Review of Security Vulnerabilities in the IPv6 Neighbor Discovery Protocol

Abstract

Internet Protocol version 6 (IPv6) contains a new protocol, Neighbor Discovery Protocol (NDP), that replaces Address Resolution Protocol (ARP) in Internet Protocol version 4 (IPv4), router discovery, and redirect. If implemented without any security mechanism, NDP contains vulnerabilities. Using spoofed Media Access Control (MAC) addresses in an NDP message, a malicious host can launch Denial-of -Service or Man-in-the-Middle attacks. IPv6 depends heavily on NDP, which appears in the network in the form of ICMPv6. If ICMP is disabled or dropped from the network, IPv6 does not operate, in contrast to IPv4. The importance of the NDP protocol in the IPv6 network is that it catches attackers’ attention on NDP vulnerabilities that they can exploit. This paper describes and reviews some of the fundamental attacks on NDP, prevention mechanisms, and current detection mechanisms for NDP-based attacks.