Man In The Middle on IPv6, are IPv4 packets affected?

Question

If I successfully Man in the Middle attack an IPv6 Address of my victim can I also sniff its IPv4 packets?

Attacks like Neighbor Advertisement Spoofing or Last Hop Router?

Answer 1

IPv4 and IPv6 are separate protocols, so attacking one doesn't directly affect the other. That said, the techniques for NA spoofing and ARP spoofing are very similar. If you have the capability to do one, you certainly could do the other.

Answer 2

An attacker on the path

One way to perform a MITM attack is by having access to a node which is on the legitimate path between the two endpoints or a node directly connected to an Ethernet segment used by the legitimate path.

Assuming the legitimate path used between the two endpoints is identical for IPv4 and IPv6, then an attacker will be just as close to the IPv4 path as to the IPv6 path.

If the attacker controls a node on the path, then the attacker can obviously MITM both protocols. If the attacker only control a node connected to the same Ethernet segment as a hop used by the legitimate path, it takes a bit more work.

In this case MAC spoofing would work equally well for attacking both IPv4 and IPv6. But it is difficult to both capture the packet that way and then pass it on to the legitimate destination.

If the attack is performed by spoofing at a higher layer, then attacks are possible against both IPv4 and IPv6, but it is different packets which need to be spoofed in the two cases. In case of IPv4 it is ARP packets, in case of IPv6 it is neighbor discovery packets.

Certain switches have features to protect against the above spoofing attacks. However if the switch was designed to protect against ARP spoofing but has no protection against neighbor discovery spoofing, then the attacker would only be able to MITM the IPv6 traffic and not the IPv4 traffic.

BGP attacks

Without being anywhere near the path between the two endpoints, it is possible to perform MITM attacks through some BGP trickery. Even if the legitimate path is identical for IPv4 and IPv6, it is still possible that prefix lengths and route origin authorization is different enough between the two, that the attack is not equally efficient against IPv4 and IPv6.

Influencing the choice of IPv4 vs IPv6

Should an attacker somehow control only IPv6 and not IPv4, the attacker may obviously have an interest in influencing the client to transmit traffic over IPv6 rather than IPv4.

If the client is using the happy eyeballs approach, then it will usually use the fastest of the two connections. A MITM simply forwarding packets between client and server can be expected to increase latency, thus the client is more likely to chose the connection not under attack. However if the MITM instead of forwarding packets decide to terminate the TCP connection and run another TCP connection towards the server, then it is possible that the MITM can achieve a better latency from the client's perspective than the legitimate path. The exact details of the algorithm vary between implementations, for example it is possible to give one protocol a head start (measured in milliseconds), and if that head start is large enough variations in latency introduced by the MITM may not affect the outcome.