NDPMon

NDPMon is very Similar to ArpWatch concerning reported activities and erroneous configurations, but it also provides new features, specific to the Neighbor Discovery protocol, for which it detects attacks, which could harm the network. Different kinds of activities can be detected: Reported Activities * wrong couple MAC/IP * wrong router MAC * wrong router IP * wrong prefix * wrong router redirect * router Flag in Neighbor Advertisment: NDPMon is carefull about nodes sending router advertisments - only nodes specified to be official routers in the configuration file can send one. * Duplicate Address Detection DOS * flip Flop * reused old ethernet address: other kinds of malicious behaviors Sysloged Activities * Unknown MAC MAnufacturer * new station * new IPv6 Global Address * new Link Local Address * wrong couple MAC/IP * wrong router MAC * wrong router IP * wrong prefix * wrong router redirect * wrong ipv6 router: if neither the Link Local Address and the MAC address are known for a RA * wrong RA flags: if the managed and other flags in the RA are not well set * wrong source link address option: the MAC address in the Link Adress option does not match with the Ethernet source address * wrong ipv6 Hop limit: IPv6 Hop Limit is not 255