Adds test about ICMPv6 kill router

diff --git a/tests/ipv6-evasion/ipv6-kill-router-gateway/README.md b/tests/ipv6-evasion/ipv6-kill-router-gateway/README.md
new file mode 100644 (file)
index 0000000..4fa620f
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-kill-router-gateway/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Detect an attack where the given router is removed as a gateway from all SLAAC configured systems.
+
+# PCAP
+
+Pcap from https://redmine.cs.uni-potsdam.de/projects/pcap/files

diff --git a/tests/ipv6-evasion/ipv6-kill-router-gateway/kill_router6.pcap b/tests/ipv6-evasion/ipv6-kill-router-gateway/kill_router6.pcap
new file mode 100644 (file)
index 0000000..fcc3a02
Binary files /dev/null and b/tests/ipv6-evasion/ipv6-kill-router-gateway/kill_router6.pcap differ

diff --git a/tests/ipv6-evasion/ipv6-kill-router-gateway/test.rules b/tests/ipv6-evasion/ipv6-kill-router-gateway/test.rules
new file mode 100644 (file)
index 0000000..d958852
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-kill-router-gateway/test.rules
@@ -0,0 +1,2 @@
+# It detects Router Advertisement messages (ie itype:134) that are send with a lifetime of zero (ie content:"|00 00|") and can be misused to signal to hosts that a particular router is going down and it should be removed from routing tables.
+alert icmpv6 any any -> any any (itype:134; icmpv6.hdr; content:"|00 00|"; offset:6; depth:2; sid:1;)

diff --git a/tests/ipv6-evasion/ipv6-kill-router-gateway/test.yaml b/tests/ipv6-evasion/ipv6-kill-router-gateway/test.yaml
new file mode 100644 (file)
index 0000000..2ba3bbe
--- /dev/null
+++ b/tests/ipv6-evasion/ipv6-kill-router-gateway/test.yaml
@@ -0,0 +1,11 @@
+requires:
+    features:
+        - HAVE_LIBJANSSON
+    min-version: 6
+
+checks:
+    - filter:
+        count: 4
+        match:
+            event_type: alert
+            alert.signature_id: 1