If I successfully Man in the Middle attack an IPv6 Address of my victim can I also sniff its IPv4 packets?

Attacks like Neighbor Advertisement Spoofing or Last Hop Router?

  • 2
    Not until they're encapsulated in IPv6.
    – Ricky
    Mar 3, 2015 at 20:24
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 4:21

2 Answers 2


IPv4 and IPv6 are separate protocols, so attacking one doesn't directly affect the other. That said, the techniques for NA spoofing and ARP spoofing are very similar. If you have the capability to do one, you certainly could do the other.

  • If you could also take over the DNS functions for IPv6, you could reply with arbitrary IPv6 addresses for IPv4 only destinations. Given that most systems have a preference for IPv6, you could pull in that traffic and MITM that traffic as well.
    – JelmerS
    Mar 4, 2015 at 8:18

An attacker on the path

One way to perform a MITM attack is by having access to a node which is on the legitimate path between the two endpoints or a node directly connected to an Ethernet segment used by the legitimate path.

Assuming the legitimate path used between the two endpoints is identical for IPv4 and IPv6, then an attacker will be just as close to the IPv4 path as to the IPv6 path.

If the attacker controls a node on the path, then the attacker can obviously MITM both protocols. If the attacker only control a node connected to the same Ethernet segment as a hop used by the legitimate path, it takes a bit more work.

In this case MAC spoofing would work equally well for attacking both IPv4 and IPv6. But it is difficult to both capture the packet that way and then pass it on to the legitimate destination.

If the attack is performed by spoofing at a higher layer, then attacks are possible against both IPv4 and IPv6, but it is different packets which need to be spoofed in the two cases. In case of IPv4 it is ARP packets, in case of IPv6 it is neighbor discovery packets.

Certain switches have features to protect against the above spoofing attacks. However if the switch was designed to protect against ARP spoofing but has no protection against neighbor discovery spoofing, then the attacker would only be able to MITM the IPv6 traffic and not the IPv4 traffic.

BGP attacks

Without being anywhere near the path between the two endpoints, it is possible to perform MITM attacks through some BGP trickery. Even if the legitimate path is identical for IPv4 and IPv6, it is still possible that prefix lengths and route origin authorization is different enough between the two, that the attack is not equally efficient against IPv4 and IPv6.

Influencing the choice of IPv4 vs IPv6

Should an attacker somehow control only IPv6 and not IPv4, the attacker may obviously have an interest in influencing the client to transmit traffic over IPv6 rather than IPv4.

If the client is using the happy eyeballs approach, then it will usually use the fastest of the two connections. A MITM simply forwarding packets between client and server can be expected to increase latency, thus the client is more likely to chose the connection not under attack. However if the MITM instead of forwarding packets decide to terminate the TCP connection and run another TCP connection towards the server, then it is possible that the MITM can achieve a better latency from the client's perspective than the legitimate path. The exact details of the algorithm vary between implementations, for example it is possible to give one protocol a head start (measured in milliseconds), and if that head start is large enough variations in latency introduced by the MITM may not affect the outcome.

  • 1
    The way happy eyeballs works in this scenario is very dependant on implementation. Chrome gives IPv6 a 300ms head start, which could be enough for the attacker to still be faster. OS X simply prefers the fastest responder. If you use Internet Explorer, you have no happy eyeballs and the attacker has until TCP times out to do his attack. See also labs.ripe.net/Members/emileaben/hampered-eyeballs
    – JelmerS
    Mar 4, 2015 at 8:34
  • @JelmerS True. Which is why that paragraph says things like If the client, usually, more likely rather than making absolute statements. I added another sentence to cover the implementation variation aspect.
    – kasperd
    Mar 4, 2015 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.