How do you detect a rogue IPv6 router?
Your PC runs IPv6 whether you asked it to or not — and the mitm6 attack quietly takes it over while IPv4 looks perfectly normal. Here’s how to see it.
You detect a rogue IPv6 router by baselining the IPv6 routers, DNS servers, and prefixes you trust — then watching for a new one to appear. The mitm6 attack forges an IPv6 Router Advertisement (or wins a DHCPv6 race) to make itself your IPv6 gateway or DNS. On Windows, Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0 lists your IPv6 routers; a router or DNS you never configured showing up there is the whole game.
IPv4 looks fine. That’s exactly why nobody notices IPv6 was stolen.
Why your PC has an IPv6 side at all
Windows ships with IPv6 enabled by default, running right alongside IPv4 — that’s called dual-stack. On the IPv6 side, your PC learns its default router and often its DNS from Router Advertisement messages broadcast on the local link, and none of those messages are authenticated. Any device on your Wi-Fi can send one.
That’s the opening a rogue IPv6 router uses. The famous tool, mitm6, doesn’t even send Router Advertisements — it answers the DHCPv6 requests Windows sends on its own and hands your machine the attacker as its DNS server. Windows prefers IPv6 for name resolution, so your lookups quietly switch sides while your IPv4 gateway never moves.
What a rogue IPv6 router looks like
The symptoms are subtle because IPv4 keeps working. Watch for:
- An IPv6 DNS server you didn’t set — a resolver appears with no matching route. This is the classic mitm6 tell.
- A new IPv6 default router (a second
::/0route) after the network was stable. - A new global prefix — your PC suddenly holds IPv6 addresses from a range that isn’t your ISP’s.
- A sudden flood of IPv6 addresses — a sign of an RA flood. On older systems this could grind the PC down; modern Windows caps and discards the excess, so today it’s more nuisance than knockout.
List your IPv6 routers, DNS, and prefixes
You can surface the same three things a detector baselines, by hand, in PowerShell. Run these on a network you trust to learn what normal is, then run them again if something feels off and compare — anything new is suspect:
# 1. Your IPv6 default routers — anything the ::/0 route points at Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0 # 2. Your IPv6 DNS servers — a new one here is the mitm6 tell Get-DnsClientServerAddress -AddressFamily IPv6 # 3. Your IPv6 addresses and the prefixes they came from Get-NetIPAddress -AddressFamily IPv6
The attacker’s side of this uses named, off-the-shelf tools — mitm6 to win the DHCPv6 race and become your DNS, or THC-IPv6’s atk6-fake_router6 to forge the Router Advertisement itself. You don’t need to run them; you just need to recognize the router and DNS entries they leave behind in the three commands above.
The blind spot, and the false alarms
Two things make this hard to catch by hand. First, almost nothing on a home network watches IPv6 — the whole attack lives in a layer most tools ignore. Second, IPv6 is genuinely noisy: SLAAC privacy addresses rotate constantly, so a naive watch that flags every new address would cry wolf all day.
The honest way through is to baseline the things that shouldn’t change quietly — your real routers, DNS servers, and global prefixes — and accept that privacy addresses share your one true prefix. A legitimately multi-homed network gets captured in the baseline, not flagged forever. That’s the difference between a useful alert and noise you learn to ignore.
Catching it automatically
WifiThreatWatch baselines your IPv6 default routers, DNS servers, and global prefixes once the network settles, then flags any new router, new DNS server, or new prefix that appears — including the stealthy link-local DNS-with-no-route that mitm6 leaves behind. It reports exactly what showed up, so you can tell a new mesh node from an attack. Detection is free.
Go deeper: how we detect a rogue IPv6 router · detecting rogue DHCP · the threats library
Rogue IPv6 router: quick answers
How do I detect a rogue IPv6 router or mitm6?
Baseline your IPv6 default routers, IPv6 DNS servers, and global prefixes when the network is healthy, then watch for anything new. On Windows, “Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0” lists your IPv6 routers and “Get-DnsClientServerAddress -AddressFamily IPv6” lists your IPv6 DNS. A DNS server or router that appears out of nowhere — especially a DNS with no matching route — is the mitm6 tell.
What is mitm6?
mitm6 is a well-known attack tool that abuses your PC’s built-in IPv6 support. It answers the DHCPv6 requests Windows sends automatically and hands your machine the attacker as its IPv6 DNS server. Because Windows prefers IPv6 for name resolution, your lookups start flowing to the attacker while your IPv4 gateway never changes — so everything looks normal on the surface.
Why does mitm6 work when I only use IPv4?
You almost certainly use IPv6 too. Windows enables dual-stack IPv6 by default, and it will accept IPv6 configuration from the network without asking you. The attacker doesn’t need to touch your IPv4 setup at all — they just win the IPv6 side that nothing on a typical home network is watching.
Can a new IPv6 router be legitimate?
Yes. A new mesh node, a second router, or an ISP change can add a legitimate IPv6 router or prefix, and SLAAC privacy addresses rotate constantly by design. That’s why good detection baselines your real routers, DNS, and prefixes first and only flags things that appear afterward — and why it reports exactly what showed up, so you can tell a new mesh node from an attack.
Does disabling IPv6 protect me?
It removes this specific attack surface, but Microsoft advises against fully disabling IPv6 because parts of Windows expect it, and it can cause its own problems. The better answer is to keep IPv6 on and watch it — detect a rogue router or DNS when it appears rather than blinding yourself to half your network stack.