IPv6 Address Starvation

Before your device uses an IPv6 address, it does a quick sanity check called Duplicate Address Detection (DAD): it asks the network, “is anyone already using this address?” If nobody answers, the address is safe to keep. IPv6 address starvation is a denial attack that abuses that politeness — an attacker answers every such question with a spoofed “yes, that one’s mine.”

Because your device honestly backs off any address someone else claims, it can never settle on any IPv6 address. The result isn’t noise — it’s silence: a machine that quietly has no working IPv6 at all.

Every address you try to claim, someone else says they already own.

The attacker doesn’t need to guess which address you’ll pick. They watch for DAD probes on the local network and reflexively answer all of them as taken. The classic tool is THC-IPv6’s atk6-dos-new-ip6, which sits on the segment and denies every new address a host tries to bring up.

# conceptual — the attacker's stance, not a copy-paste exploit
for each DAD probe seen on the segment:
    reply "that address is already mine"   # spoofed Neighbor Advertisement
# real tool: THC-IPv6  ->  atk6-dos-new-ip6 <interface>

The payoff is quiet but useful. A host with no IPv6 either falls back to IPv4 — which the attacker may already be shaping with a rogue DHCP server — or, on IPv6-first networks, gets pushed onto whatever path the attacker leaves open to watch. Denial is the setup; interception is the goal.

There’s an honest nuance here, and it shaped the detector. Windows does not keep a DAD-failed address hanging around labelled Duplicate — it simply discards it. So there’s no tidy “duplicate address” flag to read. We hardware-validated this and rebuilt the detector around what Windows actually shows.

The real, reliable signal is a working physical adapter that had IPv6 and now holds zero global (2xxx) addresses — while the network is still handing IPv6 out, meaning a default IPv6 router is still present on that adapter. You can read the same two facts by hand on Windows:

# 1. Any global (2xxx) IPv6 address left on the adapter? (router-assigned / SLAAC)
Get-NetIPAddress -AddressFamily IPv6 -PrefixOrigin RouterAdvertisement

# 2. Is an IPv6 router still on offer? (default route ::/0)
Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0

We hold that condition — a router present but zero global addresses — across several minutes so an ordinary sleep/wake or roam blip doesn’t count. An adapter that can plainly see a router but can’t hold a single global address of its own, minutes on end, isn’t a network that turned IPv6 off — it’s an address it keeps being told it can’t have.

Surfacing IPv6 starvation tells you the segment is being tampered with at a low level — the point to stop trusting where its IPv6 (or its IPv4 fallback) is steering you. WifiThreatWatch reports which adapter lost its addresses and that a router was still on offer, so you can tell a real denial apart from an ISP or router quirk.

On a subscription, Active Defense routes your traffic through the encrypted tunnel — so even when an attacker has forced you off IPv6 and onto a path they can watch, all they get to forward is ciphertext they can’t read or redirect.