IPv6 Monitoring and Flow Detection

Abstract: IPv6 Privacy extensions, implemented in major operating systems, hide user’s identity by using a temporary and a randomly generated IPv6 addresses rather than using the former, EUI-64 format where the MAC address is part of the IPv6 address. This solution for privacy has created a problem for network administrators to back-trace an IPv6 address to a specific MAC address, since the temporary IP address used once by the node is removed from the interface after a period of time. An IPv6 Ethernet test bed is setup to investigate IPv6 implementation dynamics in Windows 7 and Ubuntu10.04 operating systems. The testbed is extended to investigate the effects of temporary IPv6 addresses due to IPv6 privacy extensions on the on-going sessions of different applications including ping, File Transfer Protocol (FTP) and video streaming (HTTP and RTP). On the basis of the knowledge obtained from investigations about dynamics of IPv6 privacy extensions, this work proposes Internet Protocol version 6 Host Tracking (IPv6HoT), a web based IPv6 to MAC mapping solution. IPv6HoT uses Simple Network Management Protocol (SNMP) to forward IPv6 Neighbor table from routers to Network Management Stations (NMS). This thesis work provides guidelines for configuring IPv6 privacy extensions in Ubuntu10.04 and Windows 7; the difference of implementation between these two operating systems is also presented in this work. The results show that temporary IPv6 addressing has a definite effect on the on-going sessions of video streaming and FTP applications. Applications running as server on Temporary IPv6 address encountered more frequent on-going session interruptions than applications running as a server over public IPv6 address. When temporary IPv6 addresses were configured to host FTP and video streaming applications, their on-going sessions were permanently interrupted. It is also observed that LFTP, a client FTP application, resumes an interrupted session.