Categories: dos, intrusive
Generates a flood of Router Advertisements (RA) with random source MAC addresses and IPv6 prefixes. Computers, which have stateless autoconfiguration enabled by default (every major OS), will start to compute IPv6 suffix and update their routing table to reflect the accepted announcement. This will cause 100% CPU usage on Windows and platforms, preventing to process other application requests.
- All Cisco IOS ASA with firmware < November 2010
- All Netscreen versions supporting IPv6
- Windows 2000/XP/2003/Vista/7/2008/8/2012
- All FreeBSD versions
- All NetBSD versions
- All Solaris/Illumos versions
Security advisory: http://www.mh-sec.de/downloads/mh-RA_flooding_CVE-2010-multiple.txt
WARNING: This script is dangerous and is very likely to bring down a server or network appliance. It should not be run in a production environment unless you (and, more importantly, the business) understand the risks!
Additional documents: https://tools.ietf.org/rfc/rfc6104.txt
defines interface we should broadcast on
runs the script until the timeout is reached (default: 30s). If timeout is zero, the script will run forever.
nmap -6 --script ipv6-ra-flood.nse nmap -6 --script ipv6-ra-flood.nse --script-args 'interface=<interface>' nmap -6 --script ipv6-ra-flood.nse --script-args 'interface=<interface>,timeout=10s'
License: Same as Nmap--See https://nmap.org/book/man-legal.html