IPV6TUNNEL - IPv6 Tunneled Traffic

Method description

The IPV6TUNNEL detection method detects the network devices that are communicating through a tunneled IPv6 protocol using Teredo or 6in4 protocol. The first parameter is ConnectionsThreshold, which restricts the minimum amount of connections between stations. With the UploadDataThreshold and DownloadDataThreshold parameters it is possible to limit the minimal amount of transferred data. Another parameter is IgnoreFailedConnections, which ignores unpaired communication.

This method consists of the following submethods:

• TeredoTunnel: Reports the usage of the Teredo tunnel that is used to provide IPv6 connectivity to devices that have only the IPv4 connectivity available.

• 6in4Tunnel: Reports the usage of the 6in4 tunneling protocol.

Method configuration

It is recommended to activate this method for all IP addresses. The right place for traffic monitoring is the central switch and the Internet connection line.

Method parameters

• ConnectionsThreshold: Threshold for a minimal count of connections using the IPv6 tunnels.

• UploadDataThreshold: Threshold for a minimal amount of data sent by the device using the IPv6 tunnels.

• DownloadDataThreshold: Threshold for a minimal amount of data received by the device using the IPv6 tunnels.

• IgnoreFailedConnections: Omission of connections without response.

Assigned filter

The filter is used for restricting source or destination IP addresses.

Interpretation of results

This method detects devices communicating using the IPv6 protocol that is tunneled through IPv4. It may indicate a bypass of security policy preventing IPv6 from being used.