UDP6(1)

🌸 udp6 — the General Commands Manual, but make it make sense 🌸

okay bestie, welcome to the manual page for udp6, straight out of the General Commands Manual. she's a security tool, she's a whole personality, and she's about to teach you everything about UDP/IPv6 assessment. no cap. let's go 💅

✨ NAME ✨

udp6 — a security assessment tool for UDP/IPv6 implementations 🦋

📜 SYNOPSIS 📜

udp6 -i INTERFACE [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-s
SRC_ADDR[/LEN]] [-d DST_ADDR] [-A HOP_LIMIT] [-y FRAG_SIZE] [-u
DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-P
PAYLOAD_SIZE] [-o SRC_PORT[/LEN]] [-a DST_PORT[/LEN]] [-Z DATA] [-j
PREFIX[/LEN]] [-k PREFIX[/LEN]] [-J LINK_ADDR] [-K LINK_ADDR] [-b
PREFIX[/LEN]] [-g PREFIX[/LEN]] [-B LINK_ADDR] [-G LINK_ADDR] [-F
N_SOURCES] [-T N_PORTS] [-L] [-l] [-p PROBE_MODE] [-z SECONDS] [-r RATE]
[-v] [-h]

💖 DESCRIPTION 💖

so udp6 is literally here to let you assess IPv6 implementations against a whole buffet of attack vectors built on UDP/IPv6 datagrams. it's part of the SI6 Networks' IPv6 Toolkit — which is, and I cannot stress this enough, a security assessment and troubleshooting toolkit for the IPv6 protocols. iconic behavior, honestly. 👑

now, udp6 has two modes of operation: active and listening.

• in active mode, the tool attacks a specific target 🎯
• in listening mode, the tool just chills listening to UDP traffic on the local network, and then launches an attack in response to that traffic 👀

you get active mode if you specify an IPv6 Destination Address. you get listening mode if you set the -L option (or its long counterpart --listen). and if you're messy and specify both an attack target and the -L option? then the attack launches against the specified target first, and then the tool slides into listening mode to respond to incoming packets with UDP datagrams. multitasking queen. 💅

---

also, udp6 supports filtering of incoming packets based on:

• the Ethernet Source Address
• the Ethernet Destination Address
• the IPv6 Source Address
• the IPv6 Destination Address

there are two flavors of filters: "block filters" and "accept filters". 🚦

• if any "block filter" is specified and the incoming packet matches any of those filters, the message is discarded (so like... no UDP datagrams get sent in response, bye 👋)
• if any "accept filter" is specified, incoming packets must match the specified filters in order for the tool to respond with UDP datagrams (gatekeeping, but make it networking)

🎀 OPTIONS 🎀

udp6 takes itS parameters as command-line options. and yes, every single option can be written two ways, your choice bestie:

• a short name — one character preceded by the hyphen character, like -i
• a long name — a string preceded by two hyphen characters, like --interface

if the tool is told to, say, flood the victim with UDP datagrams from different sources (that's the --flood-sources option, more on her later), then multiple packets may need to be generated. the math is mathing, bestie. ✨

udp6 also supports IPv6 Extension Headers, including the IPv6 Fragmentation Header — which might be useful to circumvent layer-2 filtering and/or Network Intrusion Detection Systems (NIDS). BUT, and this is the important part: IPv6 extension headers are not employed by default, and they have to be explicitly enabled with the corresponding options. no sneaky surprises, you opt in. 🫶

---

• -i INTERFACE, --interface INTERFACE — this one picks the network interface the tool is gonna use. and listen, this interface must be specified. the tool does not pick any network interface "by default". you have to tell her. no main character guessing games here. 💁‍♀️
• -S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR — sets the link-layer Source Address of the probe packets. if you leave it unspecified, the link-layer Source Address of the packets gets set to the real link-layer address of the network interface. Note: this option is meaningful only when the underlying link-layer technology is Ethernet. 🧚
• -D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR — sets the link-layer Destination Address of the probe packets. by default, the link-layer Destination Address is automatically set to the link-layer address of the destination host (for on-link destinations) or to the link-layer address of the first-hop router. Note: this option is meaningful only when the underlying link-layer technology is Ethernet. 🌈
• -s SRC_ADDR[/LEN], --src-address SRC_ADDR[/LEN] — this specifies the IPv6 source address (or IPv6 prefix) used as the Source Address of the attack packets. if you pass the LEN parameter, the tool will employ a randomized Source Address for the packets. and if the -F (--flood-sources) option is specified, a random address gets selected for each packet. peep the description of the -F option for more on how -s is processed in that specific case. 👀

Note: when operating in "listening" mode, the Source Address is automatically set to the Destination Address of the incoming packet. cute little handoff. 🔄

• -d DST_ADDR, --dst-address DST_ADDR — specifies the IPv6 Destination Address of the victim. you can only leave this unspecified if the -L option is selected (i.e., if the tool is operating in "listening" mode).

Note: when operating in "listening" mode, the Destination Address is automatically set to the Source Address of the incoming packet. 💫

• -A HOP_LIMIT, --hop-limit HOP_LIMIT — specifies the Hop Limit used for the IPv6 packets. it defaults to 255. 🎯
• -u HDR_SIZE, --dst-opt-hdr HDR_SIZE — says a Destination Options header is to be included in the outgoing packet(s). the extension header size must be specified as an argument to this option (the header gets filled with padding options). and you can stack multiple Destination Options headers by using multiple -u options. the more the merrier. 💅
• -U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE — specifies a Destination Options header to be included in the "unfragmentable part" of the outgoing packet(s). the header size must be specified as an argument to this option (again, filled with padding options). multiple Destination Options headers may be specified via multiple -U options. 🌸
• -H HDR_SIZE, --hbh-opt-hdr HDR_SIZE — says a Hop-by-Hop Options header is to be included in the outgoing packet(s). the header size must be specified as an argument to this option (you already know — filled with padding options). multiple Hop-by-Hop Options headers may be specified by means of multiple -H options. 🔥
• -y FRAG_SIZE, --frag-hdr FRAG_SIZE — specifies that the resulting packet must be fragmented. the fragment size must be specified as an argument to this option. shattering, but on purpose. 💀
• -P PAYLOAD_SIZE, --payload-size PAYLOAD_SIZE — specifies the size of the UDP payload. it defaults to 0 (i.e., empty UDP datagrams — she's a minimalist). 🍓
• -o SRC_PORT[/LEN], --src-port SRC_PORT[/LEN] — specifies the UDP Source Port. if the LEN parameter is specified, the Source Port number will be randomized using the corresponding LEN as a mask (in a similar way to the specification of source addresses). and if the --flood-ports option is specified, the source port is randomized for each packet. otherwise, all packets will employ the same randomized port. consistent, but still unpredictable. ✨
• -a DST_PORT[/LEN], --dst-port DST_PORT[/LEN] — specifies the UDP Destination Port. if the LEN parameter is specified, the Destination Port number will be randomized using the corresponding LEN as a mask (in a similar way to the specification of source addresses). 🎀
• -Z DATA, --data DATA — used to specify the UDP payload. it'll typically include an application-layer request. Note: the string used for the DATA parameter can contain the \r and \n C-style escape sequences for representing "carriage return" and "line feed" (respectively).

as an example, this option could be employed to send an HTTP request if set as --data "GET / HTTP/1.0\r\n\r\n". 💻

• -j SRC_ADDR, --block-src SRC_ADDR — sets a block filter for the incoming packets, based on their IPv6 Source Address. it lets you specify an IPv6 prefix in the form -j prefix/prefixlen. if the prefix length is not specified, a prefix length of /128 is selected (i.e., the option assumes you gave a single IPv6 address, not an IPv6 prefix). 🚫
• -k DST_ADDR, --block-dst DST_ADDR — sets a block filter for the incoming packets, based on their IPv6 Destination Address. it lets you specify an IPv6 prefix in the form -k prefix/prefixlen. if the prefix length is not specified, a prefix length of /128 is selected (i.e., it assumes you meant a single IPv6 address, not an IPv6 prefix). 🚫
• -J LINK_ADDR, --block-link-src LINK_ADDR — sets a block filter for the incoming packets, based on their link-layer Source Address. the option must be followed by a link-layer address (currently, only Ethernet is supported). 🚫
• -K LINK_ADDR, --block-link-dst LINK_ADDR — sets a block filter for the incoming packets, based on their link-layer Destination Address. the option must be followed by a link-layer address (currently, only Ethernet is supported). 🚫
• -b SRC_ADDR, --accept-src SRC_ADDR — sets an accept filter for the incoming packets, based on their IPv6 Source Address. it allows specification of an IPv6 prefix in the form -b prefix/prefixlen. if the prefix length is not specified, a prefix length of /128 is selected (i.e., the option assumes that a single IPv6 address, rather than an IPv6 prefix, has been specified). ✅
• -g DST_ADDR, --accept-dst DST_ADDR — sets an accept filter for the incoming packets, based on their IPv6 Destination Address. it allows specification of an IPv6 prefix in the form -g prefix/prefixlen. if the prefix length is not specified, a prefix length of /128 is selected (i.e., the option assumes that a single IPv6 address, rather than an IPv6 prefix, has been specified). ✅
• -B LINK_ADDR, --accept-link-src LINK_ADDR — sets an accept filter for the incoming packets, based on their link-layer Source Address. the option must be followed by a link-layer address (currently, only Ethernet is supported). ✅
• -G LINK_ADDR, --accept-link-dst LINK_ADDR — sets an accept filter for the incoming packets, based on their link-layer Destination Address. the option must be followed by a link-layer address (currently, only Ethernet is supported). ✅
• -F N_SOURCES, --flood-sources N_SOURCES
• -F number — okay so this one tells the tool to send multiple UDP datagrams with different Source Addresses. The number of different source addresses is specified as -F number. The Source Address of each UDP datagram is randomly selected from the prefix specified by the -s option. If the -F option is specified but the -s option is left unspecified, the Source Address of the packets is randomly selected from the prefix ::/0. So yeah, random vibes. 🎲
• -T N_PORTS, --flood-ports N_PORTS — this option instructs the tool to send multiple UDP datagrams with different Source Ports. The Source Port of each UDP datagram is randomly selected from the whole port number space (0-65535). That's a lot of ports, bestie. 🌊
• -l, --loop — this option instructs the udp6 tool to send periodic UDP datagrams to the victim node. The amount of time to pause between sending UDP datagrams can be specified by means of the -z option, and defaults to 1 second. Note that this option cannot be set in conjunction with the -L (--listen) option. So don't mix them, fr. 🔁
• -z, --sleep — this option specifies the amount of time to pause between sending UDP datagrams (when the --loop option is set). If left unspecified, it defaults to 1 second. Nap time, but make it network packets. 😴
• -r RATE, --rate-limit RATE — this option specifies the rate limit to use when performing a remote address scan. RATE should be specified as xbps or xpps (with x being an unsigned integer), for rate-limits in bits per second or packets per second, respectively. So like 1000pps or 500bps, you got this. ⏱️
• -L, --listen — this instructs the udp6 tool to operate in listening mode (possibly after attacking a given node). Note that this option cannot be used in conjunction with the -l (--loop) option. So pick your fighter, bestie. 👂
• -p PROBE_MODE, --probe-mode PROBE_MODE — this option instructs the tool to operate in probe mode. The specific probe mode is specified as an argument to this option (currently, only script mode is supported). In probe mode, the udp6 sends probe datagrams, and waits for response packets. The response packets are decoded based on the selected probe mode.

In the script probe mode, the tool decodes UDP datagrams as follows:

RESPONSE:RESPONSE_TYPE:RESPONSE_DECODE...

Where the string RESPONSE is fixed, and RESPONSE_TYPE indicates the response received. As of this version of the tool, the following RESPONSE_TYPE values are supported:

• UDP6: Indicates that the tool received a UDP/IPv6 packet
• TIMEOUT: Indicates that the tool received no response

Possible output lines of the tool are:

RESPONSE:TIMEOUT:
RESPONSE:UDP6:

Note: Future versions of the tool will also decode ICMPv6 error messages, and will include additional data regarding the incoming UDP datagrams (e.g., payload size). So stay tuned, I guess? 👀

• -v, --verbose — this option instructs the udp6 tool to be verbose. When the option is set twice, the tool is "very verbose", and the tool also informs which packets have been accepted or discarded as a result of applying the specified filters. Spill the tea, tool. 🗣️
• -h, --help — Print help information for the udp6 tool. You love to see it. 🙌

---

✨ EXAMPLES ✨

okay so here are some iconic use cases of the udp6 tool, bestie. Let's get into it.

Example #1

# udp6 -s fc00:1::/64 -d fc00:1::1 -a 22 -F 100 -l -z 1 -v

In this example the udp6 tool is essentially employed to flood port number 22 of the host fc00:1::1. The tool sends UDP datagrams from the prefix fc00:1::/64 (as specified by the -s option) to port 22 (specified by the -a option) at the destination address fc00:1::1 (specified by the -d option). The tool sends UDP datagrams from 100 different addresses (as specified by the -F option) every one second (as specified by the -l and -z options). The tool will be verbose (as specified by the -v option). Slay. 💅

Example #3

# udp6 -d fc00:1::1 -a 80 -l -r 1pps -v --data "GET / HTTP/1.0\r\n\r\n"

Flood the target system (fc00:1::1) with UDP datagrams at a rate of one packet per second. Each UDP datagram will contain (in the payload) the string specified via the --data option. So it's like a little HTTP request in every packet. Cute. 🍓

Example #4

# udp6 -i eth0 -d fc00:1::1 -a 80 -L -s fc00:1::/112 -l -r 1000pps
--udp-flags auto -v --data "GET / HTTP/1.0\r\n\r\n" --flood-ports 10
--window-mode close

Flood the target node (fc00:1::1) with UDP connections (on port 80). On each connection that is established, an HTTP request is sent, and the UDP window is immediately closed. For each forged IPv6 source address ten different UDP source ports are randomized. The bandwidth of the attack is limited to 1000 pps. That's a lot of chaos, no cap. 🔥

Example #5

# udp6 -d fc00:1::1 -a 80 --udp-flags A --dst-opt-hdr 8 --payload-size
50 --probe-mode script

Send a probe UDP datagram to UDP port 80 at fc00:1::1. The probe packet consists of an IPv6 packet with a Destination Options header of 8 bytes, and an IPv6 payload consisting of a UDP datagram with the ACK bit set, and 50 data bytes. The probe mode is script. Detective mode activated. 🕵️‍♀️

---

👑 AUTHOR 👑

The udp6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <https://www.si6networks.com>. Iconic.

---

💖 COPYRIGHT 💖

Copyright (c) 2011-2020 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>. So you can share the love, legally. 📜

---

And that's the whole page, bestie! The footer says UDP6(1) — that's the manual section, and the source/version and date are whatever the original footer had. We're not copying the line, but you know the vibe. Stay iconic, stay curious, and keep slaying those packets. Bye! 💅✨🫶