Rethinking IPv6 Defense: A Unified Edge-Centric Zero-Trust Data-Plane Architecture

Abstract: IPv6 dependability is increasingly inseparable from IPv6 security: Neighbor Discovery (ND), Router Advertisements (RA), and ICMPv6 are essential for correct operation yet expose a broad attack surface for spoofing and flooding. Meanwhile, IPv6's massive address space breaks per-IP reputation and makes many defenses either non-scalable or narrowly scoped (e.g., only internal threats, only RA abuse, or only volumetric floods). We propose a zero-trust edge architecture implemented in a single programmable data-plane pipeline that unifies four modules: external spoofing, internal spoofing, external flooding, and internal flooding. A key design choice is to enforce identity plausibility before rate plausibility: stateless per-packet validation filters spoofed traffic early so that time-window statistics for flooding operate on credible identities. We outline a concrete P4 design (prefix Hop-Limit bands, DAD-anchored address-port bindings, and Count-Min Sketch windowed counting) and evaluate it across a systematic 15-scenario suite spanning single-, dual-, and multi-vector compositions. We report results from a BMv2 prototype and validate the same pipeline on a Netronome NFP-4000 SmartNIC, and we discuss limitations and open directions.

• The paper introduces a unified P4 data-plane architecture that places stateless identity checks before Count-Min Sketch rate checks to detect external and internal IPv6 spoofing and flooding in one pipeline.
• The architecture combines prefix-level Hop Limit validation, ND-derived address-to-port bindings, Bloom-filter safeguards, and differentiated unicast/multicast thresholds to limit false positives and state exhaustion.
• SmartNIC evaluation across 15 single-, dual-, and multi-vector scenarios achieved 100% precision, 98.32–100% recall, and 99.60% average F1, while adaptive thresholds, heuristic evasion, and production-scale deployment remain open challenges.

The paper presents a unified, edge-centric zero-trust defense architecture for IPv6 networks, implemented entirely within a single programmable data-plane pipeline (2602.08891). The work addresses a structural gap in prior defenses: most programmable-switch mitigations address only one attack dimension (spoofing or flooding), target only internal adversaries, or assume per-address state that is infeasible at IPv6 scale. The proposed design unifies four mitigation modules—external spoofing, internal spoofing, external flooding, and internal flooding—in one pass through a P4 pipeline, and is validated on both BMv2 emulation and a Netronome NFP-4000 SmartNIC.

Motivation and threat model

The authors ground the design in three structural properties of IPv6 that defeat conventional defenses. First, ICMPv6 and Neighbor Discovery (ND) are operationally essential—address resolution, SLAAC, router discovery, reachability detection—so indiscriminate filtering breaks connectivity while leaving a broad spoofing/flooding surface. Second, the address-space explosion makes per-IP reputation brittle: attackers rotate addresses cheaply via SLAAC or temporary addresses, while defenders cannot store stable mappings for billions of identifiers. Third, adversaries operate on both planes: external Internet-side sources mount floods and spoofed traffic, while compromised internal hosts abuse ND/ICMPv6 against local services. Modern attacks increasingly compose these vectors so traffic appears benign at the granularity targeted by conventional filters.

The threat model assumes a trusted edge switch connecting an internal IPv6 domain to upstream networks. Adversaries may spoof source addresses and manipulate Hop Limit (HL), flood at high rates including stealthy bursts, coordinate as DDoS with time-varying patterns, and attempt data-plane state exhaustion via address churn on an internal port. The stated goals are high-precision filtering of externally spoofed packets with implausible HL, high-precision filtering of internally spoofed packets violating port bindings, bounded-delay flood detection, and minimal disruption to benign IPv6 operation.

Architecture: identity before rate

A central design choice is enforcing identity plausibility before rate plausibility. Spoofing checks are per-packet and stateless; flooding checks require windowed state via Count-Min Sketch (CMS) counters. Ordering the pipeline this way ensures rate statistics operate only over credible identities, preventing spoofed traffic from inflating counters or fragmenting apparent sources—an explicit defense against poisoning the sketch-based statistics.

External spoofing uses prefix-level HL plausibility rather than per-host hop-count tables. A longest-prefix-match table maps each source prefix $\pi$ to an acceptable arrival-HL interval $[HL_{\min}(\pi), HL_{\max}(\pi)]$; packets whose observed HL falls outside the band are dropped. The rationale is that attackers forging arbitrary prefixes cannot match the arrival-HL range induced by the legitimate upstream path. This trades the precision of IPv4-style hop-count filtering (e.g., NetHCF) for scalability at /32–/48 granularity.

Internal spoofing anchors address–port bindings in ND behavior: the first observed Duplicate Address Detection / Neighbor Solicitation for an unseen address registers a binding to the ingress port, and subsequent packets claiming that address must arrive on the bound port. To resist state-exhaustion via address churn, learning is gated by three Bloom-filter bitmaps and a per-port address cap $k$; ports exceeding the cap have new bindings rejected. A notable assumption here: the first-seen DAD/NS is treated as authoritative registration, which presumes no attacker can race a legitimate host's DAD on a different port.

External flooding applies windowed rate control per source prefix using a CMS with $d=3$ hash functions, dropping when the estimated count reaches threshold $\theta$. The threshold is parameterized from expected service rate $r$, active prefix count $n$, window $T_w$, and operator margin $\epsilon$: $\theta = (r/n)\cdot T_w \cdot (1+\epsilon)$.

Internal flooding tracks flow-granular rates ((src, dst) or 5-tuple keys), again via a 3-hash CMS, with deliberately tighter multicast thresholds ($[HL_{\min}(\pi), HL_{\max}(\pi)]$0), reflecting the disproportionate harm of multicast floods on LANs.

Evaluation results

Evaluation spans a systematic suite of 15 scenarios on a Mininet/BMv2 topology with five ISP-level /32 prefixes and heterogeneous downstream allocations (/48, /56, /64): scenarios 1–4 single-vector, 5–10 dual-vector, 11–15 multi-vector, culminating in a full four-vector combined attack. Benign traffic follows RFC 4861 guidance for ND rates plus web-like TCP SYN load.

Metric	BMv2 (avg)	SmartNIC NFP-4000 (avg)
Precision	up to 100%	100% in all 15 scenarios
Recall	as low as 83.40%	98.32–100%
Accuracy	90.45–98.10%	98.48–100%
Average F1	94.26%	99.60%

Two results stand out. On SmartNIC hardware, precision is 100% across every scenario—including the full four-vector composition—with recall never below 98.32%, indicating the false-positive cost of the HL-band and binding checks is negligible under the tested benign workloads. Second, multi-vector composition does not degrade SmartNIC detection: the full-combination scenario scores F1 = 99.55%, comparable to single-vector cases, which supports the paper's claim that unified pipelines remain dependable under composed adversaries. The consistent gap between BMv2 (average F1 94.26%, recall down to 83.40% on internal spoofing) and hardware is attributed by the authors to software timing jitter affecting window/threshold boundaries—a plausible explanation, though it also implies detection behavior near thresholds is timing-sensitive by construction.

Limitations and open questions

The authors are candid about several constraints. Thresholds are static and can be brittle under diurnal workload shifts; they suggest a lightweight control-plane agent that learns baselines and adapts $[HL_{\min}(\pi), HL_{\max}(\pi)]$1, but this is future work rather than an evaluated component. HL plausibility is heuristic, not cryptographic—it depends on the operator supplying accurate prefix-to-HL-band mappings and could be evaded by an adversary who knows or probes the legitimate band for a claimed prefix. SmartNIC resource limits bound parsed headers and metadata (~820 B with alignment overhead in their setup), so richer per-packet features would require recirculation or multi-pass designs with attendant throughput costs. Finally, the evaluation is confined to an emulated topology; production-scale prefix counts and churn dynamics remain unmeasured, leaving open how CMS sizing, Bloom-filter capacity, and the per-port binding cap $[HL_{\min}(\pi), HL_{\max}(\pi)]$2 behave under realistic population sizes.

Conclusion

The paper contributes a coherent zero-trust edge architecture for IPv6 that unifies internal/external spoofing and flooding mitigation in a single P4 pipeline, with an ordering principle—stateless identity checks preceding stateful rate enforcement—that makes flood statistics robust to source forgery. Hardware validation on the Netronome NFP-4000 yields 100% precision and near-perfect recall across a 15-scenario multi-vector suite, demonstrating feasibility at line-rate targets. Its principal open questions concern adaptive thresholding, hardening of the HL-band heuristic against informed adversaries, and scaling behavior beyond emulated topologies.