Rogue IPv6 Router

Almost every modern home network runs IPv6 alongside IPv4 — dual-stack, on by default in Windows — and almost no home tool watches the IPv6 side. That blind spot is the whole attack. On IPv6, your PC learns its default router and often its DNS from Router Advertisement messages that any device on the link can broadcast. Nothing about them is authenticated.

A rogue IPv6 router is an attacker injecting forged Router Advertisements to make itself your IPv6 default router — or, as the tool mitm6 does, winning the DHCPv6 race to make itself your IPv6 DNS server. Either way, your IPv6 traffic or your name lookups start flowing through the attacker, while your IPv4 connection looks completely normal.

Your network speaks IPv6 whether you asked it to or not — and an attacker just offered to route it.

The classic tool is mitm6, and it’s sneaky about it: it doesn’t bother with Router Advertisements at all. It answers the DHCPv6 requests Windows sends on boot and hands your PC an IPv6 address and, critically, itself as the DNS server. Windows never takes a default route from DHCPv6, so the attacker doesn’t become your gateway — but because Windows prefers IPv6 for name resolution, your lookups now belong to them while your IPv4 gateway never changed. The THC-IPv6 suite does the louder version — forged Router Advertisements (atk6-fake_router6) that inject a bogus default route and prefix so the attacker becomes the gateway too.

# Conceptual — the two real families, named not weaponized
# mitm6: win the DHCPv6 race, become the victim's IPv6 DNS
mitm6 -i eth0 -d victim.local

# THC-IPv6: forge a Router Advertisement, become the IPv6 gateway
atk6-fake_router6 eth0 2001:db8:bad::/64

Variants make it stealthier or nastier: a SLAAC takeover injects an attacker prefix so your PC auto-configures addresses on the attacker’s network; a DHCPv6-only DNS takeover leaves no Router Advertisement to spot at all; and an RA flood (atk6-flood_router6) advertises so many bogus prefixes that older systems configured thousands of addresses and slowed to a crawl. Be honest about that last one: modern Windows caps and rate-limits autoconfigured addresses per interface and simply discards the excess, so the classic RA-flood lockup is far weaker than the old demos suggest — the forged router and DNS it hides behind are the real damage. It pairs naturally with DNS spoofing once the attacker owns your resolver.

WifiThreatWatch treats IPv6 the same way a careful operator would: once your network has settled, it baselines the truth — which IPv6 default routers you have, which IPv6 DNS servers you use, and which global /64 prefixes are legitimately yours. After that, any new IPv6 router, any new DNS server, or any new global prefix that appears is a rogue Router Advertisement until proven otherwise.

The tell that catches the stealthy mitm6 case is a link-local DNS server that is not also a router — a resolver that appeared without a matching route. That is exactly the shape mitm6 leaves behind, and it’s invisible to anything only watching IPv4. You can reproduce the same view by hand:

# Your IPv6 default routers (the ::/0 route points at them)
Get-NetRoute -AddressFamily IPv6 -DestinationPrefix ::/0

# Your IPv6 DNS servers — a new one here is the mitm6 tell
Get-DnsClientServerAddress -AddressFamily IPv6

# Your IPv6 addresses and the prefixes they came from
Get-NetIPAddress -AddressFamily IPv6

It is built to be false-positive-safe. SLAAC privacy addresses rotate constantly but all share your one real ISP prefix, so they don’t trip it, and a genuinely multi-homed network is captured in the baseline rather than flagged forever.

A new IPv6 router or DNS server that you never configured is the signal that the network’s naming and routing can no longer be trusted. WifiThreatWatch surfaces exactly what appeared — the rogue router’s link-local address, the DNS it tried to hand you, and the prefix it advertised — so you can act instead of guessing why the connection feels off.

On a subscription, Active Defense routes your traffic through the encrypted tunnel. Even when an attacker has made themselves your IPv6 gateway and resolver, all they can forward is ciphertext they can’t read or redirect — the same defense that neutralizes a rogue DHCP server on the IPv4 side.