Security analysis for IPv6 neighbor discovery protocol

Neighbor Discovery Protocol (NDP) is used by IPv6 nodes to discover other nodes on the link, which assigns link-layer address to find routers, so as to obtain reachability information about the paths to active neighbors. This paper presents security threats and deeply analysis for IPv6 NDP and discusses about typical attacks in details. Meanwhile, the attack tools developed in accordance with NDP are demonstrated, which provides certain theoretical basis for improving the security feature of NDP. Finally, an improved security strategy based on IPSec AH and MAC address option is proposed which aims at providing effectively defense against denial of service attacks and redirection attacks. The optimized NDP process has certain significance for strengthening the security of IPv6 network.