How do you detect IPv6 address starvation?

IPv6 address starvation is a denial attack on Duplicate Address Detection (DAD). DAD is the polite check every host runs before using an IPv6 address: it asks the local network whether that address is already taken, and steps aside if someone says yes.

The attacker abuses that politeness. Using a tool like THC-IPv6’s atk6-dos-new-ip6, they watch for DAD probes and answer all of them as taken. Your device honestly gives up on every address it tries — so it never gets a working IPv6 address. It’s the flip side of a noisy flood: the symptom is silence, an adapter with no IPv6 where there should be plenty.

# conceptual — the attacker's stance, not a runnable exploit
for each DAD probe seen on the segment:
    reply "that address is already mine"   # spoofed Neighbor Advertisement
# real tool: THC-IPv6  ->  atk6-dos-new-ip6 <interface>

The frustrating part is what you won’t see. Windows does not keep a DAD-failed address around labelled Duplicate — it discards it outright. We confirmed this on real hardware. So the tell is indirect:

• No global IPv6 address — your 2xxx: addresses are simply gone.
• But a router is still there — a default IPv6 route (::/0) is still being offered.
• It sticks — the loss holds for minutes, not the second-or-two of a sleep/wake or roam.
• IPv6 sites fail while IPv4 works — you fall back to IPv4, possibly onto a path someone’s watching.

You can surface the same signal by hand with two PowerShell commands. The first asks whether your adapter still holds a global IPv6 address; the second asks whether the network is still offering an IPv6 router. Zero global addresses but a router still present is the starvation fingerprint.

# Do you still have any global (2xxx) IPv6 addresses? (router-assigned / SLAAC)
Get-NetIPAddress -AddressFamily IPv6 | Where-Object PrefixOrigin -eq 'RouterAdvertisement'

# Is an IPv6 router still being offered? (default route ::/0)
Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0

# Quick sanity check of the whole IPv6 picture
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv6Address, IPv6DefaultGateway

If Get-NetRoute ::/0 returns a gateway but Get-NetIPAddress shows no 2xxx global address on that same working adapter — and it stays that way — the network is offering you IPv6 that you’re somehow never allowed to keep.

The honest caveat: losing IPv6 for a moment is normal. Sleep/wake, roaming between access points, and router reboots all drop IPv6 briefly, and plenty of networks don’t offer IPv6 at all. Catch any of those in a single snapshot and you’d cry wolf constantly.

That’s why the reliable detector holds the condition across several minutes and requires a router to still be present. A network that simply turned IPv6 off has no router to point at; a starvation attack leaves the router plainly visible while every address you try is denied. The gap between “router offered” and “address held” is the whole signal — and it only means something when it persists.

WifiThreatWatch watches your physical adapters for exactly this: one that was IPv6-capable now holding zero global addresses while a default IPv6 router is still on offer, held long enough to rule out an ordinary blip. It reports which adapter lost its addresses so you can tell a real denial from a router quirk. The detector was rebuilt around what Windows actually shows after hardware validation. Detection is free.

Go deeper: how we detect IPv6 starvation · detecting a rogue DHCP server · the threats library