This post contains the report from the study phase of the behaviour of various operating systems during SLAAC and DAD analysis for our paper called “A New Approach for Detection of Host Identity in IPv6 Networks”, which will be presented at DCNET 2013. This post also contains PCAP files that we believe may be useful for other researchers or engineers. In this post, we call RFC4941 as PE addresses and addresses used by windows with randomly generated interface identifier (IID) are called random addresses, even though the random part of the address is generated just once. The credit for most of the work goes to Martin Holkovič.

Monitoring network

We tested the operating systems on virtual machines in VMware Workstation 7.1., the network cards of the virtual machines were operating in Host-Only mode. You can see the topology on the following image: Additionally, Cisco 3725 router was connected to the topology:

Performed tests

Selection of a new address

1. The router is connected to the network and the tested interface is down on the tested OS
2. The tested interface is enabled and consequently, the OS generates a new address

Does the tested computer reply to DAD-NS (EUI-64, static, random, PE address)?

1. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network.
2. The tested address (EUI-64, static, random, PE) is set on the Ubuntu computer, consequently Ubuntu issues DAD and the tested OS should reply with the NA.

Does the tested computer use duplicate EUI-64 address?

1. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
2. The tested system is configured to generate EUI-64 if necessary.
3. Ubuntu is set up to use the same MAC address as the tested computer has.
4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate global EUI-64 address?

1. Only the systems with EUI-64 addresses enabled by default were tested
2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
3. Ubuntu is set up to use the same IPv6 address as the tested computer would use as EUI-64 address.
4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate random address?

1. Only the systems with random addresses enabled by default were tested (newer Windows).
2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
3. Ubuntu is set up to use the same IPv6 address as the tested computer would use as random address (the IID is generated once and then it stays constant).
4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate PE address?

1. PE addresses are enabled on the tested OS.
2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
3. A script that replies with NA to all PE addresses is started on the computer with Ubuntu. The script does not reply to EUI-64 (link-local, global) a random addresses used by the tested Windows computers.
4. The tested interface is enabled, the OS generates PE address and the script replies with NA.

Captured PCAP files

During the test, we captured various PCAP files that can be downloaded used for your analysis. We have also analysed the PCAP files, see the following section and the publications below.

• POLČÁK Libor, HOLKOVIČ Martin a MATOUŠEK Petr. A New Approach for Detection of Host Identity in IPv6 Networks. In: Proceedings of the 4th International Conference on Data Communication Networking, 10th International Conference on e-Business and 4th International Conference on Optical Communication Systems. Reykjavík: SciTePress – Science and Technology Publications, 2013, pp. 57-63. ISBN 978-989-8565-72-3.
• POLČÁK Libor, HOLKOVIČ Martin and MATOUŠEK Petr. Host Identity Detection in IPv6 Networks. In: E-Business and Telecommunications. Berlin: Springer Verlag, 2014, pp. 74-89. ISBN 978-3-662-44787-1. ISSN 1865-0929. (This is an extended version of the previous paper.)
• POLČÁK, Libor. Lawful Interception: Identity Detection. Brno, 2017. PhD. Thesis. Brno University of Technology, Faculty of Information Technology. 2017-10-13. Supervisor Švéda Miroslav.

Test results

The tests result are presented in the following table

Notes to the tests

• 1.Random addresses:
  • They are only supported on Windows Vista and newer.
• 2. Privacy extension addresses:
  • PE was not configured
• 3. EUI-64 global addresses – reaction to duplicate address:
  • Tested OS keeps the address but it is marked as duplicate and it is not used by the OS (e.g. DAD, ping)
• 4. Privacy extension addresses – reaction to duplicate address:
  • Only one PE is tried, it is kept after DAD but it is marked as duplicate and it is not used by the OS (e.g. DAD, ping)
• 5. EUI-64 – reaction to DAD:
  • Marked systems ignore DAD from the same MAC address as is used by the system.
• 6. Solaris – static address:
  • Static address was not tested because it was not used by the system.