Friday morning, your ISAC digest flags marketplace listings for access to Chinese surveillance cameras, and ISC Stormcast notes fresh PHP exploit chatter. An hour later, a switch on your building-ops VLAN reports neighbor-cache saturation: dozens of new IPv6 link-local entries, repeated Neighbor Solicitation floods, and a handful of hosts suddenly advertising themselves as routers. The camera subnet still looks quiet on IPv4. On IPv6, someone already walks the wire.
That pattern is the IPv6 problem most dual-stack shops still under-instrument. Attackers who buy camera shells, ride abandoned-app RCEs such as the Popcorn Time exposure, or land through unpatched PHP stacks often find IPv4 egress locked down and IPv6 left half-monitored. Neighbor Discovery then becomes the lateral channel: remap default routes, poison neighbor caches, and reach management planes that your IPv4 ACL never sees.
Why NDP sits in the middle of real incidents
IPv6 replaces ARP with Neighbor Discovery Protocol (NDP). On-link hosts resolve addresses with Neighbor Solicitation and Neighbor Advertisement. Routers announce prefixes and default gateways with Router Advertisement (RA). Prefix delegation and SLAAC do the rest. None of that requires a DHCP lease you already log.
In a dual-stack IoT VLAN, that means:
- A compromised camera can claim a second default router and pull traffic through an attacker-controlled appliance on the same L2 segment.
- Link-local addresses (fe80::/10) talk freely even when global unicast ACLs look strict.
- Privacy addresses rotate, so an IPv4 blocklist hit rarely maps 1:1 to the IPv6 peer you need to quarantine.
- Extension-header and ICMPv6 filtering gaps let control traffic survive while your IPv4 deny list stays green.
When underground sellers move camera access in bulk, buyers probe for dual-stack reachability. Your east-west risk starts at NDP, not at the first HTTPS beacon.
Detection steps that survive address rotation
1. Baseline neighbor-cache size and churn per VLAN
Pull neighbor-table counts from switches and hosts on a fixed interval (five to fifteen minutes). Store VLAN ID, interface, entry count, and rate of inserts/deletes. Alert when churn exceeds your quiet-hour baseline by a factor you set from a week of clean data. Camera and badge-reader VLANs usually show low, steady churn; sudden spikes after an advisory day deserve a ticket.
2. Flag hosts that emit Router Advertisements
Only known routers should send RA. Enable RA Guard on access ports and still log violations upstream. Any non-router MAC sourcing ICMPv6 type 134 is containment-grade evidence. Pair that with DHCPv6 server messages from unexpected MACs so rogue address assignment shows up in the same queue.
3. Join NDP anomalies to asset and exploit context
When PHP wrap-ups or consumer-app RCE notices hit, tag dual-stack subnets that host those stacks. Prefer joins on switch port, MAC, and certificate subject over fragile IP-only keys. If a camera MAC that appeared in a marketplace listing timeline also spikes Neighbor Solicitations toward your jump-host VLAN, escalate even if reputation feeds still rate the global address as clean.
4. Watch for IPv6-only listeners on management ports
Scan or inventory for services bound to :: or link-local only: Winbox-style appliance UIs, RTSP, ONVIF, SSH, and vendor agent ports. Compare against your IPv4 listening set. A service that exists solely on IPv6 is an escape hatch during IPv4-focused isolation drills.
5. Keep temporary addresses in the hunt, with tenure scoring
Privacy extensions change the global interface ID. Retain ND cache history long enough to stitch MAC → temporary address → auth or C2 event. Score short-tenure prefixes and brand-new /64s higher during exploit-scout weeks. Dropping temporary addresses from queries blinds you to the exact window marketplace buyers use after purchase.
Response actions that close the dual-stack gap
Contain on L2 and ND first
When neighbor-cache thrash and rogue RA coincide with IoT or PHP exposure news, quarantine by switch port and MAC before you argue about which global address to block. Disable the offending port or move it to a sinkhole VLAN that still captures packets. Re-enable RA Guard and IP Source Guard / IPv6 ND inspection where the platform supports it.
Force dual-stack parity on the same change ticket
Every IPv4 ACL, geo cap, and rate limit you apply to camera or admin ingress needs an IPv6 twin in the same window. Include:
- Ingress filters for management subnets on both families
- Egress allowlists that send IPv6 callbacks through the same security stack as IPv4
- Explicit denies for unexpected tunnel encapsulations (6in4, 6to4, Teredo) at the edge unless a named business case exists
Rebuild trust for on-link discovery
After containment, flush poisoned neighbor caches on routers and critical hosts. Verify the legitimate router’s MAC and link-local address against your source of truth. Capture a packet sample of RA/NS/NA for the incident folder so peer ISACs receive usable L2 indicators, not only global unicast IOCs.
Extend the hunt beyond the camera VLAN
Sold camera access often funds broader campaigns: credential stuffing against admin portals, PHP webshell drops on shared hosting ASNs, and boot-persistence tooling that survives reimage. Use the MAC and timing from the NDP event to search identity logs, RMM sessions, and appliance shell evidence within one hour. BlackX-style bootkits and similar persistence make “rebooted clean” a weak closure criterion; confirm Secure Boot state and firmware measurements on any dual-stack jump host that sat on the same broadcast domain.
Implementation details you can ship this week
- Switch telemetry: Export ND table size, RA Guard drops, and IPv6 ACL hit counters to your SIEM with VLAN and port tags.
- Host sensors: On Linux jump boxes, alert on unexpected changes to ip -6 neigh and on default-route updates from RA. On Windows, monitor IPv6 neighbor and route change events for the same.
- Policy objects: Maintain a single object group per zone with both A and AAAA members so dual-stack services cannot drift.
- Tabletop inject: Add a dual-stack IoT pivot: IPv4 isolation succeeds, rogue RA continues. Score the exercise on whether NDP controls sit in the containment checklist.
- Vendor asks: For camera and badge vendors, require documented IPv6 hardening (RA Guard compatibility, disable unused IPv6 services, signed firmware) in procurement language.
Practical takeaways
- Treat neighbor-cache churn and rogue RA as lateral-movement signals on dual-stack IoT and appliance VLANs, especially when camera-access markets or PHP/RCE advisories are active.
- Contain by port and MAC, then restore ND trust, then align IPv6 ACLs with the IPv4 controls you already trust.
- Keep temporary IPv6 addresses and link-local activity inside hunt queries, keyed by MAC and tenure.
- Inventory IPv6-only listeners on management ports before the next isolation drill claims success.
- Ship partial L2 indicators (MAC, VLAN, RA fingerprint) upstream while global attribution is still thin.
IPv6 security for operators is less about memorizing header layouts and more about instrumenting discovery the way you already instrument ARP and DHCP. When marketplace camera access and exploit wrap-ups land on the same shift, the team that already baselines neighbor-cache behavior will quarantine the east-west move while everyone else is still grepping IPv4 deny hits.
