Most IPv6 breach paths start with a packet your IPv4 playbooks treat as harmless: a Router Advertisement. Teams spend cycles on dual-stack ACLs and address reputation while the segment’s default gateway remains rewriteable by anyone who can speak Neighbor Discovery on the wire.
That gap stays open because IPv6 was rolled out as connectivity insurance. Security stacks inherited IPv4 muscle memory: block scanners, patch the edge, trust the LAN. Neighbor Discovery is the IPv6 control plane. When it is unauthenticated and unfiltered, an on-path actor owns routing for every host that accepted the advertisement.
Where the assumption breaks
Administrators often say the environment “does not use IPv6,” then leave SLAAC, ICMPv6, and link-local traffic enabled on servers, laptops, and management VLANs. Windows, macOS, and major Linux distributions prefer IPv6 when a usable RA appears. A single rogue advertisement can redirect outbound sessions through an attacker gateway while IPv4 monitoring still looks clean.
Patch weeks make this worse. When Microsoft ships hundreds of fixes in a cycle, or when a maximum-severity GitLab flaw lands in supply-chain reviews, teams race IPv4-facing appliances and leave IPv6 neighbor and hop-limit handling untouched. Watering-hole campaigns that push kits such as ScanBox already prefer quiet on-path collection. A compromised RA turns that preference into local reach: credential forms, clipboard proxies, and session cookies traverse a gateway the SOC never listed as infrastructure.
What actually goes wrong on real segments
On an access VLAN, an infected laptop or a rogue device sends RAs with a preferential lifetime and a lower router preference. Hosts install the new default route. DNS options embedded in RAs (RDNSS) replace resolver settings without touching DHCP logs your team watches. Lateral movement then rides link-local addresses that never touch your perimeter firewall.
In data centers, incomplete ICMPv6 filtering breaks Path MTU Discovery and forces fragmentation behavior security appliances handle poorly. Over-blocking “all ICMPv6” creates black holes; under-blocking leaves Packet Too Big, Neighbor Solicitation, and Router Solicitation mixed with attack traffic you cannot separate in SIEM. Extortion and credential-theft crews already rent ordinary cloud numbers for IPv4. On IPv6 they reuse the same pattern: short-lived addresses, clean ASN labels, and control-plane abuse inside your L2 domain.
A practical control-plane playbook
1. Inventory who may advertise a router
List every legitimate RA source: edge routers, distribution switches with HSRP/VRRP-IPv6, and any SDN controllers that emit advertisements. Treat that list like an allowlist for BGP peers. Anything else sending RAs on user or server VLANs is an incident, not a misconfiguration ticket.
2. Enforce RA Guard and DHCPv6 Guard at the access edge
Enable RA Guard (or equivalent port ACLs) so only trusted uplink ports forward Router Advertisements. Pair with DHCPv6 Guard where managed addressing is in use. Validate vendor behavior: some implementations inspect only the first fragment or skip hop-by-hop options. Test with crafted RAs from a lab host and confirm the frame is dropped before hosts install routes.
3. Build an ICMPv6 allowlist, not a blanket deny
Permit the minimum set your stack needs:
- Neighbor Solicitation and Neighbor Advertisement for address resolution
- Router Solicitation toward trusted routers; Router Advertisement only from those routers
- Packet Too Big and Echo Request/Reply where operationally required, rate-limited
- Destination Unreachable where applications depend on it, scoped carefully
Log and alert on unexpected ICMPv6 types and on RAs from non-uplink ports. Feed those events into the same hunt queue you use for edge management probes during patch weeks.
4. Prefer managed addressing where you need accountability
SLAAC is convenient; DHCPv6 or stable addressing with documented bindings supports forensics. Where privacy addresses are required for clients, retain correlation keys (DUID, IAID, switch port, 802.1X identity) so one session does not dissolve across your log pipeline. Keep ND cache and binding tables exported on a fixed interval for IR.
5. Close transition and tunnel leftovers
Disable Teredo, 6to4, ISATAP, and unused tunnel interfaces on endpoints and servers unless a named use case exists. Unintended tunnels punch IPv6 paths past IPv4-centric filters and recreate the “we do not use IPv6” blind spot under a different name.
6. Extend patch and exposure reviews to the IPv6 listener
When advisory-driven hunts fire (GitLab, VPN appliances, hypervisor consoles), verify the same service is reachable on AAAA records and on link-local or ULA paths from adjacent segments. Customer-data theft cases such as utility and student-loan breaches often start with an exposed management or app plane. Dual-stack means two listeners, one CVE.
Detection signals worth wiring today
- RA from a MAC or port outside the trusted router set
- Sudden default-router or RDNSS change on endpoints (EDR or host firewall telemetry)
- Spike in Neighbor Solicitation failures or duplicate address detection conflicts on a VLAN
- Outbound flows whose next hop is a host previously seen as a client, not a gateway
- AAAA resolutions to internal apps from segments that should be IPv4-only by policy
Tie those alerts to identity: which 802.1X user or device sat on the port that emitted the RA. Username-across-IP correlation still applies; on IPv6 the pivot is often the L2 port and ND binding, not a long-lived global address.
Implementation checklist for the next change window
- Document trusted RA sources per VLAN and encode them in switch policy
- Turn on RA Guard / DHCPv6 Guard and prove drops with a controlled test
- Replace “deny ICMPv6 any any” with a typed allowlist plus rate limits
- Disable unused transition interfaces via configuration baseline and CIS-style checks
- Add AAAA and ND-binding queries to every CVE-driven exposure review
- Export ND caches and RA anomalies into SIEM with retention matching your IPv4 edge hunts
What “done” looks like
You can name every device allowed to advertise a route on each segment. A lab RA from an access port produces a high-severity alert and never becomes a host default gateway. ICMPv6 is visible enough for PMTUD and ND, constrained enough that unexpected types stand out. Patch and breach response run the same checks on IPv6 listeners that they already run on IPv4.
Treat Neighbor Discovery as privileged infrastructure traffic. Once that standard sticks, IPv6 stops being an invisible bypass and becomes another control plane you can actually defend.
