Michael Vogel wrote:Haven't read the RFC 5952, and because it's not a standard, it is more important, how
network companies are interpreting the paper (in this case section 4 or so) -- when I started with networking, I wondered how many products ignored the well defined output format for MAC addresses (01:02:03:04:05:06 or 01-02-03-04-05-06)...
...back to IPv6, I would be generous when checking the input string, or add a "repair filter" to convert typos to get perfect address strings.
Since this is intended for windows systems, we are monitoring via the RFC as MS interpets and designed the OS systems. Someone else is working on the modules for linux/unix flavors (which i'm happy for because not all of the linux flavors interpet the same way all the time, for example, some may return upper case in the IPv6 address and some lower case, at times), and the MAC versions (which I believe uses all lower case in its text representations also but i'm not up to date on the MAC systems).
The interpetation of the RFC by MS is not really their interpetation, they used RFC 5952, Section 4.3, which states that only lower case alphabetics must be used in IPv6 addresses - in text representations. RFC 5952 (a "recommendation", and was dated August 2010) specifies a set of rules for generating the preferred textual representation of an IPv6 address. The third sentence of RFC 5952's section 4 reads: "The recommendation in this section SHOULD be followed by systems when generating an address to be represented as text, but all implementations MUST accept and be able to handle any legitimate RFC4291 format." , "handling" and generating a textual representation are two different things and if you feed in uppercase it will "handle" it but when it gives a text representation it will give lower case for what we are monitoring and if the uppercase is there in what we monitor then we may have a problem. In RFC 5952, section 4.3, it reads:
"4.3. Lowercase
The characters "a", "b", "c", "d", "e", and "f" in an IPv6 address MUST be represented in lowercase."
it does say "MUST be" (its refering to the text representation). True, its a recommendation and there was errata for the RFC which made a case for using all uppercase but the eratta was not accepted and its unlikely it will be accepted.
I forget right now which one, but there is another RFC that states in a small blurp that only IPv6 addresses used in documentation or examples should use uppercase. Since windows systems give lowercase in its text representations of an IPv6 address, and some malware activity is known to alter the IP addresses or place such in tables and logs with uppercase in the address, if we find one in tables or logs or in monitoring parts of the system, with uppercase its a pretty good bet the windows system did not produce it.
My favorite so far is a certain IPv6 prefix of which we catch a lot. Another issue is rogue IPv6 Router Advertisements. IPv6 RA's are used to determine node configuration, rogue RAs can cause partial or complete failure of hosts on an IPv6 link or can be used for denial-of-service or man-in-the-middle attacks. But its not just malware that can create a rogue RA and most are caused, either intentionally or not, via user misconfiguration. Rogue RA's can also hijack a wireless system (on which Rogue RA's are more common), where a laptop has enabled the Windows Internet Connection Sharing (ICS) service, which can turn a host into a 6to4 gateway, its a useful feature until it runs when not intended and some malware attempt to start an IPv4 DHCPv4 server on the host via use of a rogue RA. Its also suprising to learn that a lot of malware that alters an IPv6 address will over use a certain letter or combination of letters in altering the address (which I will not disclose the letter, combination, frequency, or placement here). I just started on the part for detecting the rogue IPv6 RA's.
Thanks for your post Michael, you reminded me of something I need to do with this as well.
The advantage of a 64 bit operating system over a 32 bit operating system comes down to only being twice the headache.
so i can't really test this! but it's detecting all my private addresses ok.