Behaviour of various operating systems during SLAAC, DAD, and ND

IPv6, Monitoring

This post contains the report from the study phase of the behaviour of various operating systems during SLAAC and DAD analysis for our paper called “A New Approach for Detection of Host Identity in IPv6 Networks”, which will be presented at DCNET 2013. This post also contains PCAP files that we believe may be useful for other researchers or engineers. In this post, we call RFC4941 as PE addresses and addresses used by windows with randomly generated interface identifier (IID) are called random addresses, even though the random part of the address is generated just once. The credit for most of the work goes to Martin Holkovič.

Monitoring network

We tested the operating systems on virtual machines in VMware Workstation 7.1., the network cards of the virtual machines were operating in Host-Only mode. You can see the topology on the following image: Testing topology Additionally, Cisco 3725 router was connected to the topology: Router connected to the tested network

Performed tests

Selection of a new address

  1. The router is connected to the network and the tested interface is down on the tested OS
  2. The tested interface is enabled and consequently, the OS generates a new address

Does the tested computer reply to DAD-NS (EUI-64, static, random, PE address)?

  1. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network.
  2. The tested address (EUI-64, static, random, PE) is set on the Ubuntu computer, consequently Ubuntu issues DAD and the tested OS should reply with the NA.

Does the tested computer use duplicate EUI-64 address?

  1. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
  2. The tested system is configured to generate EUI-64 if necessary.
  3. Ubuntu is set up to use the same MAC address as the tested computer has.
  4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate global EUI-64 address?

  1. Only the systems with EUI-64 addresses enabled by default were tested
  2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
  3. Ubuntu is set up to use the same IPv6 address as the tested computer would use as EUI-64 address.
  4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate random address?

  1. Only the systems with random addresses enabled by default were tested (newer Windows).
  2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
  3. Ubuntu is set up to use the same IPv6 address as the tested computer would use as random address (the IID is generated once and then it stays constant).
  4. The tested interface is enabled, the OS generates the same address as the Ubuntu computer already has. Ubuntu replies with NA.

Does the tested computer use duplicate PE address?

  1. PE addresses are enabled on the tested OS.
  2. The router, the tested computer and a virtual PC with Ubuntu are present in the tested network. The tested interface is down.
  3. A script that replies with NA to all PE addresses is started on the computer with Ubuntu. The script does not reply to EUI-64 (link-local, global) a random addresses used by the tested Windows computers.
  4. The tested interface is enabled, the OS generates PE address and the script replies with NA.

Captured PCAP files

During the test, we captured various PCAP files that can be downloaded used for your analysis. We have also analysed the PCAP files, see the following section.

Test results

The tests result are presented in the following table

Name Version Kernel Uses PE addresses by default Does the tested computer reply to DAD-NS (static address)? The tested computer does not use duplicate static address EUI-64 replies to DAD / does not use duplicate address Does not use duplicate EUI-64 global address in case of PE are turned on Random addresses replies to DAD / does not use duplicate address privacy extension adresy replies to DAD / does not use duplicate address / Number of attempts
CentOS 6.2 2.6.32 No Yes Yes Yes / Yes Yes -1 Yes / Yes / 5
Debian 3.1 2.4.27 No Yes was not tested Yes / Yes -2 - -2
Debian 6.0.4 2.6.32 No Yes Yes Yes / Yes Yes -1 Yes / Yes / 5
Fedora 16 3.1.0 No Yes Yes Yes / Yes Yes -1 Yes / Yes / 5
FreeBSD 9.0 - No Yes Yes, tested on 9.1 Yes5 / Yes Yes 3 -1 Yes / Yes / 1 4
Linux Mint 12 3.0.0 No Yes Yes Yes / Yes Yes -1 Yes / Yes / 5
Mac OS X 10.6.2 10.2 No Yes - Yes / Yes Yes 3 -1 Yes / Yes / 1 4
Mandriva One 2011 2.6.38 No Yes was not tested Yes / Yes Yes -1 Yes / Yes / 5
OpenBSD 5.0 - No Yes Yes Yes / Yes Yes 3 -1 Yes / Yes / 1 4
Red Hat 5 2.6.18 No Yes was not tested Yes / Yes Yes -1 Yes / Yes / 5
Solaris 5.11 - No 6 Yes Yes / Yes Yes 3 -1 Yes / Yes / 5
Ubuntu 10.04 LTS 2.6.32 No Yes was not tested Yes / Yes Yes -1 Yes / Yes / 5
Ubuntu 11.10 3.0.0 No Yes was not tested Yes / Yes Yes -1 Yes / Yes / 5
Windows 7 - 6.1 Yes Yes Yes Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows 7 SP1 6.1 Yes Yes was not tested Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows 8 consumer preview 6.2 Yes Yes Yes Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows Server 2008 R2 SP1 6.1 No Yes was not tested Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows Vista - 6.0 Yes Yes was not tested Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows Vista SP2 6.0 Yes Yes was not tested Yes5 / Yes Yes Yes / Yes Yes / Yes / 7
Windows XP SP3 5.1 No Yes Yes Yes / Yes Yes -1 Yes / Yes / 7

Notes to the tests

  • 1.Random addresses:
    • They are only supported on Windows Vista and newer.
  • 2. Privacy extension addresses:
    • PE was not configured
  • 3. EUI-64 global addresses – reaction to duplicate address:
    • Tested OS keeps the address but it is marked as duplicate and it is not used by the OS (e.g. DAD, ping)
  • 4. Privacy extension addresses – reaction to duplicate address:
    • Only one PE is tried, it is kept after DAD but it is marked as duplicate and it is not used by the OS (e.g. DAD, ping)
  • 5. EUI-64 – reaction to DAD:
    • Marked systems ignore DAD from the same MAC address as is used by the system.
  • 6. Solaris – static address:
    • Static address was not tested because it was not used by the system.
About the main author

Libor Polčák

http://www.fit.vutbr.cz/~ipolcak ipolcak@fit.vutbr.cz

Libor Polčák is a Ph.D. student at BUT, FIT.

Libor PolčákBehaviour of various operating systems during SLAAC, DAD, and ND