Efficient router fingerprinting in IPv6 networks

A considerable amount of time will be needed before each system in the Internet can convert from Internet Protocol version 4 (IPv4) to Internet Protocol version 6 (IPv6). Three strategies have been proposed by the Internet Engineer Task Force (IETF) to help the transition from IPv4 to IPv6 which are dual stack, header translation and tunneling. Tunneling is used when two computers using IPv6 want to communicate with each other and the packet will travel through a region that uses IPv4. To pass through this region, IPv6 packet must be encapsulated in IPv4 packet to have an IPv4 address in order to make it IPv4 routing compatible. Internet Protocol security (IPsec) in transport mode carries the payload of the encapsulating packet as a plain data without any mean of protection. That is, two nodes using IPsec in transport mode to secure the tunnel can spoof the inner payload; the packet will be de-capsulated successfully and accepted. IETF mentioned this problem in many RFCs. According to RFC 3964 there is no simple way to prevent spoofing attack in IPv6 over IPv4 tunnel and longer term solutions would have to be deployed in both IPv4 and IPv6 networks to help identify the source of the attack, a total prevention is likely impossible. This study proposed a new spoofing defense mechanism based on IPsec’s protocol Encapsulated Security Payload (ESP). ESP’s padding area had been used to write the IPv6 source address of the encapsulated packet. Simulation is conducted based on two scenarios, one with spoofing attack and one without. The outcome proved that proposed mechanism has managed to eliminate spoofing threat in IPv6 over IPv4 tunnel.

Internet Protocol version 6 (IPv6) is the current generation Internet protocol developed by the Internet Engineering Task Force (IETF) to handle the shortage of IP addresses in IPV4. The transition from IPv4 to IPv6 is gradually being done not happening as anticipated. It is unavoidable to have both IPv4 and IPv6 networks during the transition period, but unfortunately they are not compatible in nature. It is essential to maintain the IPv4 and IPv6 coexistence. The inter-communication ability of IPv4 and IPv6 is the dire need of network community. Many transition techniques are proposed in the recent years. This paper discussed the key difficulties in IPv4-IPv6 transition, and introduced the hybrid approach for coexistence of IPv4 and IPv6. It hybrid the advantages of weightage and tunneling translation techniques for providing inter-communication ability of IPv4 and IPv6. The proposed algorithm has been simulated and the performance metrics; transmission latency, throughput, jitter and delay have been analyzed from end to end host, through various scenarios includes IPv4 only, IPv6 Only, Dual stack, GRE tunneling. The performance of the proposed algorithm is analyzed and the future scope is discussed.

Security and privacy have become important issues when dealing with Internet Protocol version 6 (IPv6) networks. On one hand, anonymity, which is related to privacy, makes it hard for current security systems to differentiate between legitimate users and illegitimate users, especially when the users need to be authenticated by those systems whose services they require. On the other hand, a lack of privacy exposes legitimate users to abuse, which can result from the information gained from privacy-related attacks. The current problems inherent within IPv6-enabled networks are due, in part, to the fact that there is no standard available telling companies about the current deficiencies that exist within IPv6 networks. The purpose of this chapter is to show a balance between the use of privacy and security, and to describe a framework that can offer the minimum standard requirement needed for providing security and privacy to IPv6 networks.

The fast growth of the Internet usage has caused problem on Internet protocol address space. To solve this problem, Internet Protocol version 6 (IPv6) was created to expand the availability of address spaces. An important part of the IPv6 suites is the Neighbour Discovery Protocol (NDP), which is geared towards substitution of Address Resolution Protocol in router discovery, and function redirection in Internet Protocol version 4 (IPv4). NDP includes the routing function which is determines which route a data packet will follow to arrive at its intended destination, and the address function which assigns unique addresses to each and every device connected to a network for identification purposes. NDP messages are broadly categorized into five types and each message type carries out distinct tasks, these messages are: Router Solicitation (RS), Neighbour Solicitation (NS), Router Advertisement (RA), Neighbour Advertisement (NA), and Redirect. NDP security vulnerabilities is openness of a network of computer, wherein there exists a lack of trust among users. Typically, huge numbers of NDP messages can be used to flood a network, resulting in disconnecting of the connected devices. Due to the limitations of existing defence mechanisms, NDP are still prone to network-based attacks and these vulnerabilities must be considered while creating an IPv6 network. In this thesis, we present a novel detection method for DDoS and Replayed attacks that are launched using NDP in IPv6. This detection method is a stream-based network representation, instead of packet-based representation. The proposed detection method makes use of Locally Weighted Learning machine learning techniques, with three different algorithms as its based learner Bayesian network, Decision tree and Naïve Bayes. LWL-Bayesian Network model achieved the highest detection rate of 96.48%. LWL-Naïve Bayes model is the next best model, with an accuracy rate of 96.024%, while the LWL-Decision Tree model had the lowest overall detection rate of 93%. Comparatively, all developed IDSs are capable of detecting DDoS and Replayed attacks based on NDP-based network traffic as well as the detection of anomalies. They all demonstrated strong predictive ability, however, the LWL-Bayesian Network model proved to have the best overall performance to develop a locally weighted IDS model among the three models. In short, the development of the detection models, has strong predictive capabilities, with high accuracy rate, does not overfit, has low computational costs, and uses less time for model development and attack detection.

The deployment of Internet Protocol version 6 (IPv6) has raised security concerns among the network administrators. Thus, in strengthening the network security, administrator requires an appropriate method to assess the possible risks that occur in their networks. Aware of the needs to calculate risk in IPv6 network, it is essential to an organization to have an equation that is flexible and consider the requirements of the network. However, the existing risk assessment equations do not consider the requirement of the network. Therefore, this paper presents the adaptation of grounded theory to search for elements that are needed to develop IPv6 risk assessment (IRA6) equation. The attack scenarios’ experiments; UDP Flooding, TCP Flooding and Multicast attacks were carried out in different network environment to show how the IPv6 risk assessment equation being used. The result shows that the IRA6 equation is more flexible to be used regardless the network sizes and easier to calculate the risk value compared to the existing risk assessment equations. Hence, network administrators can have a proper decision making and strategic planning for a robust network security.

The Internet Protocol version 6 (IPv6) brings with it a seemingly endless supply of network addresses. It does not, however, solve many of the vulnerabilities that existed in Internet Protocol version 4 (IPv4). In fact, privacy-related crimes in IPv6 are made easier due to the way IPv6 addresses are formed. We developed a Moving Target IPv6 Defense (MT6D) that leverages the immense address space of IPv6. The two goals of MT6D are maintaining user privacy and protecting against targeted network attacks. These goals are achieved by repeatedly rotating the addresses of both the sender and receiver. Address rotation occurs, regardless of the state of ongoing sessions, to prevent an attacker from discovering the identities of the two communicating hosts. Rotating addresses mid-session prevents an attacker from even determining that the same two hosts are communicating. The continuously changing addresses also force an attacker to repeatedly reacquire the target node before he or she can launch a successful network attack. Our proof of concept demonstrates the feasibility of MT6D and its ability to seamlessly bind new IPv6 addresses. We also demonstrate MT6D's ability to rotate addresses mid-session without dropping or renegotiating sessions. Since MT6D operates at the network layer of the protocol stack, it provides a powerful moving target solution that is both platform and application independent.

Hybridizing flower pollination algorithm with particle swarm optimization for enhancing the performance of IPv6 intrusion detection system

In this article, we present a new method based on the securisation of an IPv6 (Internet Protocol version 6) address obtaining with the SLAAC (Stateless Address Autoconfiguration) method in the domestic network. The particularity of our domestic network is the presence of several Multihoming Internet service providers. The peripherals of the Home Network domain, especially routers are in charge of the relay of auto configuration messages coming from various routers of internet access providers. Our method allows the routers of the Home Network domain to filter the announcements of autoconfigurations called RA (Router Advertisements) according to the IPv6 addresses sources contained in the messages of autoconfiguration. The decision to relay or reject these announcements is based on a trusted table built from the addressing information obtained from the NDP protocol. Our method also aims to optimize the traffic in the Home Network domain by organizing routers to give them specific roles for the relay of information for autoconfiguration.

Even though more customers are regularly coming to the Internet, IPv4 addresses have been reduced by the Internet Assigned Numbers Authority (IANA) and have been deactivated in domain name registries (RIRs). IPv6, being the sole important next-generation Internet protocol, has yet to be fully developed and deployed, owing to the lack of a scheme that might address the transfer of IPv4 resources to IPv6 networks as well as collective communication between the two incompatible protocols. The Transmission Control Protocol/Internet protocol version 4 (TCP/IPv4) addresses have been reported as being on the verge of collapsing, while the next generation Internet Protocol version 6 (IPv6) is being identified on a regular basis. Among other advantages, IPv6 provides a significantly wider address space, better address design, and more security. IPv6 distribution necessitates a thorough and meticulous setup in order to avoid network disturbance and reap the benefits of IPv6. Because of the problems with IPv4, IPv6 is currently becoming increasingly popular among organizations, businesses, and Internet Service Providers (ISP). This paper we will explores the evolution of Internet Protocol version 4 (IPv4), its key features, challenges, and limitations, and examines how Internet Protocol version 6 (IPv6) addresses these issues. Additionally, we will highlight the key differences between the two protocols and discuss the transition process from IPv4 to IPv6.

Explicit Multicast-Unicast (XCAST) is a complementary protocol of multicast that supports a very large number of small multicast sessions by specifies the destinations as the lust of unicast address explicitly. The usage of the IPv6 protocol creates new challenges such as the quality of service (QoS) mechanisms that are currently supported for the Internet Protocol version 6 (IPv6) in most implementations are fewer compared to IPv4 and in addition the whole network's behavior is different. By considering IPv6 role in QoS and review the QoS routing mechanisms using by multicast as well as unicast, this paper tries to investigate a proper model for Xcast QoS and proposes protocols on IPv6-based Xcast QoS.

Digital networks are introduced gradually, nowadays many industries they rely on Internet Protocol to provide direct connectivity to customers anytime, anywhere. IP is presently utilized in crucial regions including video control, telemedicine, Internet of Think, digital payments, telepresence, etc. The two protocols, Internet Protocol version 6 (IPv6) and Internet Protocol version 4 (IPv4), can be distinguished in terms of features, services, and performance. Nowadays communication companies are The exhaustion of IPv4 and the transition to IPv6. IPv6 has more IP addresses than IPv4. IPv6 uses 128 bits and IPv4 uses 32 bits . IPv4 is not more secure than IPv6. The efficiency of IPv6 and IPv4 is carried out to test to check the response between the target client and server, the routing protocol, The packet size interval between the router and the communication network simulation. All of these parameters are combined to simultaneously test IPv4 and IPv6 performance. Now that all data has been received, it turns out that IPv4 with all these specifications is not better than IPv6. The length of a packet affects how long it takes for a packet to reach its destination. Every time a small packet is sent, the duration is slow in IPv4 with routing OSPF protocol. The study is performed using the routing OSPF vector protocol. Every time a small packet is sent the duration remains slow in IPv4 using the OSPF protocol. Whenever a small packet is sent, the duration remains slow in IPv4 using OSPF protocol. The research will be conducted using the OSPF vector routing protocol.

Internet and telecom service providers worldwide are facing financial sustainability issues in migrating their existing legacy IPv4 networking system due to backward compatibility issues with the latest generation networking paradigms viz. Internet protocol version 6 (IPv6) and software-defined networking (SDN). Bench marking of existing networking devices is required to identify their status whether the existing running devices are upgradable or need replacement to make them operable with SDN and IPv6 networking so that internet and telecom service providers can properly plan their network migration to optimize capital and operational expenditures for future sustainability. In this paper, we implement “adaptive neuro fuzzy inference system (ANFIS)”, a well-known intelligent approach for network device status identification to classify whether a network device is upgradable or requires replacement. Similarly, we establish a knowledge base (KB) system to store the information of device internetwork operating system (IoS)/firmware version, its SDN, and IPv6 support with end-of-life and end-of-support. For input to ANFIS, device performance metrics such as average CPU utilization, throughput, and memory capacity are retrieved and mapped with data from KB. We run the experiment with other well-known classification methods, for example, support vector machine (SVM), fine tree, and liner regression to compare performance results with ANFIS. The comparative results show that the ANFIS-based classification approach is more accurate and optimal than other methods. For service providers with a large number of network devices, this approach assists them to properly classify the device and make a decision for the smooth transitioning to SDN-enabled IPv6 networks.

The United States (US) Department of Defense (DoD) has been tasked by the DoD chief information officer (DoD CIO) to transition its networks from Internet protocol (IP) version 4 (IPv4) to IP version 6 (IPv6) by fiscal year 2008 (FY08). This will be a daunting task and presents significant challenges to DoD network architects, engineers and operators. One of the most difficult challenges will be to ensure that sensitive DoD information is not compromised by the introduction of IPv6. Currently, DoD information assurance (IA) professionals are studying this problem and architecting solutions to mitigate these risks. In this paper, we present a notional security architecture for DoD networks transitioning to IPv6

<span lang="EN-US">The rapid development of information and communication technologies has increased the demand for internet-facing devices that require publicly accessible internet protocol (IP) addresses, resulting in the depletion of internet protocol version 4 (IPv4) address space. As a result, internet protocol version 6 (IPv6) was designed to address this issue. However, IPv6 is still not widely used because of security concerns. An intrusion detection system (IDS) is one example of a security mechanism used to secure networks. Lately, the use of machine learning (ML) or deep learning (DL) detection models in IDSs is gaining popularity due to their ability to detect threats on IPv6 networks accurately. However, there is an apparent lack of studies that review ML and DL in IDS. Even the existing reviews of ML and DL fail to compare those techniques. Thus, this paper comprehensively elucidates ML and DL techniques and IPv6-based distributed denial of service (DDoS) attacks. Additionally, this paper includes a qualitative comparison with other related works. Moreover, this work also thoroughly reviews the existing ML and DL-based IDSs for detecting IPv6 and IPv4 attacks. Lastly, researchers could use this review as a guide in the future to improve their work on DL and ML-based IDS.</span>

2 - IPv6 Multicasting