NI6(1)

📦 version 2.2, in debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ NAME ✨

nI6 — a security assessment tool for attack vectors based on ICMPv6 Node Information messages 🦋

🌸 SYNOPSIS 🌸

ni6 [-i INTERFACE] [-S LINK_SRC_ADDR | -R] [-D LINK_DST_ADDR] [-s
SRC_ADDR[/LEN] | -r] [-d DST_ADDR] [-c HOP_LIMIT] [-y FRAG_SIZE] [-u
DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-P SIZE
| -6 IPV6_ADDR | -4 IPV4_ADDR | -n NAME | -N LEN | -x LEN -o TYPE] [-Z
SIZE] [-e] [-C ICMP6_CODE] [-q NI_QTYPE] [-X NI_FLAGS] [-P SIZE | -w
IPV6_ADDR | -W IPV4_ADDR | -a NAME | -A LEN | -Q LEN -O TYPE] [-E] [-j
PREFIX[/LEN]] [-k PREFIX[/LEN]] [-J LINK_ADDR] [-K LINK_ADDR] [-b
PREFIX[/LEN]] [-g PREFIX[/LEN]] [-B LINK_ADDR] [-G LINK_ADDR] [-L | -l]
[-z] [-v] [-h]

💅 DESCRIPTION 💅

okay so ni6 lets you assess IPv6 implementations against a whole bunch of attack vectors that ride on ICMPv6 Node Information messages. it's part of the SI6 Networks' IPv6 Toolkit, which is, like, a security assessment suite for the IPv6 protocols. the whole thing is giving very much "we test the internet so it doesn't break" energy 🫶

this tool has two modes of operation: "active" and "listening". in "active" mode the tool attacks a specific target, and in "listening" mode the tool just chills on the local network listening for ICMPv6 Node Information Query messages, then sends ICMPv6 Node Information Reply messages back in response to that traffic. iconic behavior, no cap.

  • active mode is what you get if an IPv6 Destination Address is specified.
  • listening mode is what you get if the -L option (or its long counterpart --listen) is set.
  • and if you specify both an attack target and the -L option? then the attack is launched against the specified target first, and then the tool enters listening mode to respond incoming packets with TCP segments. yes bestie, both. it does the thing then it does the other thing. 💅

the tool also supports filtering of incoming packets based on the Ethernet Source Address, the Ethernet Destination Address, the IPv6 Source Address, and the IPv6 Destination Address. there are two types of filters: "block filters" and "accept filters".

  • if any "block filter" is specified, and the incoming packet matches any of those filters, the message is discarded — and thus no ICMPv6 NI Reply messages are sent in response. bye 👋
  • if any "accept filter" is specified, incoming packets must match any of the specified "accept filters" in order for the tool to respond with ICMPv6 NI Reply messages.

🎀 OPTIONS 🎀

ni6 takes its parameters as command-line options. each option can be specified with a short name (one character preceded with the hyphen character, as e.g. -i) or with a long name (a string preceded with two hyphen characters, as e.g. --interface). pick your fave, both slay ✨

ni6 supports IPv6 Extension Headers, including the IPv6 Fragmentation Header, which might be of use to circumvent layer-2 filtering and/or Network Intrusion Detection Systems (NIDS). however — IPv6 extension headers are not employed by default, and must be explicitly enabled with the corresponding options. no sneaky defaults here, you have to actually ask for them 🧚

  • -i INTERFACE, --interface INTERFACE — this one tells the tool which network interface to use. if the destination address (the -d option) is a link-local address, or if "listening" (-L) mode is selected, then the interface must be explicitly specified. you can also pass the interface alongside a destination address using the -d option. 💖
  • -s SRC_ADDR, --src-address SRC_ADDR — sets the IPv6 source address (or IPv6 prefix) used as the Source Address of the attack packets. if you hand it an IPv6 prefix, the IPv6 Source Address of the ICMPv6 packets gets randomized from that prefix. so spicy 🌶️
note: when operating in "listening" mode, the Source Address is automatically selected depending on the IPv6 Destination Address of the ICMPv6 NI Query — unless a specific IPv6 Source Address has been specified with the -s option. it just knows, bestie.
  • -d DST_ADDR, --dst-address DST_ADDR — sets the IPv6 Destination Address of the victim. you can only leave this unspecified if the -L option is selected (i.e., if the tool is going to operate in "listening" mode). otherwise it's kinda required, yk?
note: when operating in "listening" mode, the Destination Address is automatically set to the Source Address of the incoming ICMPv6 NI Query message. it matches the vibe of whoever slid into its inbox.
  • --hop-limit, -A — specifies the Hop Limit used for the IPv6 packets. it is randomized by default 🎲
  • -y SIZE, --frag-hdr SIZE — says that the resulting packet must be fragmented. the fragment size has to be given as the argument to this option. slice it up ✂️
  • -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — says a Destination Options header is to be included in the resulting packet. the extension header size must be given as an argument (the header gets filled with padding options). you can stack multiple Destination Options headers by passing multiple -u options. more is more ✨
  • -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — same idea but the Destination Options header goes into the "unfragmentable part" of the resulting packet. the header size is the argument (again, filled with padding options), and you can stack multiple of them with multiple -U options. heads up though: this option is only valid if the -y option is specified — because the concept of an "unfragmentable part" literally only makes sense when fragmentation is employed. don't skip steps bestie 💀
  • -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — includes a Hop-by-Hop Options header in the resulting packet. header size goes in as the argument (yes, padding options, you know the drill), and multiple Hop-by-Hop Options headers can be specified with multiple -H options. 🦋
  • -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — sets the link-layer Source Address of the TCP segments. if you leave it unspecified, the link-layer Source Address gets set to the real link-layer address of the network interface. authentic, not cosplaying 💅
  • -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — sets the link-layer Destination Address of the ICMPv6 NI packets. by default, the link-layer Destination Address is automatically set to the link-layer address of the destination host (for on-link destinations) or to the link-layer of the first-hop router. autopilot mode 🛰️
  • --payload-size, -P — specifies the size (in bytes) of the ICMPv6 NI payload. 📏
  • --subject-ipv6, -6 — specifies an IPv6 Address to be used as the Subject of ICMPv6 Node Information Query messages. 🌈
  • --subject-ipv4, -4 — specifies an IPv4 Address to be used as the Subject of ICMPv6 Node Information Query messages. yes, IPv4, in the IPv6 tool. we contain multitudes 🫶
  • --subject-name, -n — specifies a Name to be used as the Subject of ICMPv6 Node Information Query messages. by default, the specified name is considered to be a Fully-Qualified Domain Name (FQDN). if you wanna know how to specify "single-label" names, go read the --sname-slabel option. it's got you 💖
  • --subject-fname, -N — tells the ni6 tool to set the Subject of ICMPv6 NI Query messages to a forged name of the specified length. fake it till you make it, bestie ✨
note: the forged name is a sequence of labels of 'a' characters, and the maximum label size is specified by means of the --max-label-size option. so, like, a lot of a's.
  • --subject-ename, -x — tells the ni6 tool to set the Subject of an ICMPv6 NI Query message to a malformed label of the specified length. this one's useful for including a malformed label that "spans past the end of the ICMPv6 NI Query". chaos, but make it intentional 💀
  • --subject-nloop, -O — says the Data field should be set to a Name that contains a DNS compression loop. the loop type is specified with this option, and the valid values are in the range 0-1. a little infinite loop moment, as a treat 🌀
  • --sname-slabel, -e — says the specified Subject Name is a single-label name, so it should be terminated with two (rather than one) NULL labels. two, not one. count them. 🔢
  • --max-label-size, -Z — specifies the maximum Name label size. it defaults to 63. 📐
  • --code, -C — specifies the ICMPv6 code. for ICMPv6 NI Query messages, if a specific Subject type is specified, the ICMPv6 code is automatically set to the corresponding value. it does the math for you 💅
  • --qtype, -q — specifies the Qtype value of ICMPv6 NI messages. for ICMPv6 NI Reply messages, if a specific Data type is specified, the ICMPv6 Qtype is automatically set to the corresponding value. again with the autofill, love that for us ✨
  • --flags, -X — specifies the "Flags" field of the ICMPv6 NI messages.
    • for ICMPv6 NI Query messages of Qtype 3 (Node IPv6 Addresses), the "Flags" field defaults to "GSLCA".
    • for ICMPv6 NI Query messages of Qtype 4 (Node IPv4 Addresses), the "Flags" field defaults to "A".
    • for other ICMPv6 NI Query messages it defaults to 0.
    • for ICMPv6 Reply messages, the "Flags" field is copied from the corresponding ICMPv6 NI Query message. copy-paste, but make it protocol 🎀
  • --data-ipv6, -w — specifies an IPv6 Address to be used as the Data of ICMPv6 Node Information Reply messages. 💜
  • --data-ipv4, -W — specifies an IPv4 Address to be used as the Data of ICMPv6 Node Information Reply messages. 🍓
  • --data-name, -a — specifies a Name to be used as the Data of ICMPv6 Node Information Reply messages. by default the specified name is considered to be a Fully-Qualified Domain Name (FQDN). and yep, for "single-label" names, go check out the --dname-slabel option. 🧚
  • --data-fname, -A — tells the ni6 tool to set the Data of the ICMPv6 NI Reply messages to a forged name of the specified length.
note: the forged name is a sequence of labels of 'a' characters, with the maximum label size being specified by means of the --max-label-size option. (same a's, different field 😌)
  • --data-ename, -Q — tells the ni6 tool to set the Data of ICMPv6 NI Reply messages to a malformed label of the specified length. useful for including a malformed label that "spans past the end of the ICMPv6 NI Reply". we love a boundary violation that's on purpose 🙈
  • --data-nloop, -O

That one sets the Data field to a Name that's packing a DNS compression loop 💀 — you pick the loop type right there with the option, and the valid values are 0 through 2. Yeah bestie, only three. Choose wisely.

  • --dname-slabel, -E — says the Data Name you handed over is a single-label name, so it gets terminated with two NULL labels instead of just one. Double-tap that NULL, periodt. 🎀
  • -j SRC_ADDR, --block-src SRC_ADDR — sets a block filter for incoming packets based on their IPv6 Source Address. You can hand it an IPv6 prefix shaped like -j prefix/prefixlen. No prefix length? It just goes ahead and assumes /128 for you (i.e. it figures you meant one single IPv6 address, not a whole prefix). 🚫
  • -k DST_ADDR, --block-dst DST_ADDR — sets a block filter for incoming Neighbor Solicitation messages based on their IPv6 Destination Address. Same deal, give it a prefix like -k prefix/prefixlen, and if you skip the prefix length it assumes /128 (i.e. a single IPv6 address, not a prefix). 🚫
  • -J SRC_ADDR, --block-link-src SRC_ADDR — sets a block filter for incoming packets based on their link-layer Source Address. You must follow it with a link-layer address. Heads up: this one only works on Ethernet interfaces. 🚫
  • -K DST_ADDR, --block-link-dst DST_ADDR — sets a block filter for incoming packets based on their link-layer Destination Address. Again, the option has to be followed by a link-layer address, and again, Ethernet interfaces only. 🚫
  • -b SRC_ADDR, --accept-src SRC_ADDR — the flip side, bestie: an accept filter for incoming packets based on their IPv6 Source Address. Specify an IPv6 prefix as -b prefix/prefixlen. Leave the prefix length out and it assumes /128 (i.e. it thinks you meant a single IPv6 address rather than a prefix). 💖
  • -g DST_ADDR, --accept-dst DST_ADDR — an accept filter for incoming packets based on their IPv6 Destination Address. Give it a prefix as -g prefix/prefixlen. No prefix length specified? /128 it is (i.e. a single IPv6 address, not a prefix). 💖
  • -B SRC_ADDR, --accept-link-src SRC_ADDR — an accept filter for incoming Neighbor Solicitation messages based on their link-layer Source Address. Gotta follow it with a link-layer address, and it's Ethernet-only, no cap. 💖
  • -G DST_ADDR, --accept-link-dst DST_ADDR — an accept filter for incoming packets based on their link-layer Destination Address. Follow it with a link-layer address; Ethernet interfaces only. 💖
  • --forge-src-addr, -r — tells ni6 to forge the IPv6 Source Address of ICMPv6 NI messages. Real talk though: when you're in listening mode, unless this is set, ni6 will not impersonate other nodes. 🎭
  • --forge-link-src-addr, -R — tells ni6 to forge the link-layer Source Address of ICMPv6 NI messages.
Note: some interface cards (or their drivers) may straight-up silently discard packets that contain a forged link-layer Source Address. Rude, honestly. 🙈
  • --loop, -l — tells the tcp6 tool to send periodic TCP segments to the victim node. How long to pause between segments is set with the -z option, and it defaults to 1 second. Important: this option cannot be set together with the -L (--listen) option. Pick a lane, bestie. 💅
  • --sleep, -z — how long to pause between sending ICMPv6 Node Information Query messages (only relevant when --loop is set). Leave it out and it defaults to 1 second. 😴
  • --listen, -L — tells ni6 to go into listening mode (possibly after attacking a target you specified). And nope, this one cannot be used together with the -l (--loop) option. 👂
  • --verbose, -v — tells ni6 to be verbose. Set it twice and you unlock "very verbose", where the tool also tells you which packets got discarded because of the filters you specified. Iconic. 📢
  • --help, -h — print the help info for the ni6 tool. We love a helpful king. 🫶

🌈 EXAMPLES 🌈

The next bits show you typical ways people actually use the ni6 tool. Vibe check passed. ✨

🍓 Example #1

# ni6 -i eth0 --subject-ipv6 ff02::1 -d ff02::1 -q 2 -v

Send an ICMPv6 Node Information Query to the multicast address ff02::1 (that's the -d option), with a Subject IPv6 Address of ff02::1 (that's --subject-ipv6), and you're querying for Node names (-q option). Also, be verbose. 📣

🦋 Example #2

# ni6 -i eth0 --data-fname 1000 -L --forge-src-addr -v

Listen for incoming ICMPv6 Node Information Query messages that are asking for node names, and reply with ICMPv6 NI Reply messages carrying a forged name of 700 bytes. Forge the IPv6 Source Address of the packets. And be verbose, obviously. 🎭

👑 AUTHOR 👑

The ni6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>.

Copyright (c) 2011-2013 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>.

And that's the whole page, bestie!! 🎀💖✨ This was the ni6 manual, section NI6(1) — so if you ever need to look it back up on your system, that's your page name, fr fr. Go forth and query some nodes, you absolute legend. 🫶👑

📦 where this page comes from