RS6(1)

📦 version 2.2, in debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NAME 💖

rs6 — a security assessment tool for attack vectors based on ICMPv6 Router Solicitation messages. bestie, it's the IPv6 Toolkit's router-solicitation gremlin and it is serving.

oh and quick vibe check before we dive in: this page is rs6(1) from the General Commands Manual. that's the manual it lives in, no cap.

✨ SYNOPSIS ✨

rs6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-y FRAG_SIZE] [-u
DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-S
LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-E LINK_ADDR] [-e] [-F N_SOURCES] [-z
SECONDS] [-l] [-v] [-h]

🦋 DESCRIPTION 🦋

okay so picture this: rs6 lets you assess IPv6 implementations against a whole buffet of attacks built on ICMPv6 Router Solicitation messages. it's part of the SI6 Networks' IPv6 Toolkit — a security assessment suite for the IPv6 protocols. literally the whole suite is iconic, and this is one of its little stars. 🌟

👑 OPTIONS 👑

rs6 takes its parameters as command-line options. every single option can be written with a short name (one character with a hyphen in front, like -i) or with a long name (a whole string with two hyphens in front, like --interface). pick your fighter, both slay.

depending on how much info (i.e., options and option data) you're trying to shove into your Router Solicitations, rs6 may need to split all that into more than one Router Solicitation. also, when the tool is told to flood the victim with Router Solicitations from different sources (that's the --flood-sources option), multiple packets may need to be generated. rs6 does support IPv6 fragmentation, which is handy if you've got a lot of information to convey inside one single Router Solicitation message. but heads up: IPv6 fragmentation is not enabled by default, you have to explicitly turn it on with the -y option. periodt.

  • -i INTERFACE, --interface INTERFACE — tells the tool which network interface to use. if the destination address (the -d option) is a link-local address, you must specify the interface explicitly. you can also hand the interface over along with a destination address using the -d option. 💅
  • -s SRC_ADDR, --src-address SRC_ADDR — this one's for specifying the IPv6 Source Address (or IPv6 prefix) to use for the Router Solicitation messages. leave it out and it'll pick a randomized link-local unicast (fe80::/64) address for you. spontaneous king behavior tbh.
  • -d DST_ADDR, --dst-address DST_ADDR — sets the IPv6 Destination Address of the Router Solicitation messages. if you don't specify it, but you did specify the Ethernet Destination Address, then the "all-routers link-local multicast" address (ff02::2) gets picked as the IPv6 Destination Address. slay.
  • --hop-limit, -A — sets the IPv6 Hop Limit to use for the Router Solicitation messages. it defaults to 255. now listen: IPv6 nodes are required to check that the Hop Limit of incoming Router Solicitation messages is 255. so this option is only useful for assessing whether an IPv6 implementation fails to enforce that check. iykyk. 👀
  • -y SIZE, --frag-hdr SIZE — says the resulting packet must be fragmented. you pass the fragment size as the argument to this option. it's giving "break me apart, respectfully".
  • -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — says a Destination Options header is to be included in the resulting packet. the extension header size goes in as the argument (the header gets filled with padding options). want more than one Destination Options header? just stack multiple -u options. the more the merrier. 🎀
  • -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — like the above, but the Destination Options header goes into the "unfragmentable part" of the resulting packet. the header size is the argument (filled with padding options, same deal). multiple -U options = multiple headers. important caveat: this option is only valid if the -y option is specified — because the whole concept of an "unfragmentable part" only makes sense when fragmentation is actually being used. no -y, no -U. periodt.
  • -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — says a Hop-by-Hop Options header is to be included in the resulting packet. header size goes in as the argument (you guessed it: filled with padding options). multiple -H options stack up multiple Hop-by-Hop Options headers. obsessed.
  • -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — sets the link-layer Source Address of the Router Solicitation messages (currently, only Ethernet is supported). leave it unspecified and the link-layer Source Address is randomized. mystery era. 🙈
  • -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — sets the link-layer Destination Address of the Router Solicitation messages (again, currently only Ethernet is supported). leave it unspecified and the link-layer Destination Address is set to 33:33:00:00:00:02 — the Ethernet address that corresponds to the "all-routers link-local multicast" address. the default is a bop.
  • --source-lla-opt, -E — specifies the contents of a source link-layer address option to include in the Router Solicitation messages. if you specify more than one source link-layer address (by stacking multiple -E options), and all the resulting options can't fit into a single Router Solicitation, then multiple Router Solicitations will be sent as needed. she adapts. 💖
  • --add-slla-opt, -e — tells rs6 to include a source link-layer address option in the Router Solicitation messages it sends. the link-layer address inside that option is the same as the Ethernet Source Address used for the outgoing Router Solicitation messages. matching set, cute.
  • --flood-sources, -F — tells rs6 to send Router Solicitations from multiple (and random) IPv6 Source Addresses. you specify how many different sources with -F number. the IPv6 Source Address of each Router Solicitation is randomized from the IPv6 prefix given with the -s option, and it defaults to a random link-local unicast address (fe80::/64). flood era activated. 🌊
  • --loop, -l — tells rs6 to send periodic Router Solicitations to the destination node. how long to pause between sending Neighbor Solicitations can be set with the -z option, and it defaults to 1 second.
  • --sleep, -z — sets the amount of time to pause between sending Router Solicitation messages. if you leave it unspecified, it defaults to 1 second. nap break, but make it malicious. 😴
  • --verbose, -v — tells rs6 to be verbose. spill the tea, girl.
  • --help, -h — print help information for the rs6 tool. the classic "just tell me what's going on" button.

🌈 EXAMPLES 🌈

the following sections illustrate typical use cases of the rs6 tool. let's get into it.

Example #1

# rs6 -i eth0 -e

use the network interface eth0 to send a Router Solicitation using a random link-local unicast IPv6 Source Address and a random Ethernet Source Address, to the IPv6 Destination Address ff02::2 (the "all-routers link-local multicast" address, selected by default) and the Ethernet Destination Address 33:33:00:00:00:02 (also selected by default). the Router Solicitation also includes a source link-layer address option, containing the same Ethernet address as the one used for the Ethernet Source Address of the packet. so it's a little matching moment. ✨

Example #2

# rs6 -i eth0 -e -F 100 -l -z 10 -v

send 100 Router Solicitation messages using a random Ethernet Source Address and a random IPv6 Source Address for each of them, to the Ethernet Destination Address 33:33:00:00:00:02 (default) and the IPv6 Destination Address ff02:2 (default). each message includes a source link-layer address option containing the same link-layer address as the one used for the Ethernet Source Address of the packet. repeat this operation every ten seconds. be verbose. she's loud and she's proud. 📣

Example #3

# rs6 -i eth0 -d fe80::1 -E ff:ff:ff:ff:ff:ff -v

send one Router Solicitation message using a random Ethernet Source Address and a random link-local unicast (i.e., fe80::/64) IPv6 Source Address, to the Ethernet Destination Address 33:33:00:00:00:02 (default) and the IPv6 Destination Address fe80::1. each Router Solicitation includes a source link-layer address option containing the Ethernet address ff:ff:ff:ff:ff:ff. be verbose. chef's kiss. 👑

🫶 SEE ALSO 🫶

go read "Security/Robustness Assessment of IPv6 Neighbor Discovery Implementations" (available at: <http://www.si6networks.com/tools/ipv6toolkit/si6networks-ipv6-nd-assessment.pdf>) — it's a whole discussion of Neighbor Discovery vulnerabilities, plus additional examples of how to use the na6 tool to exploit them. required reading, bestie. 📚

💜 AUTHOR 💜

the rs6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>. king behavior, honestly.

Copyright (c) 2011-2013 Fernando Gont.

permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. a copy of the license is available at <http://www.gnu.org/licenses/fdl.html>.

and that's the whole page, bestie 💅 this was rs6(1) from the General Commands Manual, and it ate. go forth and solicit some routers, responsibly. 🦋🌸✨
📦 where this page comes from