ICMPv6 - Wireshark

ICMPv6Nalini ElkinsCEOInside Products, Inc.Nalini.elkins@insidethestack.com1

Agenda Changes ICMPv4 / ICMPv6 New ICMPv6 functions– Router discovery,– Prefix discovery,– Parameter discovery,– Address resolution,– Neighbor unreachability,– Duplicate Address Detection,– Redirect

Why ICMP? IP uses ICMP to convey errorinformation. Like what?

Why ICMP? IP uses ICMP to convey error information. Like what?– Host unreachable– Port unreachable– Firewall stopped the packet– There is a better way to get from here to there

ICMPv4 Messages Some ICMPv4 packets are ‘functional’ Like what?

ICMPv4 Messages Some ICMPv4 packets are ‘functional’ Like what?– Ping– Redirect– Sometimes called ‘informational’

ICMP messages are transferred through the network as the data portion of an IP datagram.This means that ICMP messages themselves can be lost.To avoid generation of error messages about error messages, new error messages about ICMP errorsare not generated.Each ICMP message has a slightly different format but the first 4 bytes are ALWAYS the same.

Hack – SMURF : ICMP ProtocolA SMURF Attack is a denial-of-servicenetwork attack (DoS) that is directedtowards some pre-determined target,usually a server.Any server that is plugged into a networkand can receive IP packets is vulnerable.These attacks come very quickly andpresent themselves as very hard to trace.

ICMP SMURFPING - PING ResponsePING - PING ResponseTCP/IP –NetworkPING - PING ResponseServerTCP App.DatasetsPING - PING ResponsePerforming a SMURF Attack involves: Creating an ICMP packet, usually an echo or a ping request packet, and placingthe victim's address in the return field (a forged packet). This packet is then broadcast onto the network, being received by several hostswho blindly reply to the victim with a response. The victim, now receiving several times its usual load, is overwhelmed withresponse packets.

Reflector Attacks Reflectors: All Web or DNS servers, and routers are potential reflectors,since they will return– SYN acks or RSTs in response to SYN or other TCP packets;– Query replies in response to query requests; or– ICMP Time Exceeded or– Host Unreachable in response to particular IP packets. By spoofing IP addresses from slaves — a massive distributed Denial ofService (dDoS) attack can be arranged.

What has changed?ICMPv4 Messages---- ----------0 Echo Reply3 Destination Unreachable4 Source Quench5 Redirect Message8 Echo Request11 Time Exceeded12 Parameter Problem13 Timestamp Request14 Timestamp Reply17 Address Mask Request18 Address Mask Reply

What has changed?ICMPv4 Messages---- ----------0 Echo Reply3 Destination Unreachable4 Source Quench5 Redirect Message8 Echo Request11 Time Exceeded12 Parameter Problem13 Timestamp Request14 Timestamp Reply17 Address Mask Request18 Address Mask Reply

ICMPv6 Error MessagesType Name---- -------------------------------1 Destination Unreachable2 Packet Too Big3 Time Exceeded4 Parameter ][RFC2463]Error messages have message types from 0 to 127.

ICMPv4 Error – Info Ratio Error messages : 90% Informational : 10%

ICMPv6 Error – Info Ratio Error messages : 20% Informational : 80%

ICMPv6 Info Messages Why? Informational : 80%–ARP gone!–Replaced by Neighbor discovery /Router discovery, Multicast ListenerDiscovery–Mobile IP

ICMPv6 Informational 9140141Name-------------------------Echo RequestEcho ReplyMulticast Listener QueryMulticast Listener ReportMulticast Listener DoneRouter SolicitationRouter AdvertisementNeighbor SolicitationNeighbor AdvertisementRedirect MessageRouter RenumberingICMP Node Info. QueryICMP Node Info. ResponseInverse Neighbor DiscoverySolicitation MessageType Name---- ------------------------142 Inverse Neighbor DiscoveryAdvertisement Message143 Version 2 Multicast ListenerReport144 Home Agent Address DiscoveryRequest Message145 Home Agent Address DiscoveryReply Message146 Mobile Prefix Solicitation147 Mobile Prefix Advertisement148 Certification Path Solicitation149 Certification Path Advertisement150 Experimental mobility protocols151 Multicast Router Advertisement152 Multicast Router Solicitation153 Multicast Router Termination

ICMPv6 Echo RequestDestination Address: Any legalIPv6 address.

ICMPv6 Echo Reply An Echo Reply SHOULD be sent in responseto an Echo Request message sent to an IPv6multicast address. The source address of the reply MUST be aunicast address belonging to the interface onwhich the multicast Echo Request messagewas received.

Ping to Multicast AddressesPinging ff02::1 with 32 bytes of data:Reply from ff02::1: time 1msReply from ff02::1: time 1msReply from ff02::1: time 1msReply from ff02::1: time 1msPing statistics for ff02::1:Packets: Sent 4, Received 4,Lost 0 (0% loss),Approximate round trip times inmilliseconds:Minimum 0ms, Maximum 0ms,Average 0msPinging ff02::2 with 32 bytes timedout.out.out.out.Ping statistics for ff02::2:Packets: Sent 4, Received 0,Lost 4 (100% loss),Did a Ping for Multicast address:FF02:0:0:0:0:0:0:2All Routers AddressDid a Ping for Multicast address:FF02:0:0:0:0:0:0:1All Nodes AddressDoes this mean my router is down?

Ping to www.kame.netPinging www.kame.net2001:200:0:8002:203:47ff:fea5:3085] with 32 bytes of data:Reply from 2001:200:0:8002:203:47ff:fea5:3085: time 227msReply from 2001:200:0:8002:203:47ff:fea5:3085: time 228msReply from 2001:200:0:8002:203:47ff:fea5:3085: time 250msReply from 2001:200:0:8002:203:47ff:fea5:3085: time 349msPing statistics for 2001:200:0:8002:203:47ff:fea5:3085:Packets: Sent 4, Received 4, Lost 0 (0% loss),Approximate round trip times in milli-seconds:Minimum 227ms, Maximum 349ms, Average 263msThe router stack SHOULD implement an echo reply but there is no MUST inthe RFC! Do not have to implement echo reply for multicast address.

IPv6 Destination UnreachableCodeMeaningDescription0No Route ToDestinationThe datagram was not delivered because it could not berouted to the destination. Since this means the datagramcould not be sent to the destination device's localnetwork, this is basically equivalent to the “NetworkUnreachable” message subtype in ICMPv4.1Communication WithDestinationAdministrativelyProhibitedThe datagram could not be forwarded due to filtering thatblocks the message based on its contents. Equivalent tothe message subtype with the same name (and Codevalue 13) in ICMPv4.3Address UnreachableThere was a problem attempting to deliver the datagramto the host specified in the destination address. Thiscode is equivalent to the ICMPv4 “Host Unreachable”code and usually means the destination address wasbad or there was a problem with resolving it into a layertwo address.4Port UnreachableThe destination port specified in the UDP or TCP headerwas invalid or does not exist on the destination host.ICMPv4 Dest Unreach Subcodes0:Network Unreachable1: Host Unreachable2: Protocol Unreachable4:Fragmentation Needed andDF Set5:Source Route Failed6: Destination NetworkUnknown7:Destination Host Unknown8:Source Host Isolated9:Communication with DestinationNetwork is AdministrativelyProhibited10:Communication with DestinationHost is Administratively Prohibited11:Destination Network Unreachablefor Type of Service12:Destination Host Unreachable forType of Service13:Communication AdministrativelyProhibited14:Host Precedence Violation15Precedence Cutoff In Effect

ICMPv6 Packet Too Big In IPv6, routers are not allowed tofragment datagrams that are toolarge to send over a physical link areconnected. Packet is dropped, and an ICMPv6Packet Too Big message sent.(minimum IPv6 MTU 1280 bytes) Used in Path MTU Discovery

Now, the more complicated ones!–Neighbor discovery,–Router discovery,–Multicast Listener Discovery

Stateless Autoconfiguration Stateless autoconfiguration allows a node to beconfigured without any configuration server. How? A node configures its own globallyroutable addresses in cooperation with a localIPv6 router. The address combines the 48- or 64-bit MACaddress of the adapter with network prefixesthat are learned from the neighboring router. In the case of multi-homed devices,autoconfiguration is performed for each interfaceseparately. Stateless autoconfiguration uses the NeighborDiscovery protocol.Example on Windows PC: result of IPConfigEthernet adapter Local Area Connection:Description : Realtek Family Fast Ethernet NICPhysical Address : 00-11-D8-39-29-2BAutoconfiguration Enabled . : YesIP Address : fe80::211:d8ff:fe39:292b%4

Stateless Autoconfiguration Steps 1 - 2 Link-Local Address Generation:The device generates a link-localaddress. Link-Local Address UniquenessTest:– Is someone using my address?– Sends Neighbor Solicitationmessage– Listens for a NeighborAdvertisement

Stateless Autoconfiguration Steps 3 - 4 Link-Local Address Assignment:– Can be used for communication on thelocal network, but not on internet orintranet. Router Contact:– Asks local router what to do– Sends Router Solicitation– Listens for Router Advertisement Router Direction:– Are we stateful / stateless– What prefix do we use?

Stateless Autoconfiguration Step 5 Global Address Configuration:– If using stateless autoconfiguration ,form global unicast address combiningnetwork prefix and MAC address (IID). Advantages:– Low administrative costs Disadvantages– Low administrative costs

Stateless Autoconfig on Windows To see stateless autoconfiguration at work, start with a Windows PC with no IPv6 enabled.Look at the IPconfig above.You see only IPv4 connectionsLet’s install IPv6.

After IPv6 Installed Successfully Notice whataddresses areassigned. Will we be able togo out over theinternet? What do you thinkis the MACaddress? Why did thishappen?

IPConfig with Global Unicast Addresses Will we beable to goout overtheinternet? Why didthishappen? NoticedefaultIPv6gateway.

Notice the sequence of events.Where is the MAC address?What is the Next Header field?What address do you think will be assigned? What kind of an address is ::?How about ff02::2?How about ff02::1:ff39:292b?And fe80::211:d8ff:fe39:292b?

What is a Neighbor? Two devices are neighbors ifthey are on the same localnetwork Either a host or a router.

What is Discovery? Not just who our neighbors are butalso important information aboutthem. Such as:– address resolution,– parameter communication,– autoconfiguration,– local network connectivity,– datagram routing and– configuration.NeighborsLocal NetworkWhat network prefix should Iuse?What MTU?How do I do autoconfiguration?Are you using the address that Iwant to use?

Neighbor Discovery Standards The Neighbor Discovery protocol originallydefined in RFC 1970 (1996) revised in RFC 2461(1998) and ongoing . Most of the functions of the ND protocol areimplemented using a set of four ICMPv6 controlmessages.Neighbor DiscoveryMessages - ICMPv6Router AdvertisementRouter SolicitationNeighbor Advertisement ND can use of the authentication and encryptionwith IPSecNeighbor Solicitation

ND Implementation – ICMPv6 ND implements its functions using ICMPv6messages.1. This is who I amRouterAtlanta1.2.3.4.Router Advertisement Messages: Sentregularly by routers to tell hosts that theyexist and provide important prefix andparameter information to them.Router Solicitation Messages: Sent byhosts to request that any local routerssend a Router Advertisement message sothey don't have to wait for the next regularadvertisement message.Neighbor Advertisement Messages:Sent by hosts to indicate the existence ofthe host and provide information about it.Neighbor Solicitation Messages: Sent toverify the existence of another host and toask it to transmit a NeighborAdvertisement.2. Tell me about youRouterAtlanta3. This is who I amHost1Host24. Tell me about youHost1Host2

Router Advertisement PacketSource Address : MUST be the linklocal address assigned to the interfacefrom which this message is sent.Destination Address: Typically theSource Address of an invoking RouterSolicitation or the all-nodes multicastaddress.