IPB207: Flying Blind: Monitoring Might Not See IPv6

The episode features Ed Horley, Nick Boraglio, and Tom Coffin examining the state of IPv6 monitoring infrastructure. They identify multiple layers of problems: first, monitoring platforms often cannot ingest data streams via IPv6 or lack IPv6-aware endpoints; second, many platforms don't understand IPv6 packet structures and either ignore or mishandle the data; third, there is significant functional parity issues between IPv4 and IPv6 capabilities within the same monitoring system.

The hosts discuss how enterprise monitoring systems are deeply entrenched in organizational workflows, making platform replacement extremely difficult despite IPv6 shortcomings. They note that monitoring is often maintained by engineering teams without dedicated staff, and systems may have been in place for 20+ years with complex third-party dependencies and integrations. This creates vendor lock-in where organizations must wait for their existing vendor to add IPv6 support rather than switching platforms.

A major gap identified is event correlation across IPv4 and IPv6 protocols. While modern systems can correlate events across multiple IPv4 addresses to identify unified attack patterns, equivalent cross-protocol correlation between IPv4 and IPv6 is rare. This means security incidents or lateral movement exploiting both protocols may not be detected as a single coherent threat.

The hosts also discuss technical challenges specific to IPv6: extension headers are complex and often misunderstood, flow labels are increasingly used but not well-monitored, and many appliances silently filter IPv6 features by default without visibility. They note that tools lack sophisticated parsing logic to extract actionable insights from IPv6 extension headers and flow labels, often only reporting raw numeric values.

Another critical gap is device identity tracking. Traditional MAC-to-IP correlation used for device identification breaks down with IPv6 address rotation and temporary addresses. Modern networks support multiple IPv6 addresses per device (temporary, global unicast, ULA, link-local), making correlation significantly more complex. The hosts suggest that moving toward identity-based approaches using certificates may be necessary, but current monitoring systems haven't adapted.

Reporting capabilities represent the final leg of the monitoring stool. The hosts note that even where data collection works, the ability to generate useful reports about IPv6 traffic, client device types, address allocation methods, and time-based address mappings remains underdeveloped compared to IPv4 reporting.