NS6(1)

📦 version 2.2, in debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NS6(1) 💖

okay bestie, pull up a chair, because we're about to talk about ns6, the security assessment tool for attack vectors based on ICMPv6 Neighbor Solicitation messages, from the General Commands Manual. yes. that whole mouthful. she's iconic, she's dangerous, she's here to vibe check your IPv6 stack. 🦋

✨ NAME ✨

ns6 — A security assessment tool for attack vectors based on ICMPv6 Neighbor Solicitation messages 💅

🌸 SYNOPSIS 🌸

ns6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-y FRAG_SIZE] [-u
DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-S
LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-E LINK_ADDR] [-e] [-t
TARGET_ADDR[/LEN]] [-F N_SOURCES] [-T N_TARGETS] [-z SECONDS] [-l] [-v]
[-h]

🎀 DESCRIPTION 🎀

ns6 lets you assess IPv6 implementations against a whole menu of attacks that ride on ICMPv6 Neighbor Solicitation messages. no cap. 🫶

she's part of the SI6 Networks' IPv6 Toolkit — a security assessment suite for the IPv6 protocols. the whole girl group, basically. 👑

✨ OPTIONS ✨

ns6 takes all her parameters through command-line options. every single option can be written two ways: with a short name (one character, hyphen in front, like -i) or with a long name (a string with two hyphens in front, like --interface). pick your fighter. 💖

depending on how much info (aka options) you're trying to shove into your Neighbor Solicitations, ns6 might need to split that info across more than one Neighbor Solicitation message. and when you tell ns6 to flood the victim with Neighbor Solicitations from different sources (the --flood-sources option), multiple packets may need to be sent too. ns6 supports IPv6 fragmentation, which is lowkey useful if you need to fit a big pile of information into a single Neighbor Solicitation message. IPv6 fragmentation is not enabled by default — you have to explicitly turn it on with the -y option. 🙈

  • -i INTERFACE, --interface INTERFACE — tells the tool which network interface to use. if the destination address (the -d option) is a link-local address, you must specify the interface explicitly. you can also specify the interface alongside a destination address, using the -d option. 🌈
  • -s SRC_ADDR, --src-address SRC_ADDR — specifies the IPv6 Source Address to use for the Neighbor Solicitation messages. if you leave it unspecified, a randomized link-local (fe80::/64) address gets picked for you. surprise! 🎁
  • -d DST_ADDR, --dst-address DST_ADDR — specifies the IPv6 Destination Address of the Neighbor Solicitation messages. if you leave this unspecified but you do specify the Ethernet Destination Address, then the "all-nodes link-local multicast" address (ff02::1) becomes the IPv6 Destination Address. ✨
  • --hop-limit, -A — specifies the IPv6 Hop Limit for the Neighbor Solicitation messages. defaults to 255. heads up bestie: IPv6 nodes are required to check that the Hop Limit of incoming Neighbor Solicitation messages is 255. so this option is only useful for assessing whether an IPv6 implementation fails to enforce that check. 👀
  • -y SIZE, --frag-hdr SIZE — says the resulting packet must be fragmented. you pass the fragment size as the argument to this option. 🧩
  • -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — includes a Destination Options header in the resulting packet. the extension header size goes in as the argument (the header gets filled with padding options). you can stack multiple Destination Options headers by using multiple -u options. 💫
  • -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — includes a Destination Options header in the "unfragmentable part" of the resulting packet. header size as the argument (filled with padding options, same deal). multiple Destination Options headers = multiple -U options. this option is only valid if the -y option is specified, because the whole concept of an "unfragmentable part" only makes sense when fragmentation is in play. ⚠️
  • -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — includes a Hop-by-Hop Options header in the resulting packet. header size as the argument (padding options fill it up). multiple Hop-by-Hop Options headers via multiple -H options. 🦋
  • -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — specifies the link-layer Source Address of the Neighbor Solicitation messages (currently, only Ethernet is supported). if you leave it unspecified, the link-layer Source Address is randomized. 🎲
  • -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — specifies the link-layer Destination Address of the Neighbor Solicitation messages (currently, only Ethernet is supported). if you leave it unspecified, it's set to the address 33:33:00:00:00:01 — that's the Ethernet address corresponding to the "all-nodes link-local multicast" IPv6 address (ff02::1). 🌟
  • --target, -t — specifies the IPv6 Target Address of the Neighbor Solicitation messages.

if the -T (--flood-targets) option is specified, then this option specifies an IPv6 prefix in the form -t prefix/prefixlen. check out the description of the -T option for more on how -t gets processed in that specific case. 📌

  • --source-lla-opt, -E — specifies the contents of a source link-layer address option to include in the Neighbor Solicitation messages. if you specify more than one source link-layer address (multiple -E options) and all the resulting options can't fit into a single Neighbor Solicitation, ns6 will send multiple Neighbor Solicitations as needed. 💌
  • --add-slla-opt, -e — tells ns6 to include a source link-layer address option in the Neighbor Solicitation messages she sends. the link-layer address in that option is the same as the Ethernet Source Address used for the outgoing Neighbor Solicitation messages. matchy matchy. 💅
  • --flood-sources, -F — tells ns6 to send Neighbor Solicitations from multiple (and random) IPv6 Source Addresses. you specify the number of different sources as -F number. the IPv6 Source Addresses of the packets are randomly selected from the prefix specified by the -s option (which defaults to fe80::/64). 🌊
  • --flood-targets, -T — tells ns6 to send Neighbor Solicitation messages for multiple Target Addresses. the number of different Target Addresses is -T number. each packet's Target Address is randomly selected from the prefix ::/64, unless you specified a different prefix with the -t option. 🎯
  • --loop, -l — tells ns6 to send periodic Neighbor Solicitations to the victim. how long to pause between them is set with the -z option, and defaults to 1 second. 🔁
  • --sleep, -z — tells ns6 the amount of time to pause between sending Neighbor Solicitations. if left unspecified, it defaults to 1 second. 😴
  • --verbose, -v — tells ns6 to be verbose. spill the tea, girl. 🗣️
  • --help, -h — print help information for the ns6 tool. 🆘

🌈 EXAMPLES 🌈

the following sections illustrate typical use cases of the ns6 tool.

⭐ Example #1

# ns6 -i eth0 -d fe80::01 -t 2001:db8::1 -e

use the network interface eth0 to send a Neighbor Solicitation message using a random link-local unicast IPv6 Source Address and a random Ethernet Source Address, to the IPv6 Destination address fe80::1 and the Ethernet Destination Address 33:33:00:00:00:01 (selected by default). the target of the Neighbor Advertisement is 2001:db8::1. the Neighbor Solicitation also includes a source link-layer address option, containing the same Ethernet address as the one used for the packet's Ethernet Source Address. 💖

⭐ Example #2

# ns6 -i eth0 -s 2001:db8::/32 -t 2001:db8::1 -F 10 -l -z 10 -e -v

send 10 Neighbor Solicitation messages using random Ethernet Source Addresses and random IPv6 Source Addresses from the prefix 2001:db8::/32, to the Ethernet Destination Address 33:33:00:00:00:01 (default) and the IPv6 Destination Address ff02::1 (default). the IPv6 Target Address of the Neighbor Solicitation is 2001:db8::1, and each message includes a source link-layer address option containing the same address used for the packet's Ethernet Source Address. repeat this operation every ten seconds. be verbose. 🔥

⭐ Example #3

# ns6 -i eth0 -s 2001:db8::/32 -t 2001:db8::1 -F 10 -l -z 10 -E
ff:ff:ff:ff:ff:ff -v

send 10 Neighbor Solicitation messages using random Ethernet Source Addresses and random IPv6 Source Addresses from the prefix fe80::/64 (default, link-local unicast), to the Ethernet Destination Address 33:33:00:00:00:01 (default) and the IPv6 Destination Address ff02:1 (default). the IPv6 Target Address of the Neighbor Solicitation is 2001:db8::1, and each message includes a source link-layer address option containing the Ethernet address ff:ff:ff:ff:ff:ff. repeat this operation every ten seconds. be verbose. 👑

🦋 SEE ALSO 🦋

"Security/Robustness Assessment of IPv6 Neighbor Discovery Implementations" (available at: <http://www.si6networks.com/tools/ipv6toolkit/si6networks-ipv6-nd-assessment.pdf>) for a discussion of Neighbor Discovery vulnerabilities, and additional examples of how to use the na6 tool to exploit them. 📚

💜 AUTHOR 💜

The ns6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>. 🫶

Copyright (c) 2011-2013 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>. 📜

okay that's the whole thing, bestie, every last flag and footnote, no skips, no cap. 💖 and yeah — this page is NS6(1), from the General Commands Manual, and it signs off as NS6(1) at the bottom too, because she said her name twice and honestly? main character energy. periodt. 💅✨

📦 where this page comes from