FRAG6(1)

💖 FRAG6(1) 💖

okay bestie, welcome to FRAG6(1), straight out of the General Commands Manual — this is the page for frag6, and it is a lot, so hydrate first 🫶

---

🌸 NAME 🌸

frag6 — a security assessment tool for IPv6 fragmentation ✨

---

🦋 SYNOPSIS 🦋

frag6 [-i INTERFACE] -d DST_ADDR [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR]
[-s SRC_ADDR[/LEN]] [-A HOP_LIMIT] [-u DST_OPT_HDR_SIZE] [-U
DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-P FRAG_SIZE] [-O FRAG_TYPE]
[-o FRAG_OFFSET] [-I FRAG_ID] [-T] [-n] [-p | -W | -X | -F N_FRAGS] [-l]
[-z SECONDS] [-v] [-h]

---

💜 DESCRIPTION 💜

so <pink>frag6</pink> is a security assessment tool for attack vectors that ride on IPv6 fragments. it's part of the SI6 Networks' IPv6 Toolkit — which is, and I mean this, a security assessment and trouble-shooting suite for the IPv6 protocols. iconic behavior, honestly 👑

---

✨ OPTIONS ✨

frag6 takes its parameters as command-line options. every single one of them can be written either as a short name (one character, with a single hyphen in front, like -i) or as a long name (a whole string, with two hyphens in front, like --interface). pick your fighter 💅

• -i INTERFACE, --interface INTERFACE — tells the tool which network interface to use. ⚠️ if your destination address (that's the -d option) is a link-local address, you have to specify the interface explicitly, no skipping. you can also hand over the interface together with a destination address, via the -d option.
• -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — sets the link-layer Source Address of the probe packets. if you don't say anything, it just uses the real link-layer address of the network interface. lowkey the default is fine 🎀
• -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — sets the link-layer Destination Address of the probe packets. by default it's set automatically — either to the link-layer address of the destination host (for on-link destinations) or to the link-layer address of the first-hop router. it literally handles it for you 🫶
• -s SRC_ADDR, --src-address SRC_ADDR — sets the IPv6 source address (or an IPv6 prefix, note the difference bestie) used as the Source Address of the outgoing packets. if you hand it an IPv6 prefix, the source address of each outgoing packet gets randomized from inside that prefix. chaos, but make it structured ✨
• -d DST_ADDR, --dst-address DST_ADDR — the IPv6 Destination Address of the target node. 🚨 this one cannot be left unspecified. it's giving mandatory. periodt.
• -A HOP_LIMIT, --hop-limit HOP_LIMIT — sets the Hop Limit for the IPv6 packets. by default the Hop Limit is randomized 🎲
• -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — says "please include a Destination Options header in the outgoing packet(s)". the extension header size has to be given as the argument to this option (the header gets filled with padding options). and yes, you can stack multiple Destination Options headers by passing multiple -u options 💅
• -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — same idea, but for a Destination Options header inside the "unfragmentable part" of the outgoing packet(s). size goes in as the argument (filled with padding options). multiple Destination Options headers? pass multiple -U options, go off 💖
• -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — asks for a Hop-by-Hop Options header in the outgoing packet(s). size as the argument (yep, filled with padding options). multiple Hop-by-Hop Options headers via multiple -H options 🌈
• -P FRAG_SIZE, --frag-size FRAG_SIZE — sets the IPv6 fragment payload size.
• -O FRAG_TYPE, --frag-type FRAG_TYPE — picks the fragment "type". the possible types are "first", "middle", "last", and "atomic". here's the breakdown, bestie, write it down ✍️
  • if the type is "first" → the Fragment Offset is automatically set to 0, and the "M" ("More fragments") bit is set to 1.
  • if the type is "middle" → the Fragment Offset gets a non-zero value, and the "M" bit is set to 1.
  • if the type is "last" → the Fragment Offset gets a non-zero value, and the "M" bit is set to 0.
  • if the type is "atomic" → the Fragment Offset is set to 0, and the "M" bit is set to 0. (the little unicorn of fragments 🦄)
• -o FRAG_OFFSET, --frag-offset FRAG_OFFSET — sets the Fragment Offset. heads up: whatever you put here overrides the value that -O would have implicitly set. you're the main character now 👑
• -I FRAG_ID, --frag-id FRAG_ID — sets the fragment "Identification" value. if you leave it out, the Identification value is randomized 🎲
• -T, --no-timestamp — when the tool is assessing a target's fragment reassembly policy, the fragment payload normally includes a timestamp value used to measure the fragment reassembly timeout. if this option is set, that timestamp is not included in the payload — and consequently the tool will not be able to measure the fragment reassembly timeout. no timestamp, no timing, that's the deal 😭
• -n, --no-responses — tells frag6 not to display the responses to the fragments it sent. super useful when you're doing a fragmentation-flooding attack, because you might get a lot of response packets (ICMPv6 errors) coming back at you 💀
• -p, --frag-reass-policy — tells the tool to figure out the target's IPv6 fragment reassembly policy. to do that, it runs a whole series of tests to determine how the target node processes overlapping fragments. the figures below show the packet sequence for each test 👇

Test #1

Frag. #1:  AAAAAAAAAAA
Frag. #2:         BBBBBBBBBBB

Test #2

Frag. #1:  AAAAAAAAAA
Frag. #2:                    BBBBBBBBBBB
Frag. #3:         CCCCCCCCCCC

Test #3

Frag. #1:  AAAAAAAAAA
Frag. #2:                    BBBBBBBBBBB
Frag. #3:            CCCCCCCCCCC

Test #4

Frag. #1:  AAAAAAAAAA
Frag. #2:                    BBBBBBBBBBB
Frag. #3:            CCCCCCCCCCCCCCCCCCCCCCCCCC

Test #5

Frag. #1:  AAAAAAAAAA
Frag. #2:                    BBBBBBBBBBB
Frag. #3:                           CCCCCCCCCCC
Frag. #4:            DDDDDDDD

for each one of those tests, the tool reports which copy of the data the target host actually used. and if the host says nothing back at all, the tool tells you whether the host silently dropped the fragments, or sent back an ICMPv6 Time Exceeded error message. detective work, but make it packets 🔍

• -W, --frag-id-policy — tells the tool to work out the fragment "Identification" generation policy. here's the whole vibe: the tool sends a bunch of probe packets to the target node, samples the "Identification" values from the corresponding response packets, and then tries to infer the fragment Identification generation policy of the target from those sampled values.

first, it sends a number of fragments from a single IPv6 address, so the per-destination policy can be determined. then it sends a number of fragments from random IPv6 addresses (from the same prefix as the first fragments), so the "global" fragment Identification generation policy can be inferred 🌍

then the tool computes the expected value and the standard deviation of the difference between consecutive-sampled Identification values (IDn – IDn-1), all with the intent of inferring the fragment Identification algorithm at the target node 🧮

for small values of the standard deviation, the fragment Identification is assumed to be a monotonically-increasing function with increments of the "expected value". for large values of the standard deviation, the fragment Identification is assumed to be randomized — and the expected value and standard deviation get reported to you, the user, as indicators of the "quality" of the fragment Identification generation algorithm. data, but make it gossip 💅

• -X, --pod-attack — tells the tool to perform a "Ping of Death" attack against the specified target. yes, that one. it's right there in the manual, bestie 💀
• -F FRAG_NUMBER, --flood-frags FRAG_NUMBER — tells the tool to send the specified number of fragments back-to-back to the target node. this one's likely to be used together with the -l option, so the whole thing repeats in a loop 🔁
• -l, --loop — tells frag6 to periodically send IPv6 fragments to the target node. how long it pauses between batches of fragments is set with the -z option, and it defaults to 1 second ⏱️
• -z SECONDS, --sleep SECONDS — sets how long the tool should pause between sending btaches of IPv6 fragments (that's when the --loop option is set). if you leave it unspecified, it defaults to 1 second 😴
• -v, --verbose — tells frag6 to be verbose. and if you set this option twice and the -W option was set, the tool also outputs the sampled Fragment Identification values (on top of the other information). double -v, double the tea ☕
• -h, --help — prints help information for the frag6 tool. the classic 🫶

---

🎀 EXAMPLES 🎀

the sections below show typical use cases of the frag6 tool. study them, they eat 💅

⭐ Example #1

# frag6 --frag-id-policy -d fc00:1::1 -v

assess the fragment Identification generation policy of the host "fc00:1::1". be verbose.

⭐ Example #2

# frag6 --frag-reass-policy -d fc00:1::1 -v

assess the fragment reassembly policy of the host "fc00:1::1". be verbose.

⭐ Example #3

# frag6 --frag-type atomic -d fc00:1::1 -v

send an IPv6 atomic fragment to the host "fc00:1::1". be verbose.

⭐ Example #4

# frag6 -s ::/0 --flood-frags 100 -l -z 5 -d fc00:1::1 -v

send 100 fragments (every 5 seconds) to the host fc00:1::1, using a forged IPv6 Source Address from the prefix ::/0. the aforementioned fragments should have an offset of 0, and the M bit set (i.e., be first-fragments). be verbose.

---

okay bestie there's literally more, keep scrolling, part 2 is coming and it's gonna be good 🦋

✨ AUTHOR ✨

okay so this absolute legend of a human made all of this happen 💖 the frag6 tool and the matching manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>. bestie really said "i'll build the whole thing and write the docs too" and then did it. main character energy fr fr 👑

---

🎀 COPYRIGHT 🎀

so like, the legal bit, but make it cute:

• Copyright (c) 2011-2013 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html> 🫶

ngl that's basically "yes you can share this, just keep it open and credit the original," which is lowkey iconic of it 💅

---

and that's the whole page, bestie!! you just read the entire FRAG6(1) manual — every flag, every example, every little warning — and you ate ✨ this was the frag6(1) manual page, and it's giving certified classic 🌸 go forth and frag responsibly, i'm obsessed with you, periodt 💖🎀🦋