IPv6 Router Advertisements Explained: SLAAC, NDP & Rogue RA Attacks (Animated)

Most networks have IPv6 switched on, whether the team planned it or not: Windows, macOS and Linux all enable it by default and prefer it over IPv4. Devices find their IPv6 router by listening for router advertisements, and nothing checks who sends them.

1. Router solicitation: “any ipv6 routers here?”

When it connects, the laptop sends an ICMPv6 router solicitation to the all-routers multicast address.

1. RS (Your laptop → everyone on the LAN): Every device hears it, including the attacker.

Wireshark filter:

icmpv6.type == 133

2. Router advertisement: the router answers with a prefix

The router replies with its prefix and says “use me as your default gateway”. The laptop builds its own address (SLAAC) and starts preferring IPv6.

1. RA (Router (real gateway) → Your laptop): The laptop now has an IPv6 address and gateway.

Wireshark filter:

icmpv6.type == 134

3. Rogue ra: attack: “i am the router now”

Any device can send router advertisements. An attacker announces itself with high priority, so hosts switch their IPv6 default gateway to the attacker. Because systems prefer IPv6, much of their traffic now flows through the attacker, even on a network everyone thought was IPv4-only.

1. RA (Attacker (same LAN) → Your laptop): A rogue advertisement with high priority.
2. HTTP (Your laptop → Attacker (same LAN)): Traffic now flows through the attacker, a man-in-the-middle over IPv6.

Wireshark filter:

icmpv6.type == 134 && !(eth.src == 00:1a:2b:00:00:01)

4. Ra guard: defence: only the router’s port may advertise

Enable RA Guard on access switches so router advertisements are only accepted from the port where the real router lives. Also monitor for unexpected RAs, and manage IPv6 deliberately rather than ignoring it.

1. RA (Attacker (same LAN) → Your laptop): The switch drops it.

Switch config (cisco):

ipv6 nd raguard policy HOSTS
 device-role host
interface range Gi1/0/1-48
 ipv6 nd raguard attach-policy HOSTS

FAQ