The Unexplored Impact of IPv6 on Intrusion Detection Systems
Loading...
Authors
Gehrke, Keith A.
Subjects
Advisors
Beverly, Robert
Date of Issue
2012-03
Date
Mar-12
Publisher
Monterey, California. Naval Postgraduate School
Language
Abstract
With DoD networks steadily adopting and transitioning to the next generation Internet Protocol, IPv6, careful consideration
must be given to IPv6-specific implications on network protection. While Network Intrusion Detection Systems (NIDS) assist
in protecting current IPv4 DoD networks, NIDS performance in operational DoD IPv6 environments is largely unknown. As a
step toward more rigorous NIDS evaluation, we investigate the extent to which known IPv4 attacks are able to evade detection
when converted to equivalent IPv6 attacks. Utilizing 13 general attack classes, we test the IPv6 readiness of two popular open
source NIDSs: SNORT and BRO. Attacks in each class are evaluated in a virtual test bed that models both “native” and
“transitional” networks. In the native IPv6 environment, we achieve a 95% detection rate for SNORT as compared to 8% with
BRO. In addition, we discover a bug in SNORT where a carefully crafted IPv6 packet causes the NIDS to fail open, allowing
full circumvention. Our findings suggest that, with respect to IPv6, both NIDS signatures and NIDS software require
additional testing and evaluation to be operationally ready.
Type
Thesis
Description
Series/Report No
Department
Computer Science