udp6(1)
NAME
udp6 - A security assessment tool for UDP/IPv6 implementations
SYNOPSIS
udp6 -i INTERFACE [-S LINK_SRC_ADDR] [-D LINK-DST-ADDR] [-s SRC_ADDR[/LEN]] [-d DST_ADDR] [-A HOP_LIMIT] [-y FRAG_SIZE] [-u DST_OPT_HDR_SIZE] [-U DST_OPT_U_HDR_SIZE] [-H HBH_OPT_HDR_SIZE] [-P PAYLOAD_SIZE] [-o SRC_PORT] [-a DST_PORT] [-Z DATA] [-j PREFIX[/LEN]] [-k PREFIX[/LEN]] [-J LINK_ADDR] [-K LINK_ADDR] [-b PREFIX[/LEN]] [-g PREFIX[/LEN]] [-B LINK_ADDR] [-G LINK_ADDR] [-F N_SOURCES] [-T N_PORTS] [-L] [-l] [-p PROBE_MODE] [-z SECONDS] [-r RATE] [-v] [-h]
DESCRIPTION
udp6 allows the assessment of IPv6 implementations with respect to a variety of attack vectors based on UDP/IPv6 datagrams. This tool is part of the SI6 Networks' IPv6 Toolkit: a security assessment and troubleshooting toolkit for the IPv6 protocols. udp6 tool has two modes of operation: active and listening. In active mode, the tool attacks a specific target, while in listening mode the tool listens to UDP traffic on the local network, and launches an attack in response to such traffic. Active mode is employed if an IPv6 Destination Address is specified. Listening mode is employed if the "-L" option (or its long counterpart "--listen") is set. If both an attack target and the "-L" option are specified, the attack is launched against the specified target, and then the tool enters listening mode to respond incoming packets with UDP datagrams. udp6 supports filtering of incoming packets based on the Ethernet Source Address, the Ethernet Destination Address, the IPv6 Source Address, and the IPv6 Destination Address. There are two types of filters: "block filters" and "accept filters". If any "block filter" is specified, and the incoming packet matches any of those filters, the message is discarded (and thus no UDP datagrams are sent in response). If any "accept filter" is specified, incoming packets must match the specified filters in order for the tool to respond with UDP datagrams.
OPTIONS
udp6 takes itS parameters as command-line options. Each of the options
can be specified with a short name (one character preceded with the
hyphen character, as e.g. "-i") or with a long name (a string preceded
with two hyphen characters, as e.g. "--interface").
If the tool is instructed to e.g. flood the victim with UDP datagrams
from different sources ("--flood-sources" option), multiple packets may
need to be generated.
udp6 supports IPv6 Extension Headers, including the IPv6 Fragmentation
Header, which might be of use to circumvent layer-2 filtering and/or
Network Intrusion Detection Systems (NIDS). However, IPv6 extension
headers are not employed by default, and must be explicitly enabled
with the corresponding options.
-i INTERFACE, --interface INTERFACE
This option specifies the network interface that the tool will
use. The network interface must be specified (i.e., the tool
does not select any network interface "by default").
-S SRC_LINK_ADDR, --src-link-address SRC_LINK_ADDR
This option specifies the link-layer Source Address of the probe
packets. If left unspecified, the link-layer Source Address of
the packets is set to the real link-layer address of the network
interface. Note: this option is meaningful only when the
underlying link-layer technology is Ethernet.
-D DST_LINK_ADDR, --dst-link-address DST_LINK_ADDR
This option specifies the link-layer Destination Address of the
probe packets. By default, the link-layer Destination Address is
automatically set to the link-layer address of the destination
host (for on-link destinations) or to the link-layer address of
the first-hop router. Note: this option is meaningful only when
the underlying link-layer technology is Ethernet.
-s SRC_ADDR, --src-address SRC_ADDR
This option specifies the IPv6 source address (or IPv6 prefix)
to be used for the Source Address of the attack packets. If the
"-F" ("--flood-sources") option is specified, this option
includes an IPv6 prefix, from which random addresses are
selected. See the description of the "-F" option for further
information on how the "-s" option is processed in that specific
case.
Note: When operating in "listening" mode, the Source Address is
automatically set to the Destination Address of the incoming
packet.
-d DST_ADDR, --dst-address DST_ADDR
This option specifies the IPv6 Destination Address of the
victim. It can be left unspecified only if the "-L" option is
selected (i.e., if the tool is to operate in "listening" mode).
Note: When operating in "listening" mode, the Destination
Address is automatically set to the Source Address of the
incoming packet.
-A HOP_LIMIT, --hop-limit HOP_LIMIT
This option specifies the Hop Limit to be used for the IPv6
packets. It defaults to 255.
-u HDR_SIZE, --dst-opt-hdr HDR_SIZE
This option specifies that a Destination Options header is to be
included in the outgoing packet(s). The extension header size
must be specified as an argument to this option (the header is
filled with padding options). Multiple Destination Options
headers may be specified by means of multiple "-u" options.
-U HDR_SIZE, --dst-opt-u-hdr HDR_SIZE
This option specifies a Destination Options header to be
included in the "unfragmentable part" of the outgoing packet(s).
The header size must be specified as an argument to this option
(the header is filled with padding options). Multiple
Destination Options headers may be specified by means of
multiple "-U" options.
-H HDR_SIZE, --hbh-opt-hdr HDR_SIZE
This option specifies that a Hop-by-Hop Options header is to be
included in the outgoing packet(s). The header size must be
specified as an argument to this option (the header is filled
with padding options). Multiple Hop-by-Hop Options headers may
be specified by means of multiple "-H" options.
-y FRAG_SIZE, --frag-hdr FRAG_SIZE
This option specifies that the resulting packet must be
fragmented. The fragment size must be specified as an argument
to this option.
-P PAYLOAD_SIZE, --payload-size PAYLOAD_SIZE
This options specifies the size of the UDP payload. It defaults
to 0 (i.e., empty UDP datagrams).
-o SRC_PORT, --src-port SRC_PORT
This option specifies the UDP Source Port.
-a DST_PORT, --dst-port DST_PORT
This option specifies the UDP Destination Port.
-Z DATA, --data DATA
This option is used to specify the UDP payload. It will
typically include an application-layer request. Note: the string
used for the DATA parameter can contain the "\r" and "\n"
C-style escape senquenced for representing "carriage return" and
"line feed" (respectively).
As an example, this option could be employed to send an HTTP
request if set as '--data "GET / HTTP/1.0\r\n\r\n"'.
-j SRC_ADDR, --block-src SRC_ADDR
This option sets a block filter for the incoming packets, based
on their IPv6 Source Address. It allows the specification of an
IPv6 prefix in the form "-j prefix/prefixlen". If the prefix
length is not specified, a prefix length of "/128" is selected
(i.e., the option assumes that a single IPv6 address, rather
than an IPv6 prefix, has been specified).
-k DST_ADDR, --block-dst DST_ADDR
This option sets a block filter for the incoming packets, based
on their IPv6 Destination Address. It allows the specification
of an IPv6 prefix in the form "-k prefix/prefixlen". If the
prefix length is not specified, a prefix length of "/128" is
selected (i.e., the option assumes that a single IPv6 address,
rather than an IPv6 prefix, has been specified).
-J LINK_ADDR, --block-link-src LINK_ADDR
This option sets a block filter for the incoming packets, based
on their link-layer Source Address. The option must be followed
by a link-layer address (currently, only Ethernet is supported).
-K LINK_ADDR, --block-link-dst LINK_ADDR
This option sets a block filter for the incoming packets, based
on their link-layer Destination Address. The option must be
followed by a link-layer address (currently, only Ethernet is
supported).
-b SRC_ADDR, --accept-src SRC_ADDR
This option sets an accept filter for the incoming packets,
based on their IPv6 Source Address. It allows the specification
of an IPv6 prefix in the form "-b prefix/prefixlen". If the
prefix length is not specified, a prefix length of "/128" is
selected (i.e., the option assumes that a single IPv6 address,
rather than an IPv6 prefix, has been specified).
-g DST_ADDR, --accept-dst DST_ADDR
This option sets a accept filter for the incoming packets, based
on their IPv6 Destination Address. It allows the specification
of an IPv6 prefix in the form "-g prefix/prefixlen". If the
prefix length is not specified, a prefix length of "/128" is
selected (i.e., the option assumes that a single IPv6 address,
rather than an IPv6 prefix, has been specified).
-B LINK_ADDR, --accept-link-src LINK_ADDR
This option sets an accept filter for the incoming packets,
based on their link-layer Source Address. The option must be
followed by a link-layer address (currently, only Ethernet is
supported).
-G LINK_ADDR, --accept-link-dst LINK_ADDR
This option sets an accept filter for the incoming packets,
based on their link-layer Destination Address. The option must
be followed by a link-layer address (currently, only Ethernet is
supported).
-F N_SOURCES, --flood-sources N_SOURCES
This option instructs the tool to send multiple UDP datagrams
with different Source Addresses. The number of different source
addresses is specified as "-F number". The Source Address of
each UDP datagram is randomly selected from the prefix specified
by the "-s" option. If the "-F" option is specified but the "-s"
option is left unspecified, the Source Address of the packets is
randomly selected from the prefix ::/0.
-T N_PORTS, --flood-ports N_PORTS
This option instructs the tool to send multiple UDP datagrams
with different Source Ports. The Source Port of each UDP
datagram is randomly selected from the whole port number space
(0-65535).
-l, --loop
This option instructs the udp6 tool to send periodic UDP
datagrams to the victim node. The amount of time to pause
between sending UDP datagrams can be specified by means of the
"-z" option, and defaults to 1 second. Note that this option
cannot be set in conjunction with the "-L" ("--listen") option.
-z, --sleep
This option specifies the amount of time to pause between
sending UDP datagrams (when the "--loop" option is set). If left
unspecified, it defaults to 1 second.
-r RATE, --rate-limit RATE
This option specifies the rate limit to use when performing a
remote address scan. "RATE" should be specified as "xbps" or
"xpps" (with "x" being an unsigned integer), for rate-limits in
bits per second or packets per second, respectively.
-L, --listen
This instructs the udp6 tool to operate in listening mode
(possibly after attacking a given node). Note that this option
cannot be used in conjunction with the "-l" ("--loop") option.
-p PROBE_MODE, --probe-mode PROBE_MODE
This option instructs th too to operate in probe mode. The
specific probe mode is specified as an argument to this option
(currently, only "script" mode is supported). In probe mode, the
udp6 sends probe datagrams, and waits for response packets. The
response packets are decoded based on the selected probe mode.
In the "script" probe mode, the tool decodes UDP datagrams as
follows:
RESPONSE:RESPONSE_TYPE:RESPONSE_DECODE...
Where the string RESPONSE is fixed, and RESPONSE_TYPE indicates
the response received. As of this version of the tool, the
following RESPONSE_TYPE values are supported:
+ UDP6: Indicates that the tool received a UDP/IPv6 packet
+ TIMEOUT: Indicates that the tool received no response
Possibe output lines of the tool are:
RESPONSE:TIMEOUT:
RESPONSE:UDP6:
Note: Future versions of the tool will also decode ICMPv6 error
messages, and will include additional data regarding the
incoming UDP datagrams (e.g., payload size).
-v, --verbose
This option instructs the udp6 tool to be verbose. When the
option is set twice, the tool is "very verbose", and the tool
also informs which packets have been accepted or discarded as a
result of applying the specified filters.
-h, --help
Print help information for the udp6 tool.
EXAMPLES
The following sections illustrate typical use cases of the udp6 tool. Example #1 # udp6 -s fc00:1::/64 -d fc00:1::1 -a 22 -F 100 -l -z 1 -v In this example the udp6 tool is essentially employed to flood port number 22 of the host fc00:1::1. The tool sends UDP datagrams from the prefix fc00:1::/64 (as specified by the "-s" option) to port 22 (specified by the "-a" option) at the destination address fc00:1::1 (specified by the "-d" option). The tool sends UDP datagrams from 100 different addresses (as specified by the "-F" option) every one second (as specified by the "-l" and "-z" options). The tool will be verbose (as specified by the "-v" option). Example #3 # udp6 -d fc00:1::1 -a 80 -l -r 1pps -v --data "GET / HTTP/1.0\r\n\r\n" Flood the target system (fc00:1::1) with UDP datagrams at a rate of one packet per second. Each UDP datagram will contain (in the payload) the string specified via the "--data" option. Example #4 # udp6 -i eth0 -d fc00:1::1 -a 80 -L -s fc00:1::/112 -l -r 1000pps --udp-flags auto -v --data "GET / HTTP/1.0\r\n\r\n" --flood-ports 10 --window-mode close Flood the target node (fc00:1::1) with UDP connections (on port 80). On each connection that is established, an HTTP request is sent, and the UDP window is immediately closed. For each forged IPv6 source address ten different UDP source ports are randomized. The bandwidth of the attack is limited to 1000 pps. Example #5 # udp6 -d fc00:1::1 -a 80 --udp-flags A --dst-opt-hdr 8 --payload-size 50 --probe-mode script Send a probe UDP datagram to UDP port 80 at fc00:1::1. The probe packet consists of an IPv6 packet with a Destination Options header of 8 bytes, and an IPv6 payload consisting of a UDP datagram with the ACK bit set, and 50 data bytes. The probe mode is "script".
AUTHOR
The udp6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <http://www.si6networks.com>.
COPYRIGHT
Copyright (c) 2011-2013 Fernando Gont.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A
copy of the license is available at
<http://www.gnu.org/licenses/fdl.html>.
UDP6(1)
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
