RD6(1)

✨ rd6 — the girlies' guide to ICMPv6 Redirect shenanigans (RD6(1), General Commands Manual) ✨

okay bestie, sit DOWN, hydrate, and let me tell you about rd6 💖

---

🌸 NAME 🌸

rd6 — a security assessment tool for attack vectors based on ICMPv6 Redirect messages 💅

---

🎀 SYNOPSIS 🎀

rd6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-S LINK_SRC_ADDR]
[-D LINK-DST-ADDR] [-A HOP_LIMIT] [-y FRAG_SIZE] [-u DST_OPT_HDR_SIZE]
[-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-r RD_DESTADDR/LEN] [-t
RD_TARGETADDR/LEN] [-p PAYLOAD_TYPE] [-P PAYLOAD_SIZE] [-n] [-c
HOP_LIMIT] [-x SRC_ADDR] [-a SRC_PORT] [-o DST_PORT] [-X TCP_FLAGS] [-q
TCP_SEQ] [-Q TCP_ACK] [-V TCP_URP] [-w TCP_WIN] [-M] [-O] [-N] [-E
LINK_ADDR] [-e] [-j PREFIX[/LEN]] [-k PREFIX[/LEN]] [-J LINK_ADDR] [-K
LINK_ADDR] [-b PREFIX[/LEN]] [-g PREFIX[/LEN]] [-B LINK_ADDR] [-G
LINK_ADDR] [-f] [-R N_DESTS] [-T N_TARGETS] [-F N_SOURCES] [-L | -l]
[-z] [-v] [-h]

like, yes, that's a lot of brackets. she's a big girl. she contains multitudes. 👑

---

🦋 DESCRIPTION 🦋

rd6 lets you assess IPv6 implementations against a whole buffet of attack vectors based on ICMPv6 Redirect messages. It's part of the SI6 Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols. periodt. ✨

This tool has two modes of operation: active and passive. In active mode, the tool attacks a specific target, while in passive mode the tool listens to traffic on the local network, and launches an attack in response to such traffic. You get active mode if you specify an IPv6 Destination Address, a Redirect Destination Address, and a Redirect Target Address. You get passive mode if the -L option (or its long counterpart --listen) is set. And plot twist — if you specify BOTH an attack target and the -L option, the attack is launched against the specified target, and then the tool enters passive mode to respond to incoming packets with ICMPv6 Redirect messages. multitasking icon 💅

The tool supports filtering of incoming packets based on the Ethernet Source Address, the Ethernet Destination Address, the IPv6 Source Address, and the IPv6 Destination Address. There are two types of filters: "block filters" and "accept filters". If any "block filter" is specified, and the incoming packet matches any of those filters, the message is discarded (and thus no Redirect messages are sent in response). If any "accept filter" is specified, incoming packets must match the specified filters in order for the tool to respond with Redirect messages. no filter, no entry, fr fr 🚫

---

💜 OPTIONS 💜

rd6 takes its parameters as command-line options. Each of the options can be specified with a short name (one character preceded with the hyphen character, as e.g. -i) or with a long name (a string preceded with two hyphen characters, as e.g. --interface). pick your vibe, she's flexible 🫶

Depending on the amount of information (i.e., options) to be conveyed into the ICMPv6 Redirect messages, it may be necessary for the rd6 tool to split that information into more than one Redirect message. Also, if the tool is instructed to e.g. flood the victim with Redirect messages from different sources (--flood-sources option), multiple packets may need to be generated. rd6 supports IPv6 fragmentation, which might be of use to circumvent layer-2 filtering and/or Network Intrusion Detection Systems (NIDS). BUT — and this is the important part bestie — IPv6 fragmentation is not enabled by default, and must be explicitly enabled with the -y option. you have to ASK her. she's not gonna just do it. 🙈

---

• -i INTERFACE, --interface INTERFACE — this one tells the tool which network interface to use. If the destination address (-d option) is a link-local address, or the "listening" (-L) mode is selected, you must explicitly specify the interface. You can also specify the interface alongside a destination address, with the -d option. 💅
• -s SRC_ADDR, --src-address SRC_ADDR — specifies the IPv6 source address (or IPv6 prefix) used as the Source Address of the attack packets. This address typically corresponds to the IPv6 link-local address of the default router. If the -F (--flood-sources) option is specified, this option includes an IPv6 prefix, from which random addresses are selected. See the description of the -F option for further info on how -s gets processed in that specific case. 👑

Note: instead of specifying the "Source Address" with this option, the --learn-router option could be set, so the tool automatically learns the IPv6 link-local address of the default router, and uses this address for the "Source Address" of the Redirect messages. she'll figure it out herself, lowkey iconic 🧚

• -d DST_ADDR, --dst-address DST_ADDR — specifies the IPv6 Destination Address of the victim. It can be left unspecified only if the -L option is selected (i.e., if the tool is to operate in "Passive" mode). When operating in passive mode (-L option), the IPv6 Destination Address is selected according to the IPv6 Source Address of the incoming packet. she reads the room ✨
• --hop-limit, -A — specifies the Hop Limit to be used for the Redirect messages. It defaults to 255. Note that IPv6 nodes are required to check that the Hop Limit of incoming Redirect messages is 255. So this option is only useful to assess whether an IPv6 implementation fails to enforce that check. shady but legal 💀
• -y SIZE, --frag-hdr SIZE — specifies that the resulting packet must be fragmented. The fragment size must be specified as an argument to this option. 🍓
• -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — specifies that a Destination Options header is to be included in the resulting packet. The extension header size must be specified as an argument to this option (the header is filled with padding options). You can stack multiple Destination Options headers by means of multiple -u options. more is more 💅
• -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — specifies a Destination Options header to be included in the "unfragmentable part" of the resulting packet. The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Destination Options headers may be specified by means of multiple -U options. This option is only valid if the -y option is specified (as the concept of "unfragmentable part" only makes sense when fragmentation is employed). no -y, no -U, that's the rule babe 🚫
• -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — specifies that a Hop-by-Hop Options header is to be included in the resulting packet. The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Hop-by-Hop Options headers may be specified by means of multiple -H options. 🌈
• -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — specifies the link-layer Source Address of the Redirect messages (this option is only valid for Ethernet interfaces). If left unspecified, the link-layer Source Address is randomized. However, if this option is left unspecified, but the --learn-router option is set, the link-layer Source Address is set to that of the default router for the local network. mystery mode unless you say otherwise 🕵️♀️
• -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — specifies the link-layer Destination Address of the Redirect messages (this option is only valid for Ethernet interfaces). If left unspecified, it is set to the "all-nodes link-local multicast" address (ff02::1). When operating in passive mode, the link-layer Destination Address is set according to the link-layer Source Address of the incoming packet. 💫
• --redir-target, -t — specifies the Target Address of the Redirect messages. If the -T (--flood-targets) option is specified, this option specifies an IPv6 prefix in the form -t prefix/prefixlen. See the description of the -T option for further info on how -t gets processed in that specific case. This option can be left unspecified only if the --make-onlink option is selected, in which case the Redirect Target Address is set to the same value as the Redirect Destination address. 😌
• --redir-dest, -r — specifies the Redirect Destination Address. If the -R (--flood-dests) option is specified, this option specifies an IPv6 prefix in the form -r prefix/prefixlen. See the description of the -R option for further information on how the -t option is processed in that specific case. 🌸
• --payload-type, -p — specifies the payload type to be included in the Redirect Payload. Currently supported payloads are "TCP", "UDP", and "ICMP6". The payload-type defaults to "TCP". 💅
• --payload-size, -P — the size of the payload to be included in the Redirect message (with the payload type being specified by the -p option). By default, as many bytes as possible are included, without exceeding the minimum IPv6 MTU (1280 bytes). generous queen 👑
• --no-payload, -n — specifies that no payload (i.e., no Redirected Header option) should be included in the Redirect message. minimalism 🎀
• --ipv6-hlim, -c — specifies the Hop Limit of the IPv6 packet included in the payload of the Redirect message. It defaults to 255. ⭐
• --peer-addr, -x — specifies the IPv6 Source Address of the Redirect payload. If left unspecified, the IPv6 Source Address of the Redirect payload is set to the same value as the IPv6 Destination Address of the packet. This option is only employed for packets sent in "active" mode.

Note: this option might be useful to check whether an implementation validates the contents of the Redirect message. vibe check on the implementation 🔍

• --redir-port, -o — specifies the Destination Port of the TCP or UDP packet contained in the Redirect payload.

Note: this option is meaningful only if "TCP" or "UDP" have been specified with the -p option. 🫶

• --peer-port, -a — specifies the Source Port of the TCP or UDP packet contained in the Redirect payload.

Note: this option is meaningful only if "TCP" or "UDP" have been specified with the -p option. 🫶

• --tcp-flags, -X — specifies the flags of the TCP header contained in the Redirect payload. The flags are specified as "F" (FIN), "S" (SYN), "R" (RST), "P" (PSH), "A" (ACK), "U" (URG), "X" (no flags). If left unspecified, only the "ACK" bit is set.

Note: this option is meaningful only if "TCP" has been specified with the -p option. 🔥

• --tcp-seq, -q —
• This option specifies the Sequence Number of the TCP header contained in the Redirect payload. If left unspecified, the Sequence Number is randomized. heads up bestie: the flag name for this one got chopped off the top of the page, so it's just the deets here, no cap

Note: This option is meaningful only if "TCP" has been specified with the -p option. 🫶

• --tcp-ack, -Q — sets the Acknowledgment Number of the TCP header inside the Redirect payload. Leave it out and the Acknowledgment Number gets randomized. 🎲

Note: only meaningful if "TCP" has been specified with the -p option.

• --tcp-urg, -V — sets the Urgent Pointer of the TCP header in the Redirect payload. If you don't specify it, the Urgent Pointer is 0. Zero. Nothing. Empty. 💀

Note: only meaningful if "TCP" has been specified with the -p option.

• --tcp-win, -w — sets the Window of the TCP header in the Redirect payload. Unspecified? The Window is randomized. ✨

Note: only meaningful if "TCP" has been specified with the -p option.

• --resp-mcast, -M — tells the tool that, when it's in "passive" mode, it should also respond to packets sent to multicast addresses. By default the tool does not send Redirects in response to packets sent to multicast addresses. 👑
• --make-onlink, -O — instructs the tool to set the Redirect Target Address to the same value as the Redirect Destination Address, which makes that address count as "on-link". It's giving "same address, different font" 💅
• --learn-router, -N — tells the tool to learn the link-layer and the (link-local) IPv6 addresses of the local router via Router Solicitation and Router Advertisement messages. If the IPv6 Source Address or the link-layer Source Address are left unspecified, the values learned with this option get used instead. 🦋

Note: this one is very useful — it saves you from having to hand-type the IPv6 and/or Ethernet addresses of the router. iykyk

• --target-lla-opt, -E — specifies the contents of a target link-layer address option to include in the Redirect messages. One option specified? It goes into all the outgoing Redirect messages. More than one target link-layer address specified (via multiple -E options) and they all can't fit into a single Redirect message? Then multiple Redirect messages get sent, as needed. 📦📦
• --add-tlla-opt, -e — tells rd6 to include a target link-layer address option in the Redirect messages it sends. When you use this, the link-layer Source Address must be specified, and that value gets used for the target link-layer address option. The difference between this and the -E option: -e doesn't specify the actual value of the option, it just says "include a target link-layer address option" (and the actual value is selected as explained above). Same vibe, different job. 🎀
• -j SRC_ADDR, --block-src SRC_ADDR — sets a block filter for incoming packets based on their IPv6 Source Address. You can hand it an IPv6 prefix in the form -j prefix/prefixlen. No prefix length given? Then a prefix length of /128 is selected — i.e. the option assumes you meant a single IPv6 address, not an IPv6 prefix. 🚫
• -k DST_ADDR, --block-dst DST_ADDR — sets a block filter for incoming Neighbor Solicitation messages based on their IPv6 Destination Address. Prefix form is -k prefix/prefixlen, and if the prefix length isn't specified, a prefix length of /128 is selected (i.e. it assumes a single IPv6 address rather than an IPv6 prefix). 🚫
• -J SRC_ADDR, --block-link-src SRC_ADDR — sets a block filter for incoming packets based on their link-layer Source Address. Must be followed by a link-layer address. Heads up: this one is only valid for Ethernet interfaces. 🌐
• -K DST_ADDR, --block-link-dst DST_ADDR — sets a block filter for incoming packets based on their link-layer Destination Address. Must be followed by a link-layer address. Again: only valid for Ethernet interfaces. 🌐
• -b SRC_ADDR, --accept-src SRC_ADDR — sets an accept filter for incoming packets based on their IPv6 Source Address. Prefix form: -b prefix/prefixlen. If the prefix length isn't specified, /128 is selected — so it assumes a single IPv6 address, not a prefix. ✅
• -g DST_ADDR, --accept-dst DST_ADDR — sets an accept filter for incoming packets based on their IPv6 Destination Address. Prefix form: -g prefix/prefixlen. No prefix length? /128 it is, i.e. it assumes a single IPv6 address rather than an IPv6 prefix. ✅
• -B SRC_ADDR, --accept-link-src SRC_ADDR — sets an accept filter for incoming Neighbor Solicitation messages based on their link-layer Source Address. Must be followed by a link-layer address, and it's only valid for Ethernet interfaces. 🌸
• -G DST_ADDR, --accept-link-dst DST_ADDR — sets an accept filter for incoming packets based on their link-layer Destination Address. Must be followed by a link-layer address, and (say it with me) only valid for Ethernet interfaces. 🌸
• --sanity-filters, -w — automatically adds an "accept filter" for the link-layer Destination Address that corresponds to the local router (either learned via the --learn-router option, or specified with the -S option), plus a block filter for the IPv6 Source Address fe80::/16. 🧠

Note: you want this in virtually all scenarios, so the tool doesn't go responding to link-local traffic and all that. Basically a vibe check for your packets.

• --flood-dests, -R — tells rd6 to send multiple Redirect messages for different Redirect Destination Addresses. How many different ones? You say so with -R number. Each packet's Redirect Destination Address is randomly picked from the prefix ::/0, unless you specified a different prefix with the -r option. 🌊
• --flood-targets, -T — tells rd6 to send multiple Redirect messages for different Redirect Target Addresses. The number of different Target Addresses is specified as -T number. Each packet's Target Address is randomly selected from the prefix fe80::/64, unless a different prefix was specified with the -t option. 🎯
• --flood-sources, -F — tells the tool to send multiple Redirect messages with different Source Addresses. The number of different sources is -F number. Each Redirect message's Source Address is randomly selected from the prefix specified by the -s option. If -F is specified but -s is left unspecified, the packets' Source Address is randomly selected from the prefix fe80::/64 (link-local unicast). Also worth clocking: hosts are required to discard Redirect messages whose IPv6 Source address doesn't match the (link-local) IPv6 address of the router used for the Redirect Destination Address. 😭
• --loop, -l — tells rd6 to send periodic Redirect messages to the victim node. The pause between sends can be set with the -z option and defaults to 1 second. Note that this option cannot be set together with the -L (--listen) option. ⏰
• --sleep, -z — specifies how long to pause between sending Redirect messages (when --loop is set). Left unspecified, it defaults to 1 second. 😴
• --listen, -L — tells rd6 to operate in passive mode (possibly after attacking a given node). Note that this option cannot be used together with the -l (--loop) option. 👂
• --verbose, -v — tells rd6 to be verbose. Set it twice and the tool is "very verbose", and it also tells you which packets were accepted or discarded because of the filters you specified. Spill the tea, bestie 🗣️
• --help, -h — print help information for the rd6 tool. 🆘

---

✨ EXAMPLES ✨

The following sections illustrate typical use cases of the rd6 tool. Real ones. Periodt. 💅

🌟 Example #1 🌟

# rd6 -i eth0 --learn-router --sanity-filters -L --make-onlink -v

The tool uses the network interface "eth0" and operates in passive mode (the -L option). The IPv6 and Ethernet address of the local router is automatically learned by means of RS/RA messages. Basic filters get employed so it doesn't respond to incorrect/unnecessary packets (--sanity-filters). Each Redirect message will contain the Redirect Target Address set to the same value as the Redirect Destination Address, which makes the corresponding address count as "on-link" (the --make-onlink option). And the tool prints detailed information about the attack (the -v option). 👑

🌟 Example #2 🌟

# rd6 -i eth0 --learn-router -d 2001:db8::1 -r 2001:db8::/64 -t
fe80::bad -R 100 -l -v

Flood the victim host (specified with the -d option) with batches of 100 Redirect messages (the -R 100 option). Each Redirect message redirects a random address from the prefix "2001:db8::/64" to the address "fe80::bad". The IPv6 and link-layer addresses of the current local router get dynamically learned by means of RS/RA messages (the --learn-router option). The process repeats every second (the -l option, with the default delay of 1 second). 🔁🔥

👀 SEE ALSO 👀

Okay bestie, if you wanna go deep deep into the lore, there's this absolute banger of a paper:

• "Security/Robustness Assessment of IPv6 Neighbor Discovery Implementations" — you can grab it at http://www.si6networks.com/tools/ipv6toolkit/si6networks-ipv6-nd-assessment.pdf

It's literally the whole tea on Neighbor Discovery vulnerabilities 💀, plus it's got extra examples of how to use the na6 tool to exploit them. So if you were sitting here like "okay but what do I DO with all this power", that PDF is your girl. Go read it, iykyk 🫶

---

🫶 AUTHOR 🫶

Not me giving credit where it's due, because we always do that:

The rd6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>.

Periodt. 👑

---

📜 COPYRIGHT 📜

Copyright (c) 2011-2013 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.

A copy of the license is available at http://www.gnu.org/licenses/fdl.html.

fr fr, that's the whole legal bit — no extra clauses hiding in there, no sneaky fine print, just the standard GFDL situation. 💖

---

And that's a wrap on the rd6(1) page, bestie!! 🎀 You made it all the way to the end, main character energy only. This whole thing is RD6(1) — that's the source and version tag stamped on it, courtesy of the SI6 Networks / IPv6 Toolkit era, dated back in that 2011–2013 copyright window. Go be iconic with your router discovery. Slay. 💅✨🦋