mldq6 - Man Page

A security assessment tool for attack vectors based on ICMPv6 MLD Query messages

Synopsis

mldq6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-A HOP_LIMIT] [-y FRAG_SIZE] [-u DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-E LINK_ADDR] [-e] [-m MLD_ADDR] [-r MLD_RESP_DELAY ] [-F N_SOURCES] [-z SECONDS] [-l] [-v] [-h]

Description

mldq6 allows the assessment of IPv6 implementations with respect to a variety of attacks based on ICMPv6 MLD Query messages. This tool is part of the SI6 Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols.

Options

mldq6 takes its parameters as command-line options. Each of the options can be specified with a short name (one character preceded with the hyphen character, as e.g. "-i") or with a long name (a string preceded with two hyphen characters, as e.g. "--interface").

-i INTERFACE, --interface INTERFACE

This option specifies the network interface that the tool will use. If the destination address ("-d" option) is a link-local address, the interface must be explicitly specified. The interface may also be specified along with a destination address, with the "-d" option.

-s SRC_ADDR, --src-address SRC_ADDR

This option is meant to specify the IPv6 Source Address (or IPv6 prefix) to be used for the MLD Query messages. If left unspecified, a randomized link-local unicast (fe80::/64) address is selected.

-d DST_ADDR, --dst-address DST_ADDR

This option specifies the IPv6 Destination Address of the MLD Query messages. If left unspecified the "all-nodes link-local multicast" address (ff02::1) is selected as the IPv6 Destination Address.

-A HOP_LIMIT, --hop-limit HOP_LIMIT

This option specifies the IPv6 Hop Limit to be used for the MLD Query messages. It defaults to 1. Note that IPv6 nodes are required to check that the Hop Limit of incoming MLD Query messages is 1. Therefore, this option is only useful to assess whether an IPv6 implementation fails to enforce the aforementioned check.

-y SIZE, --frag-hdr SIZE

This option specifies that the resulting packet must be fragmented. The fragment size must be specified as an argument to this option.

-u HDR_SIZE, --dst-opt-hdr HDR_SIZE

This option specifies that a Destination Options header is to be included in the resulting packet. The extension header size must be specified as an argument to this option (the header is filled with padding options). Multiple Destination Options headers may be specified by means of multiple "-u" options.

-U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE

This option specifies a Destination Options header to be included in the "unfragmentable part" of the resulting packet. The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Destination Options headers may be specified by means of multiple "-U" options. This option is only valid if the "-y" option is specified (as the concept of "unfragmentable part" only makes sense when fragmentation is employed).

-H HDR_SIZE, --hbh-opt-hdr HDR_SIZE

This option specifies that a Hop-by-Hop Options header is to be included in the resulting packet. The header size must be specified as an argument to this option (the header is filled with padding options). Multiple Hop-by-Hop Options headers may be specified by means of multiple "-H" options. Without this option a MLD standard conforming Hop-by-hop header is added. With "-H 0" no Hop-by-Hop Options header is added, thus creating an invalid MLD Query message). This option can be used to check whether an IPv6 implementations correctly validates the Hop-by-Hop Options header and drops MLD Query messages with an invalid Hop-by-Hop Options header.

-S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR

This option specifies the link-layer Source Address of the MLD Query messages (currently, only Ethernet is supported). If left unspecified, the link-layer Source Address is randomized.

-D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR

This option specifies the link-layer Destination Address of the MLD Query messages (currently, only Ethernet is supported). If left unspecified, the link-layer Destination Address is set to "33:33:00:00:00:01" (the Ethernet address that corresponds to the "all-nodes link-local multicast" address).

--source-lla-opt,  -E

This option specifies the contents of a source link-layer address option to be included in the MLD Query messages. If more than one source link-layer address is specified (by means of multiple "-E" options), and all the resulting options cannot be conveyed into a single MLD Query, multiple MLD Queries will be sent as needed.

--add-slla-opt,  -e

This option instructs the mldq6 tool to include a source link-layer address option in the MLD Query messages that it sends. The link-layer address included in the option is the same as the Ethernet Source Address used for the outgoing MLD Query messages.

-m MLD_ADDR, --mld-addr MLD_ADDR

This option specifies the MLD Multicast Address of the MLD Query messages. If left unspecified the unspecified IPv6 address (::) is selected as the MLD Multicast Address (a General Query). Note that for a valid Multicast-Address-Specific Query MLD_ADDR and the IPv6 destination address should be the same. So if setting a multicast address with "-m", you might also want to use "-d" and "-D".

-r MLD_RESP_DELAY, --mld-resp-delay MLD_RESP_DELAY

This option specifies the MLD Maximum Respones Delay of the MLD Query messages in milliseconds. A multicast listener will reply with its MLD Report with a random delay between zero and the MLD_RESP_DELAY. Defaults to 10000 milliseconds (10 seconds).

--flood-sources,  -F

This option instructs the mldq6 tool to send MLD Queries from multiple (and random) IPv6 Source Addresses. The number of different sources is specified as "-F number". The IPv6 Source Address of each MLD Query is a randomized from the IPv6 prefix specified with the "-s" option, and defaults to a random link-local unicast address (fe80::/64).

--loop,  -l

This option instructs the mldq6 tool to send periodic MLD Queries to the destination node. The amount of time to pause between sending MLD Queries can be specified by means of the "-z" option, and defaults to 120 seconds.

--sleep,  -z

This option instructs the mldq6 tool to the amount of time to pause between sending MLD Query messages. If left unspecified, it defaults to 120 seconds.

--verbose,  -v

This option instructs the mldq6 tool to be verbose.

--help,  -h

Print help information for the mldq6 tool.

Examples

The following sections illustrate typical use cases of the rs6 tool.

Example #1

# mldq6 -i eth0

Use the network interface "eth0" to send a MLD Query using a random link-local unicast IPv6 Source Address and a random Ethernet Source Address, to the IPv6 Destination Address "ff02::1" ("all-nodes link-local multicast" address, selected by default) and the Ethernet Destination Address "33:33:00:00:00:01" (selected by default). Set the MLD Multicast Address to :: (a "General Query", default) and set the MLD Maximum Response Delay to 10 seconds (default).

Example #2

# mldq6 -i eth0 -d ff12::123 -D 33:33:00:00:01:23 -m ff12::123 -r 1000 -F 100 -l -z 5 -v

Send 100 Multicast-Address-Specific MLD Query messages using a random Ethernet Source Address and random IPv6 Source Address for each of them, to the Ethernet Destination Address "33:33:00:00:01:23" and the IPv6 Destination Address "ff12::123". Set the MLD Multicast Address to ff02::123 (a "Multicast-Address-Specific Query") and set the MLD Maximum Response Delay to 1000 milliseconds. Repeat this operation every five seconds. Be verbose.

Multicast Listeners

To create multicast listeners you can check queries send by mldq6 against, you can use socat (>= 1.7.3.2) for instance:

$ socat -u UDP6-RECV:1234,reuseaddr,ipv6-join-group="[ff12::123]:eth0" -

Another option is mcjoin: https://github.com/troglobit/mcjoin

Author

The mldq6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>.