What does a rogue IPv6 Router Advertisement win on an IPv4-only protected segment, and what does filtering it risk?

## Why the IPv4 controls see nothing DHCP snooping watches DHCP. Dynamic ARP inspection watches ARP. Neither protocol is involved in how an IPv6 host finds a router: that happens through Neighbour Discovery, where routers advertise themselves with ICMPv6 Router Advertisements and hosts derive addresses from the prefixes those advertisements carry. There is no ARP in IPv6 at all. So an adversary who sends advertisements is not defeating your first-hop controls; it is standing next to them. The outcome is worth stating precisely, because candidates routinely overstate it. A rogue advertisement does not overwrite anyone's IPv4 gateway, does not change an ARP entry, and does not add or alter a DHCP binding. It adds an IPv6 default router and a prefix. Every IPv4 counter stays clean. What moves is the traffic of dual-stacked hosts toward destinations that resolve to both families, because common resolver and connection behaviour tries the IPv6 path first or in parallel. ## The answer that costs candidates the question "We do not run IPv6 on that segment." The stack on the host does. A modern operating system ships with IPv6 enabled, will accept an advertisement on a link where the network team deployed nothing, and needs no DHCP whatsoever to build an address from the prefix it is handed. Disabling DHCPv6 changes nothing about this path. The only two real options are filtering advertisements at the access port or turning the stack off on every host, and the second is an endpoint fleet project owned by somebody else. ## What the defence costs The counter is a separate family of first-hop controls with their own configuration and their own trusted-port equivalents: - **RA guard** decides which ports are permitted to carry Router Advertisements, and discards them elsewhere. - **DHCPv6 guard** does the equivalent job for DHCPv6 server messages. - **Neighbour Discovery inspection**, sometimes with an IPv6 binding table of its own, gives source validation an IPv6 equivalent of the snooping table. None of these is switched on by enabling the IPv4 set, and each repeats the trusted-port mistake in a new place. Filter advertisements on the router-facing uplink by omitting it from the permitted list and you drop the genuine ones too. ## The failure is delayed, and that is what makes it hard Hosts do not lose IPv6 the instant advertisements stop. They coast: the router lifetime in the last advertisement counts down, and the prefix's preferred and valid lifetimes count down behind it. Connectivity therefore degrades an hour or more after the change, long after the window closed and everyone went home. Worse, clients that try both families and fall back after a short delay turn the outage into *slowness*, which gets reported to an application team rather than to the network team who made the change. Anyone rolling out RA filtering should say in advance which port carries the real router, and should watch that port's advertisements after the change rather than declaring success on silence. ## Reading the two advertisements On the wire the rogue is not malformed. It is a well-formed advertisement whose only distinguishing feature is the port it arrived on and, often, a default router preference set high so hosts prefer it over the real one. That is exactly why the control is positional: the switch cannot judge the contents, only the direction, in the same way it cannot judge a DHCP offer and only judges which port may carry one. ## What a strong answer covers Say what the rogue advertisement gains (a default router and a prefix for dual-stacked hosts) and what it does not touch (any IPv4 record). Say why disabling DHCPv6 is irrelevant. Name the separate controls and their port roles. Then name the price honestly: a second set of positional decisions, a delayed and easily misattributed failure mode when they are wrong, and an IPv6 path that in many estates is neither monitored nor tested, so nobody notices either the attack or the self-inflicted outage quickly.