETF RFC 6980 (2013-08-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 3971 [Active*]
IETF RFC 4861 [Active*]
IETF RFC 6494 [Active*]

Bibliographic Reference(s)

SourceForge, "ramond", January 2009, < http://ramond.sourceforge.net/ >. EXTERNAL
Gont, F., "Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)", Work in Progress, November 2012. EXTERNAL
Gont, F., "Results of a Security Assessment of the Internet Protocol version 6 (IPv6)", DEEPSEC 2011 Conference, Vienna, Austria, November 2011, < http://www.si6networks.com/presentations/deepsec2011/ fgont-deepsec2011-ipv6-security.pdf >. EXTERNAL
SourceForge, "NDPMon - IPv6 Neighbor Discovery Protocol Monitor", July 2012, < http://ndpmon.sourceforge.net/ >. EXTERNAL
Gont, F., "Security Assessment of the Internet Protocol version 6 (IPv6)", UK Centre for the Protection of National Infrastructure, (available on request). EXTERNAL
IETF RFC 3756 [Active*]
RFC6104 — RFC6104 EXTERNAL
RFC6105 — RFC6105 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6980.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6980, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery. Available at https://doi.org/10.17487/RFC6980

Snippet:

IETF RFC 6980, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery. Available at https://doi.org/10.17487/RFC6980

HTML (ISO 690 compliant)

Preview:

IETF RFC 6980, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery. Available at https://doi.org/10.17487/RFC6980

Snippet:

<span class="citation"><cite>IETF RFC 6980</cite>, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery. Available at <a href="https://doi.org/10.17487/RFC6980" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6980</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6980, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery
doi: 10.17487/RFC6980
url: https://doi.org/10.17487/RFC6980

Snippet:

<li>
<cite id="bib-rfc6980">IETF RFC 6980</cite>, Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery
<span class="doi">10.17487/RFC6980</span>
</li>

Referenced By

IETF RFC 7066 [Active*]