IPv6 Neighbor Spoofing

IPv6 neighbor spoofing is ARP spoofing’s modern twin. IPv6 has no ARP at all — instead, hosts map addresses to hardware MACs using Neighbor Discovery, a scheme of Neighbor Solicitation and Neighbor Advertisement messages. Like ARP, it was designed to simply trust whatever it hears.

An attacker abuses that trust by sending forged, unsolicited Neighbor Advertisements claiming that your router’s link-local address (the fe80::… address every IPv6 router has) now lives at the attacker’s MAC. Your device believes it, updates its neighbor cache, and starts sending IPv6 traffic to the attacker.

The dangerous part: this poisons only IPv6. Your IPv4 path stays clean, so anything checking IPv4 sees nothing wrong — while modern apps quietly prefer IPv6 through the attacker.

The attacker floods the local segment with fake Neighbor Advertisements for the router’s fe80:: address, overriding the real binding in every victim’s neighbor cache. The real router keeps answering too, so the attacker just repeats often enough to win. Off-the-shelf tooling — the THC-IPv6 suite — makes this a one-liner.

# Conceptual — the THC-IPv6 toolkit forges Neighbor Advertisements claiming the
# router's fe80:: address is now at the ATTACKER's MAC, poisoning neighbor caches
parasite6 eth0            # relay/redirect IPv6 neighbor traffic
fake_advertise6 eth0 fe80::1   # advertise the router address at the attacker's MAC

Why it works so well: because Happy Eyeballs (the algorithm browsers and apps use to race IPv4 and IPv6) generally prefers IPv6 when it’s available, the attacker captures the path most of your real traffic actually takes — while an IPv4-only check sees a perfectly healthy network. This is the IPv6 half of a man-in-the-middle attack, and the natural next step after ARP spoofing.

WifiThreatWatch reads the operating system’s IPv6 neighbor cache and baselines the one binding that matters: your default router’s address and the MAC it answers from. We learn the router’s link-local address from the IPv6 default route, then remember which hardware address that router address resolves to.

If that same router address later starts answering at a different valid unicast MAC, that’s poisoning — the exact fingerprint of a forged Neighbor Advertisement. You can watch the same two facts by hand on Windows:

# 1. Find the router's IPv6 link-local address (the ::/0 default-route next hop)
Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0

# 2. Note the MAC (LinkLayerAddress) next to that router fe80:: row.
#    If it later changes to a different MAC, that's poisoning.
Get-NetNeighbor -AddressFamily IPv6 | Format-Table IPAddress, LinkLayerAddress, State

Anchoring on the tiny router set is what keeps this false-positive-safe. SLAAC privacy addresses churn constantly on a healthy network — we never watch those, so their churn never trips the alarm. A router reboot keeps the same MAC; a genuine hardware swap changes the router address, which reads as a new-router event, not a poisoning flap.

A single changed binding isn’t enough to alarm you. We confirm the router address is genuinely answering at the new MAC — not a stale cache entry from a poisoning that already ended — before we call it. That keeps a one-off cache blip from becoming a false alert.

When it’s confirmed, you can tap Protect Me. We break the attacker’s targeting by cycling your identity — new MAC, fresh addresses — and bring up an encrypted, self-hosted VPN tunnel so your traffic no longer depends on a poisoned neighbor cache. If the attacker re-advertises, we change identity again.

See the full Active Defense flow →