NDPMon

The Neighbor Discovery Protocol[1] Monitor (NDPMon) is a diagnostic software application used by Internet Protocol version 6[2] network administrators for monitoring ICMPv6 packets.[3] NDPMon observes the local network for anomalies in the function of nodes using Neighbor Discovery Protocol (NDP) messages, especially during the Stateless Address Autoconfiguration.[4] When an NDP message is flagged, it notifies the administrator by writing to the syslog or by sending an email report. It may also execute a user-defined script. For IPv6, NDPMon is an equivalent of Arpwatch for IPv4, and has similar basic features with added attacks detection.[5]

NDPMon runs on Linux distributions (available in Debian repositories[6] and in Ubuntu 12.10[7]), Mac OS X, FreeBSD (available as port[8]), NetBSD and OpenBSD. It uses a configuration file containing the expected and valid behavior for nodes and routers on the link. This includes the routers' addresses (MAC and IP) and the prefixes, flags and parameters announced.

NDPMon also maintains an up-to-date a list of neighbors on the link and watches all advertisements and changes. It permits tracking the usage of cryptographically generated interface identifiers or temporary global addresses when Privacy extensions are enabled (default behavior in Ubuntu and Windows for example).

NDPMon is free software under the GNU LGPL 2.1.[9]

Alerts and reports

NDPMon generates various reports and alerts, including:

Available plugins

A set of plugins are available for NDPMon:

See also

References

  1. RFC 4861, Neighbor Discovery for IP version 6 (IPv6), T. Narten et al. (September 2007)
  2. RFC 2460 Internet Protocol, Version 6 (IPv6) Specification S. Deering, R. Hinden (December 1998)
  3. Monitoring the Neighbor Discovery Protocol F. Beck, T. Cholez, I. Chrisment and O. Festor - The Second International Workshop on IPv6 Today - Technology and Deployment - IPv6TD 2007 (2007)
  4. RFC 4862 IPv6 Stateless Address Autoconfiguration, S. Thomson, T. Narten, T. Jinmei (September 2007)
  5. RFC 3756 IPv6 Neighbor Discovery (ND) Trust Models and Threats P. Nikander, Ed.,J. Kempf, E. Nordmark (May 2004)
  6. Debian packages
  7. Ubuntu binary package
  8. FreeBSD port
  9. See COPYING in the tarball.

External links

This article is issued from Wikipedia - version of the Thursday, December 19, 2013. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.