TCP6(1)

📦
version 2.2 · 2 versions
, in epel 10, epel 9, fedora 43, fedora 44

🎀 tcp6 — General Commands Manual 🎀

okay bestie, welcome to tcp6, page TCP6(1) of the General Commands Manual 💖 she's a whole security assessment tool for TCP/IPv6 implementations and honestly? she eats.

✨ NAME ✨

tcp6 — a security assessment tool for TCP/IPv6 implementations 🦋

✨ SYNOPSIS ✨

tcp6 -i INTERFACE [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-s
SRC_ADDR[/LEN]] [-d DST_ADDR] [-A HOP_LIMIT] [-y FRAG_SIZE] [-u
DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-c
OPEN_TYPE] [-C CLOSE_TYPE] [-P PAYLOAD_SIZE] [-o SRC_PORT[/LEN]] [-a
DST_PORT[/LEN]] [-X TCP_FLAGS] [-q TCP_SEQ] [-Q TCP_ACK] [-V TCP_URP]
[-w TCP_WIN] [-W WINDOW_MODE] [-M WIN_MOD_MODE] [-Z DATA] [-N] [-n] [-j
PREFIX[/LEN]] [-k PREFIX[/LEN]] [-J LINK_ADDR] [-K LINK_ADDR] [-b
PREFIX[/LEN]] [-g PREFIX[/LEN]] [-B LINK_ADDR] [-G LINK_ADDR] [-F
N_SOURCES] [-T N_PORTS] [-f] [-R] [-L] [-l] [-p PROBE_MODE] [-z SECONDS]
[-r RATE] [-v] [-h]

✨ DESCRIPTION ✨

so tcp6 lets you assess IPv6 implementations against a whole buffet of attack vectors based on TCP/IPv6 segments. she's part of the SI6 Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols, and yes she's that girl 💅

tcp6 can be used to perform specific TCP connection-establishment and connection-termination sequences. for example, she can simulate a TCP "simultaneous open" scenario (peep the --open-mode option) or simulate a TCP "simultaneous close" scenario (see the --close-mode option). she can also run a bunch of resource-exhaustion attacks against TCP — SYN-flooding attacks, connection-flooding attacks (check the --flood-sources and --flood-ports options), etc. and on top of all that, she can exploit attack vectors based on the TCP window (see the --window option). versatile queen 👑

tcp6 has two modes of operation: active and listening. In active mode, the tool attacks a specific target; in listening mode, the tool listens to TCP traffic on the local network and launches an attack in response to that traffic. Active mode is what happens when an IPv6 Destination Address is specified. Listening mode is what happens when the -L option (or its long counterpart --listen) is set. and if you specify both an attack target and the -L option, the attack is launched against that specified target, and then the tool enters listening mode to respond to incoming packets with TCP segments. main character behavior fr fr ✨

tcp6 supports filtering of incoming packets based on the Ethernet Source Address, the Ethernet Destination Address, the IPv6 Source Address, and the IPv6 Destination Address. there are two types of filters: "block filters" and "accept filters". If any "block filter" is specified and the incoming packet matches any of those filters, the message is discarded (so no TCP segments get sent in response, bye 👋). If any "accept filter" is specified, incoming packets must match the specified filters in order for the tool to respond with TCP segments. vibe check: passed or not passed, no in-between 💀

✨ OPTIONS ✨

tcp6 takes its parameters as command-line options. Each of the options can be specified with a short name (one character preceded with the hyphen character, like -i) or with a long name (a string preceded with two hyphen characters, like --interface). pick your fighter 🫶

If the tool is instructed to, like, flood the victim with TCP segments from different sources (that's the --flood-sources option), multiple packets may need to be generated. just so you know.

tcp6 supports IPv6 Extension Headers, including the IPv6 Fragmentation Header, which might be of use to circumvent layer-2 filtering and/or Network Intrusion Detection Systems (NIDS). however — and this is important bestie — IPv6 extension headers are not employed by default, and must be explicitly enabled with the corresponding options. no sneaky defaults here 💅

  • -i INTERFACE, --interface INTERFACE — this option specifies the network interface that the tool will use. The network interface must be specified (i.e., the tool does not select any network interface "by default"). no autopilot, you have to tell her 🎀
  • -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — this option specifies the link-layer Source Address of the probe packets. If left unspecified, the link-layer Source Address of the packets is set to the real link-layer address of the network interface. Note: this option is meaningful only when the underlying link-layer technology is Ethernet.
  • -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — this option specifies the link-layer Destination Address of the probe packets. By default, the link-layer Destination Address is automatically set to the link-layer address of the destination host (for on-link destinations) or to the link-layer address of the first-hop router. Note: this option is meaningful only when the underlying link-layer technology is Ethernet.
  • -s SRC_ADDR[/LEN], --src-address SRC_ADDR[/LEN] — this option specifies the IPv6 source address (or IPv6 prefix) to be used for the Source Address of the attack packets. If the LEN parameter is specified, the tool will employ a randomized Source Address for the packets. If the -F (--flood-sources) option is specified, a random address will be selected for each packet. See the description of the -F option for further information on how the -s option is processed in that specific case.

Note: When operating in "listening" mode, the Source Address is automatically set to the Destination Address of the incoming packet. she just knows 😌

  • -d DST_ADDR, --dst-address DST_ADDR — this option specifies the IPv6 Destination Address of the victim. It can be left unspecified only if the -L option is selected (i.e., if the tool is to operate in "listening" mode).

Note: When operating in "listening" mode, the Destination Address is automatically set to the Source Address of the incoming packet.

  • -A HOP_LIMIT, --hop-limit HOP_LIMIT — this option specifies the Hop Limit to be used for the IPv6 packets. It defaults to 255.
  • -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — this option specifies that a Destination Options header is to be included in the outgoing packet(s). The extension header size must be specified as an argument to this option (the header is filled with padding options). Multiple Destination Options headers may be specified by means of multiple -u options. stack 'em up 🧚
  • -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — this option specifies a Destination Options header to be included in the "unfragmentable part" of the outgoing packet(s). The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Destination Options headers may be specified by means of multiple -U options.
  • -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — this option specifies that a Hop-by-Hop Options header is to be included in the outgoing packet(s). The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Hop-by-Hop Options headers may be specified by means of multiple -H options.
  • -y FRAG_SIZE, --frag-hdr FRAG_SIZE — this option specifies that the resulting packet must be fragmented. The fragment size must be specified as an argument to this option.
  • -P PAYLOAD_SIZE, --payload-size PAYLOAD_SIZE — this option specifies the size of the TCP payload. It defaults to 0 (i.e., empty TCP segments).
  • -o SRC_PORT[/LEN], --src-port SRC_PORT[/LEN] — this option specifies the TCP Source Port. If the LEN parameter is specified, the Source Port number will be randomized using the corresponding LEN as a mask (in a similar way to the specification of source addresses). If the --flood-ports option is specified, the source port is randomized for each packet. Otherwise, all packets will employ the same randomized port.
  • -a DST_PORT[/LEN], --dst-port DST_PORT[/LEN] — this option specifies the TCP Destination Port. If the LEN parameter is specified, the Destination Port number will be randomized using the corresponding LEN as a mask (in a similar way to the specification of source addresses).
  • -X TCP_FLAGS, --tcp-flags TCP_FLAGS — this option is used to set specific TCP flags. The flags are specified as "F" (FIN), "S" (SYN), "R" (RST), "P" (PSH), "A" (ACK), "U" (URG), "X" (no flags).

If this option is not set, and the tool operates in listening mode, the flags of the generated TCP segments are automatically set as follows: TCP segments elicited by SYNs have both the SYN and ACK flags set. All other TCP segments have the ACK bit set.

  • -q SEQ_NUMBER, --tcp-seq SEQ_NUMBER — this option specifies the Sequence Number of the TCP header. If left unspecified, the Sequence Number is randomized.

If this option is left unspecified and the tool is operating in listening mode, the TCP Sequence Number is set to the Acknowledgement Number of the packet that elicited the TCP segment.

  • -Q ACK_NUMBER, --tcp-ack ACK_NUMBER — this option specifies the Acknowledgment Number of the TCP segment. If left unspecified, the Acknowledgment Number is randomized if the ACK flag is set, and otherwise is set to 0.

If this option is left unspecified and the tool is operating in listening mode, the TCP Sequence Number is set to the Acknowledgement Number of the packet that elicited the TCP segment.

  • -V URG_POINTER, --tcp-urg URG_POINTER — this option specifies the Urgent Pointer of the TCP segment. If left unspecified, the Urgent Pointer is set to 0.
  • -w TCP_WINDOW, --tcp-win TCP_WINDOW — this option specifies the value of the TCP Window. If left unspecified, the Window is randomized.
  • -W WIN_MODE, --window-mode WIN_MODE — this option specifies how to operate the TCP window by means of the WIN_MODE parameter. Two modes are supported:
    • closed
    • modulated

When the "closed" mode is selected, the TCP window will be set to 0 (i.e., "closed window"). If the tool establishes new TCP connections, the initial window advertised during the TCP three-way handshake will be that specified with the -w option. However, once the connection has been established, the TCP window will be set to 0. This allows for the implementation of the so-called Netkill attack, discussed in Section 7.1.1 of the document "Security Assessment of the Transmission Control Protocol (TCP)" (available at: http://www.gont.com.ar/papers/tn-03-09-security-assessment-TCP.pdf). 🌈

Okay so when the "modulated" mode is selected, the TCP window is gonna oscillate between two different values — like it's switching outfits, back and forth. 💃 Those two values, plus the amount of time each one stays "active", get specified with the -M (--win-modulate) option. The first value is the one meant to close the window (so like, typically it's zero), and the second one is meant to open the window. Why are we doing this little dance? Because the whole point of alternating is to dodge a trivial mitigation against Zero-Window attacks that some stacks implement, where they cap the maximum amount of time the TCP window advertised by a remote peer can stay fully-closed (i.e., set to 0). But if you keep flipping the advertised window to some other (small) value every now and then? That cute little "counter-measure" is easily circumvented. periodt. 💅

  • -M WIN_MOD_MODE, --win-modulation WIN_MOD_MODE — this one specifies the two values (and how long each one lasts) that your TCP window is gonna alternate between. WIN_MOD_MODE has the syntax WIN1:TIME1:WIN2:TIME2, where WIN1 and WIN2 are the window sizes for each period, and TIME1 and TIME2 are the respective time lengths. So for example, setting --win-modulation 0:60:10:30 makes tcp6 alternate between advertising a TCP window of 0 bytes for 60 seconds, and advertising a TCP window of 10 bytes for 30 seconds. Iconic.

You'll typically run this alongside one of the flooding options (--flood-sources and/or --flood-ports) plus the --data option, so that multiple TCP connections get established and the target TCPs keep their retransmission buffer full. In that scenario, the TCP window "modulation" option can be leveraged to evade the trivial counter-measures some TCP stacks implement that try to mitigate Zero-Window attacks by enforcing a limit on the maximum amount of time the TCP window can sit in the "closed state". 🫶

  • -c OPEN_MODE, --open-mode OPEN_MODE — sets the connection-establishment mode, bestie. Here are your options:
    • simultaneous
    • passive
    • abort

When simultaneous is selected, tcp6 responds to incoming SYN segments with other SYN segments, simulating a "simultaneous open" scenario. When passive is selected, tcp6 responds to incoming SYN segments with the typical SYN/ACK segments, leading to the traditional "three-way handshake". And finally, when abort is selected, tcp6 responds to incoming SYN segments with RST segments, so it's just aborting the incoming connections. 😭

For the most part this option is useful for assessing the correct behavior of TCP implementations (like, does it support "simultaneous opens" or not, iykyk).

  • -C CLOSE_MODE, --close-mode CLOSE_MODE — sets the connection-termination mode. The modes available are:
    • simultaneous
    • passive
    • abort
    • active
    • FIN-WAIT-1
    • FIN-WAIT-2
    • LAST-ACK

When simultaneous is selected, tcp6 responds to incoming FIN segments with FIN segments, simulating a "simultaneous close" scenario. When passive is selected, tcp6 responds to incoming FIN segments with the typical FIN/ACK segments, leading to the traditional TCP connection-termination sequence. When abort is selected, tcp6 responds to incoming FIN segments with RST segments, aborting the corresponding connections. And when active is selected, tcp6 starts the connection-termination sequence itself by sending a FIN segment. 💅

The FIN-WAIT-1, FIN-WAIT-2, and LAST-ACK modes will leave connections in the FIN-WAIT-1, FIN-WAIT-2, and LAST-ACK states respectively. But heads up — for the remote TCPs to transition to the FIN-WAIT-1 or FIN-WAIT-2 states, those remote TCPs must perform the "active close". That can be trivially triggered for application protocols like HTTP, but it might not be feasible for other protocols. 🙈

  • -Z DATA, --data DATA — used to specify a payload that should be sent as the first data segment once a TCP connection has been established. It'll typically include an application-layer request. Note: the string you pass as DATA can contain the "\r" and "\n" C-style escape sequences for representing "carriage return" and "line feed" respectively. 🍓

Example vibes: you could use this option to send an HTTP request if you set it as --data "GET / HTTP/1.0\r\n\r\n".

  • -N, --not-ack-data — tells tcp6 not to acknowledge the TCP payload of incoming segments (when it's operating in listening mode).

Note: by default, tcp6 acknowledges both the payload and the flags of the incoming TCP segments.

  • -n, --not-ack-flags — tells tcp6 not to acknowledge the TCP flags (SYN and/or FIN) of incoming segments (again, when operating in listening mode).

Note: by default, tcp6 acknowledges both the payload and the flags of the incoming TCP segments.

  • -j SRC_ADDR, --block-src SRC_ADDR — sets a block filter for incoming packets based on their IPv6 Source Address. It lets you specify an IPv6 prefix in the form -j prefix/prefixlen. If you don't give a prefix length, a prefix length of /128 is selected (so the option assumes you meant a single IPv6 address rather than an IPv6 prefix). ✨
  • -k DST_ADDR, --block-dst DST_ADDR — sets a block filter for incoming packets based on their IPv6 Destination Address. Lets you specify an IPv6 prefix in the form -k prefix/prefixlen. No prefix length? Then /128 is selected, i.e. the option assumes a single IPv6 address rather than an IPv6 prefix.
  • -J LINK_ADDR, --block-link-src LINK_ADDR — sets a block filter for incoming packets based on their link-layer Source Address. This option must be followed by a link-layer address (currently, only Ethernet is supported).
  • -K LINK_ADDR, --block-link-dst LINK_ADDR — sets a block filter for incoming packets based on their link-layer Destination Address. Must be followed by a link-layer address (currently, only Ethernet is supported).
  • -b SRC_ADDR, --accept-src SRC_ADDR — sets an accept filter for incoming packets based on their IPv6 Source Address. Specify an IPv6 prefix in the form -b prefix/prefixlen. If the prefix length isn't specified, /128 is selected (the option assumes a single IPv6 address rather than an IPv6 prefix). 💖
  • -g DST_ADDR, --accept-dst DST_ADDR — sets an accept filter for incoming packets based on their IPv6 Destination Address. Specify an IPv6 prefix in the form -g prefix/prefixlen. If the prefix length isn't specified, /128 is selected (again, the option assumes a single IPv6 address rather than an IPv6 prefix).
  • -B LINK_ADDR, --accept-link-src LINK_ADDR — sets an accept filter for incoming packets based on their link-layer Source Address. Must be followed by a link-layer address (currently, only Ethernet is supported).
  • -G LINK_ADDR, --accept-link-dst LINK_ADDR — sets an accept filter for incoming packets based on their link-layer Destination Address. Must be followed by a link-layer address (currently, only Ethernet is supported).
  • -F N_SOURCES, --flood-sources N_SOURCES — tells the tool to send multiple TCP segments from different Source Addresses. You specify the number of different source addresses as -F number. The Source Address of each TCP segment is randomly selected for each packet from the prefix specified by the -s option. And if -F is specified but -s is left unspecified, the Source Address of the packets is randomly selected from the prefix ::/0. 🌈
  • -T N_PORTS, --flood-ports N_PORTS — tells the tool to send multiple TCP segments with different Source Ports. The Source Port gets randomized from the port range specified via the --src-port option or, if that's left unspecified, from the whole port number space (0-65535). 🎀
  • -l, --loop — tells the tcp6 tool to send periodic TCP segments to the victim node. How long to pause between sending TCP segments is set by the -z option, and defaults to 1 second. Note that this option cannot be set together with the -L (--listen) option. 😤
  • -z, --sleep — specifies the amount of time to pause between sending TCP segments (when the --loop option is set). If you leave it unspecified, it defaults to 1 second.
  • -r RATE, --rate-limit RATE — specifies the rate limit to use when performing a remote address scan. RATE should be given as xbps or xpps (with x being an unsigned integer), for rate-limits in bits per second or packets per second respectively. ⭐
  • -L, --listen — instructs the tcp6 tool to operate in listening mode (possibly after attacking a given node). Note that this option cannot be used in conjunction with the -l (--loop) option.
  • -p PROBE_MODE, --probe-mode PROBE_MODE — tells tcp6 to operate in probe mode, with the specific probe mode given as an argument (currently, only script mode is supported). In probe mode, tcp6 sends probe segments and waits for response packets, and those response packets get decoded based on the probe mode you selected. 🧚

In the script probe mode, bestie, the tool decodes TCP segments like this:

RESPONSE:RESPONSE_TYPE:RESPONSE_DECODE...

Where the string RESPONSE is fixed ✨ and RESPONSE_TYPE tells you what kind of response came back. As of this version of the tool, these are the RESPONSE_TYPE values you can get:

  • TCP6 — means the tool received a TCP/IPv6 packet 🎀
  • TIMEOUT — means the tool received no response at all 💀

If RESPONSE_TYPE is TCP6, the RESPONSE code carries the TCP flags that were set in the received TCP segment. Those flags get encoded as "F" (FIN), "S" (SYN), "R" (RST), "P" (PSH), "A" (ACK), and "U" (URG). slay.

The possible output lines of the tool are:

RESPONSE:TIMEOUT:
RESPONSE:TCP6:RA:
heads up bestie 👀 Future versions of the tool will also decode ICMPv6 error messages, and will include additional data regarding the incoming TCP segments (e.g., ACK value, payload size, etc.). That's a future-version thing, not a right-now thing, so don't come for me.

💬 -v, --verbose

This option tells the tcp6 tool to be verbose. And if you set it twice, the tool becomes "very verbose", and it will also tell you which packets got accepted or discarded as a result of applying the filters you specified. she's chatty like that 🗣️💅

🆘 -h, --help

Prints help information for the tcp6 tool. the classic. when in doubt, ask for help 🫶

🌸 EXAMPLES 🌸

The following sections illustrate typical use cases of the tcp6 tool. grab a snack, we're going shopping 🛍️

✨ Example #1

# tcp6 -s fc00:1::/64 -d fc00:1::1 -a 22 -X S -F 100 -l -z 1 -v

In this example the tcp6 tool is basically being used to pull off a SYN-flood attack against port number 22 of the host fc00:1::1. The tool uses the network interface "eth0" (as specified by the -i option), and sends SYN segments (as specified by the -X option) from the prefix fc00:1::/64 (as specified by the -s option) to port 22 (specified by the -a option) at the destination address fc00:1::1 (specified by the -d option). The tool sends TCP segments from 100 different addresses (as specified by the -F option) every one second (as specified by the -l and -z options). And the tool will be verbose (as specified by the -v option). iconic behavior honestly 💅

✨ Example #2

# tcp6 -i eth0 -L -X RA -v

In this example, the tcp6 tool is employed to perform a TCP connection-reset attack against all active TCP connections in the local network 😭. The tool listens (-L) on the interface eth0 (-i eth0), and responds to any TCP segments with a RST packet (with both the RST and ACK bits set). The tool will be verbose. so it's just out here ending everyone's conversations, ok.

✨ Example #3

# tcp6 -i eth0 -d fc00:1::1 -a 80 -L -s fc00:1::/112 -l -r 1pps -v
--data "GET / HTTP/1.0\r\n\r\n" --close-mode last-ack --flood-ports 10

Flood the target system (fc00:1::1) with connections that stay in the LAST-ACK state (on port 80), sending packets at a rate of one packet per second. For each forged address, 10 different (forged) ports are used. For each connection, tcp6 will send an HTTP application request. very "let me just leave this here and never text back" energy 🎀

✨ Example #4

# tcp6 -i eth0 -d fc00:1::1 -a 80 -L -s fc00:1::/112 -l -r 1000pps
--tcp-flags auto -v --data "GET / HTTP/1.0\r\n\r\n" --flood-ports 10
--window-mode close

Flood the target node (fc00:1::1) with TCP connections (on port 80). On each connection that is established, an HTTP request is sent, and the TCP window is immediately closed. For each forged IPv6 source address ten different TCP source ports are randomized. The bandwidth of the attack is limited to 1000 pps. boundaries? set. window? closed. 🦋

✨ Example #5

# tcp6 -d fc00:1::1 -a 80 --tcp-flags A --dst-opt-hdr 8 --payload-size
50 --probe-mode script

Send a probe TCP segment to TCP port 80 at fc00:1::1. The probe packet consists of an IPv6 packet with a Destination Options header of 8 bytes, and an IPv6 payload consisting of a TCP segment with the ACK bit set, and 50 data bytes. The probe mode is "script". lowkey the cutest one of the bunch, she's just asking questions 📨

👀 SEE ALSO 👀

"Security Assessment of the Transmission Control Protocol (TCP)" (available at: <http://www.gont.com.ar/papers/tn-03-09-security-assessment-TCP.pdf>) for a discussion of TCP vulnerabilities. required reading bestie, fr fr 📚

👑 AUTHOR 👑

The tcp6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <https://www.si6networks.com>. king behavior, we love a credited author 🫶

Copyright (c) 2011-2020 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>. read the license bestie, it's giving "legally required but also kinda iconic" ⭐

and that's a wrap on the whole page 💖 it's TCP6(1) — the tcp6 tool's very own manual page from the SI6 Networks crew. go forth and be verbose (twice, if you're feeling spicy). bye bestie!! 🌈🎀✨

📦 where this page comes from