MLDQ6(1)

💖 MLDQ6(1) — the manual page, but make it make sense 💖

ok so bestie. this is the manual page for mldq6, a General Commands Manual entry, and honestly it's giving "chaos but make it educational". sit down, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

mldq6 — a security assessment tool for attack vectors based on ICMPv6 MLD Query messages 🎀

---

✨ SYNOPSIS ✨

mldq6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-A HOP_LIMIT]
[-y FRAG_SIZE] [-u DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H
HBH_OPT_HDR_SIZE] [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-E LINK_ADDR]
[-e] [-m MLD_ADDR] [-r MLD_RESP_DELAY ] [-F N_SOURCES] [-z SECONDS] [-l]
[-v] [-h]

---

✨ DESCRIPTION ✨

okay so mldq6 lets you vibe check IPv6 implementations against a whole buffet of attacks based on ICMPv6 MLD Query messages. it's part of the SI6 Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols. literally iconic. 👑

---

✨ OPTIONS ✨

so mldq6 takes its parameters as command-line options, and every single one can be written either as a short name (one character preceded with the hyphen character, as e.g. "-i") or as a long name (a string preceded with two hyphen characters, as e.g. "--interface"). flexible queen behavior 💅

• -i INTERFACE, --interface INTERFACE — this one tells the tool which network interface it's gonna use. ⚠️ if the destination address (the "-d" option) is a link-local address, you must spell out the interface explicitly. you can also hand over the interface alongside a destination address, with the "-d" option.
• -s SRC_ADDR, --src-address SRC_ADDR — meant to specify the IPv6 Source Address (or IPv6 prefix) to be used for the MLD Query messages. if you leave it unspecified, a randomized link-local unicast (fe80::/64) address gets picked. 🎲
• -d DST_ADDR, --dst-address DST_ADDR — specifies the IPv6 Destination Address of the MLD Query messages. leave it out and the "all-nodes link-local multicast" address (ff02::1) is selected as the IPv6 Destination Address.
• -A HOP_LIMIT, --hop-limit HOP_LIMIT — sets the IPv6 Hop Limit for the MLD Query messages. defaults to 1. and here's the tea: IPv6 nodes are required to check that the Hop Limit of incoming MLD Query messages is 1. so this option is only useful to assess whether an IPv6 implementation fails to enforce that check. 👀
• -y SIZE, --frag-hdr SIZE — says the resulting packet must be fragmented. the fragment size has to be given as an argument to this option.
• -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — says a Destination Options header is to be included in the resulting packet. the extension header size must be specified as an argument to this option (the header gets filled with padding options). you can stack multiple Destination Options headers by passing multiple "-u" options. 🧚
• -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — specifies a Destination Options header to be included in the "unfragmentable part" of the resulting packet. header size goes in as the argument (header gets filled with padding options). multiple Destination Options headers = multiple "-U" options. > this one is only valid if the "-y" option is specified, because the concept of "unfragmentable part" only makes sense when fragmentation is employed. no -y, no -U, periodt.
• -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — says a Hop-by-Hop Options header is to be included in the resulting packet. header size as the argument (filled with padding options). multiple Hop-by-Hop Options headers via multiple "-H" options. without this option, a MLD standard conforming Hop-by-hop header is added. with "-H 0" no Hop-by-Hop Options header is added, thus creating an invalid MLD Query message. 😱 this option can be used to check whether an IPv6 implementation correctly validates the Hop-by-Hop Options header and drops MLD Query messages with an invalid Hop-by-Hop Options header.
• -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — specifies the link-layer Source Address of the MLD Query messages (currently, only Ethernet is supported). left unspecified? the link-layer Source Address is randomized. 🎲
• -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — specifies the link-layer Destination Address of the MLD Query messages (currently, only Ethernet is supported). if you don't set it, the link-layer Destination Address becomes "33:33:00:00:00:01" — the Ethernet address that corresponds to the "all-nodes link-local multicast" address.
• --source-lla-opt, -E — specifies the contents of a source link-layer address option to be included in the MLD Query messages. and if more than one source link-layer address is specified (by means of multiple "-E" options), and all the resulting options can't be conveyed into a single MLD Query, multiple MLD Queries will be sent as needed. she'll make it work 💅
• --add-slla-opt, -e — instructs mldq6 to include a source link-layer address option in the MLD Query messages that it sends. the link-layer address inside the option is the same as the Ethernet Source Address used for the outgoing MLD Query messages. matching, cute.
• -m MLD_ADDR, --mld-addr MLD_ADDR — specifies the MLD Multicast Address of the MLD Query messages. if left unspecified, the unspecified IPv6 address (::) is selected as the MLD Multicast Address — that's a General Query. 📌 note that for a valid Multicast-Address-Specific Query, MLD_ADDR and the IPv6 destination address should be the same. so if you're setting a multicast address with "-m", you might also want to use "-d" and "-D". bestie, do all three, trust. 🫶
• -r MLD_RESP_DELAY, --mld-resp-delay MLD_RESP_DELAY — sets the MLD Maximum Respones Delay of the MLD Query messages, in milliseconds. a multicast listener will reply with its MLD Report with a random delay between zero and the MLD_RESP_DELAY. defaults to 10000 milliseconds (10 seconds). ⏳
• --flood-sources, -F — tells mldq6 to send MLD Queries from multiple (and random) IPv6 Source Addresses. how many different sources? that's specified as "-F number". the IPv6 Source Address of each MLD Query is randomized from the IPv6 prefix specified with the "-s" option, and defaults to a random link-local unicast address (fe80::/64). 🌊
• --loop, -l — tells mldq6 to send periodic MLD Queries to the destination node. the amount of time to pause between sending MLD Queries can be specified by means of the "-z" option, and defaults to 120 seconds. 🔁
• --sleep, -z — tells mldq6 the amount of time to pause between sending MLD Query messages. if left unspecified, it defaults to 120 seconds. 😴
• --verbose, -v — tells mldq6 to be verbose. she's a talker, we love her. 🗣️
• --help, -h — print help information for the mldq6 tool.

---

✨ EXAMPLES ✨

the following sections illustrate typical use cases of the rs6 tool.

Example #1 🍓

# mldq6 -i eth0

use the network interface "eth0" to send a MLD Query using a random link-local unicast IPv6 Source Address and a random Ethernet Source Address, to the IPv6 Destination Address "ff02::1" ("all-nodes link-local multicast" address, selected by default) and the Ethernet Destination Address "33:33:00:00:00:01" (selected by default). set the MLD Multicast Address to :: (a "General Query", default) and set the MLD Maximum Response Delay to 10 seconds (default). default default default — she's low-maintenance like that. ✨

Example #2 🌈

# mldq6 -i eth0 -d ff12::123 -D 33:33:00:00:01:23 -m ff12::123 -r 1000 -F 100 -l -z 5 -v

send 100 Multicast-Address-Specific MLD Query messages using a random Ethernet Source Address and random IPv6 Source Address for each of them, to the Ethernet Destination Address "33:33:00:00:01:23" and the IPv6 Destination Address "ff12::123". set the MLD Multicast Address to ff02::123 (a "Multicast-Address-Specific Query") and set the MLD Maximum Response Delay to 1000 milliseconds. repeat this operation every five seconds. be verbose. 💅

---

✨ MULTICAST LISTENERS ✨

so you wanna create multicast listeners that you can check queries sent by mldq6 against? you can use socat (>= 1.7.3.2) for instance:

$ socat -u UDP6-RECV:1234,reuseaddr,ipv6-join-group="[ff12::123]:eth0" -

another option is mcjoin: https://github.com/troglobit/mcjoin

---

✨ AUTHOR ✨

the mldq6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>. 🫡

---

✨ COPYRIGHT ✨

Copyright (c) 2011-2020 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>.

---

okay that's the whole thing, no notes, you ate. 🎀 this was the MLDQ6(1) page from the General Commands Manual, and yeah — that footer really does just say MLDQ6(1) and nothing else, iconic minimalist behavior 💀. go forth and query responsibly, bestie 💖🦋✨