Finding IPv6 Where You Least Expect It Using LiveAction Software to Visualize and Troubleshoot IPv6 on Your Network

Transcription

1 LiveAction Application Note Finding IPv6 Where You Least Expect It Using LiveAction Software to Visualize and Troubleshoot IPv6 on Your Network September

2 Table of Contents 1. IPv6 Powering the Internet of the (Near) Future IPv6 in the Enterprise... 2 Finding IPv6 Network Traffic Conclusion... 6

3 1. IPv6 Powering the Internet of the (Near) Future Internet Protocol Version 4 (IPv4) came into existence in the early 80 s. As growth of the Internet took off, it was immediately recognized that the 32-bit address space of IPv4 would be insufficient, and techniques were adopted to make more efficient use of this limited resource (Classes Inter-Domain Routing, Network Address Translation and RFC 1918 private addresses). However, these were rightly recognized as stop-gaps with the only practical long-term solution to IPv4 address exhaustion being the adoption of a new Internet Protocol version with a wider address space. Just such a change was integrated into Internet Protocol Version 6 (IPv6), with publication of the main specification occurring in IPv6 features a number of improvements to IPv4, chief among them being the adoption of a 128-bit address space. Some of the other improvements to IPv6 have already been incorporated into IPv4 (e.g., IPsec), thus delaying the adoption of IPv6 until the pool of public IPv4 addresses has been exhausted. The timeframe of exhaustion is expected to begin in 2011with the IANA, followed shortly thereafter with the regional and local registries (ISPs). This makes mid-term adoption of IPv6 by U.S. enterprises a real consideration. Regardless of when you choose to introduce IPv6 in your enterprise, it s likely that IPv6 traffic is running there today. This application note explores how you can use LiveAction 2.0 software from ActionPacked! Networks and Cisco devices supporting NetFlow v9 to find, track, and troubleshoot IPv6 traffic on your network, regardless of whether that traffic is there intentionally or not. 1

4 2. IPv6 in the Enterprise While the use of private IP addresses and NAT (network address translation) on internal enterprise networks has been instrumental in postponing the need for IPv6, there is still likely to be some IPv6 protocol traffic running on your LAN. This is chiefly due to the default behavior of newer operating system versions that enable IPv6. A short list of operating systems that turns IPv6 on by default: Microsoft Vista Microsoft Windows Server 2008 Microsoft Windows 7 Apple OSX Most BSD distributions Most Linux distributions from 2004 and onwards Various cell phone operating systems from 2006 and onwards IPv6 running on your network can pose a security risk under certain circumstances, most notably where tunneling is enabled (6to4, Teredo, ISATAP) and if your security devices are not IPv6 aware and configured correctly. If you re not aware of what is happening with IPv6 traffic on your network it could work as an attack vector. If you intentionally run IPv6 traffic on your network then you ll want to track utilization levels and be prepared with the tools you need to debug any issues that arise. Finding IPv6 Network Traffic The first step to auditing IPv6 traffic on your network is to point an IPv6-capable NetFlow v9 monitoring tool at one of the key devices in your network and set up an IPv6 traffic filter to see if anything shows up. This could be on a campus or WAN core router, or in the following example, some key branch routers. In this example, LiveAction 2.0 is configured to collect NetFlow v9 exports that have been set up on two branch routers. 2

5 This IPv6 filter is also available in the device view, which we have selected here: We can quickly ascertain from the integrated table and graphical views that we do have IPv6 traffic on this network device. If this traffic is unexpected we might want to investigate further to find the exact end station that is the source of this traffic. If the IPv6 traffic is not part of a planned deployment, it s likely that your IP address management systems won t be able to tell you what end station is responsible for the traffic. By using LiveAction s NetFlow v9 support we can immediately pinpoint the source MAC addresses of the traffic flows. This particular router has been set up with the proper MAC address export, so the information is right there in the table: Source MAC is reported along with IPv6 addresses to help you identify the end station responsible for the traffic. 3

6 Since tunneled IPv6 traffic can be a potential security issue, this is a good time to look for such traffic. LiveAction has a built in Teredo filter to help you pinpoint tunneled IPv6 packets. Just select the Teredo filter from the display filter dropdown list: If any of this tunneled traffic is unexpected, you should investigate it thoroughly and security provisions taken to block tunneled traffic from entering and exiting your network. Make sure your security devices support IPv6 and that your policies are appropriately configured. These same techniques can be used with LiveAction s historical reporting capability if forensic investigations need to be performed on saved historical traffic flows. In the device view you can access historical capability from the toolbar. Then select the calendar day and time of interest and proceed with your investigation. Use the Playback tool when you want to visualize the traffic flows traversing the router. Choose the calendar date and time and step through or playback the traffic flows. The Top Analysis tool is helpful to do bulk examination of traffic for a given time frame. 4

7 Similarly, for the system view, you can display all the system-level traffic flows within a given time period. This is helpful when you need to track down flows end-to-end to determine where they may have originated or terminated within your network. On the system view, display all the flows within a given timeframe by using the calendar functions 5

8 3. Conclusion IPv6 deployments are inevitable for today s public and private networks, and depending on your company s priorities, deployments may come sooner rather than later. Even if IPv6 deployments in your enterprise are not expected in the foreseeable future, now is the time to understand unexpected IPv6 traffic running on your networks, what potential risks that traffic may pose, and to ensure that your security and management tools are providing the IPv6 support you need. LiveAction 2.0 and above from ActionPacked! Networks provides the IPv6 traffic visibility that is essential for understanding and troubleshooting traffic that might otherwise go unnoticed. In addition to its through-the-network traffic flow visibility, LiveAction all-in-one QoS software provides the monitoring, analysis, troubleshooting and configuration capabilities needed through all phases of network QoS management. Whether you need IPv4/IPv6 traffic visibility or QoS management capabilities, we invite you to download the LiveAction trial and put its CCIE power at your fingertips. In addition to our trial software, more in-depth white papers, pocket guides, application notes and videos on using LiveAction are available via our website at Copyright 2012 ActionPacked! Networks. All rights reserved. ActionPacked!, the ActionPacked! logo and LiveAction are trademarks of ActionPacked! Networks. Other company and product names are the trademarks of their respective companies. ActionPacked! Networks 155 Kapalulu Place, Suite 222 Honolulu, HI