Switch Binding Table Mitigates IPv6 Neighbor Discovery Cache Exhaustion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPv6 networks are vulnerable to scanning attacks that lead to memory depletion in routers due to the creation of numerous neighbor discovery cache entries, limiting the capability to serve existing hosts in the subnet, as attackers send packets to a large number of IPv6 addresses within the same subnet, causing routers to store packets that trigger resolution.
Innovation Solution
A method where a switch or L3 registrar maintains a binding table for all IP addresses in a subnet, ensuring that a router does not store an address in the neighbor discovery cache by responding with a negative status or ignoring the request if the address is not within the table, thereby preventing state creation and limiting the attack window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the router creates ND cache entries for each scanned IPv6 address, then the router can resolve addresses for legitimate hosts, but the router's memory is depleted and its capability to serve existing hosts is limited
Solution Approach 1:
The switch performs preliminary verification by checking its binding table before the router creates ND cache entries. By pre-validating IP addresses against the binding table, the switch prevents the router from storing cache entries for invalid or scanned addresses, thus avoiding memory depletion while maintaining address resolution capability for legitimate hosts
Solution Approach 2:
The switch acts as an intermediary between the attacker and the router's ND cache. It intercepts Neighbor Solicitation messages, verifies addresses against the binding table, and selectively blocks or allows cache entry creation. This intermediary function filters out malicious scanning traffic before it consumes router memory, while still permitting legitimate address resolution
2Reliability
If the router stores packets that trigger resolution, then the router can complete neighbor discovery, but the attack window is extended and more state is created in the router
Solution Approach 1:
The switch performs preliminary address validation in the binding table before packets are stored in the router for resolution. By pre-checking whether the target IP address exists in the binding table, the switch eliminates the need for the router to store and hold packets for invalid addresses, thus reducing the attack window and preventing unnecessary state creation
Solution Approach 2:
The switch applies preliminary anti-action by blocking Neighbor Solicitation messages for addresses not in the binding table before they can trigger router packet storage. This preemptive blocking prevents the extension of the attack window and stops the creation of router state for invalid addresses, while still allowing legitimate neighbor discovery to proceed
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device, e.g., switch (120) or registry (115) maintains a binding table for all internet protocol (IP) addresses in a particular subnet associated with the device, and in response to receiving a neighbor solicitation (NS) lookup message from a router (130) for a particular address, determines whether the particular address is within the binding table. When the particular address is not within the binding table, the device causes the router (130) to not store the particular address in a neighbor discovery (ND) cache at the router e.g., by responding to clear the cache, or ignoring to prevent state from being created. The ND-requesting router ensures that the particular address is not kept in an ND cache at the router in response to the device indicating that the particular address is not within its binding table (explicit response to clear, or absence of instruction to store state).