# Securing IPv6 Neighbor Discovery Address Resolution with Voucher-Based Addressing
## 2 Background and Motivation
### Classic Neighbor Spoofing Attacks  
The \"classic\" neighbor spoofing attack targets two nodes that have established existing and reachable-state cache entries between them. In its simplest form, it overhears an address resolution transaction and follows the completed exchange with an overriding Neighbor Advertisement packet to the target of the attack. RFC 4861 [3] is careful to mention these target nodes receiving unsolicited Neighbor Advertisements: \"The Override flag MAY be set to either zero or one. In either case, neighboring nodes will immediately change the state of their Neighbor Cache entries for the target address to STALE, prompting them to verify the path for reachability. If the Override flag is set to one, neighboring nodes will install the new link-layer address in their caches. Otherwise, they will ignore the new link-layer address, choosing instead to probe the cached address\".  
Such a mechanism is put in place to allow the target of any Neighbor Discovery proxying to assert its own link-layer address as being reachable on-link directly, rather than letting traffic slowly meander to it through the proxy node(s) indirectly. Due to this tradeoff made by the NDP specification, this advertised override forces the target node to update the link-layer address binding for the victim to the spoofed address. Thus, a single packet has initiated this especially heinous attack.  
In step 1 of Figure 1, Node A is the solicitor who asks for the link-layer-to-IP-address (LL2 IP; see Table 1) binding from the address fe80::b. Since Node A does not know the target's link-layer address yet (and thus where to forward frames), a solicited-node multicast address is used instead which utilizes the last 24 bits of the target IP address. Any node can be subscribed to the solicited-node multicast group without authorization. So, then, both Node B (the legitimate target) and Node C (the listening threat actor) from the Figure receive the multicast NS packet. Notice that in step 1, Node A also includes an \"SLLAO\" (source link-layer address option) with its NS message in order to let receivers know the reverse path on the link layer to find fe80::a (i.e., the MAC address 11-22-33-44-55-aa).  
In step 2, Node B receives the NS, pre-caches the link-layer binding from the SLLAO, and responds with its legitimate MAC address in a unicast advertisement packet to Node A at fe80::a. The listening Node C has also received the same NS message details in this step. After some brief delay, it sends a spoofed unicast Override NA in step 3 with its own link-layer address (11-22-33-44-55-cc) as the reported binding for fe80::b. Note that Node C does not need to await this NDAR process in order to send an Override NA if it already knows the link-layer address of Node A.  
Node A has now been poisoned: it subsequently updates its Neighbor Cache for fe80::b to the spoofed link-layer address because of the Override flag, for which there is no authentication requirement to use. Packets destined for fe80::b will now be sent to Node C, which can read and interact with the data before forwarding it down the path to Node B, where it will be received without the knowledge that Node C had any interaction with it. If Node C repeats this process oppositely with Node B's traffic en route to Node A, then a completely transparent and two-way on-path attack is successfully set up. Node C would achieve a complete arbitration of the traffic stream between Nodes A and B.