Attack tree (IPv4 and IPv6)¶

1. Protocol-Specific Attacks [OR]

    1.1 IPv4-Specific Attacks [OR]
    
        1.1.1 IP Fragmentation Attacks [OR]
        
            1.1.1.1 Teardrop attacks causing kernel panics
            1.1.1.2 Overlapping fragment firewall evasion
            
        1.1.2 ICMP Abuse [OR]
        
            1.1.2.1 Smurf attacks (amplification via broadcast)
            1.1.2.2 ICMP tunnelling for data exfiltration
            
        1.1.3 ARP Spoofing/Poisoning [OR]
        
            1.1.3.1 Gratuitous ARP for Man-in-the-Middle
            1.1.3.2 ARP cache poisoning for DoS
            
        1.1.4 NAT Abuse [OR]
        
            1.1.4.1 NAT state table exhaustion attacks
            1.1.4.2 NAT traversal techniques for unauthorised access
            
    1.2 IPv6-Specific Attacks [OR]
    
        1.2.1 SLAAC & RA Attacks [OR]
        
            1.2.1.1 Rogue Router Advertisements (MitM)
            1.2.1.2 RA flooding for DoS
            
        1.2.2 NDP Exploitation [OR]
        
            1.2.2.1 Neighbour Advertisement spoofing
            1.2.2.2 Duplicate Address Detection (DAD) DoS
                    
        1.2.3 Extension Header Abuse [OR]
            
            1.2.3.1 Firewall evasion using Hop-by-Hop options
            1.2.3.2 Resource exhaustion via complex header chains
            1.2.3.3 Covert channel via Traffic Class / Flow Label (exfiltrate information in unused header fields)
      
        1.2.4 Dual-Stack Attacks [OR]
        
            1.2.4.1 Bypassing IPv4 security via unmonitored IPv6
            1.2.4.2 Tunnelling IPv4 over IPv6 for evasion
            
    1.3 Protocol-Agnostic Attacks [OR]
    
        1.3.1 IP Spoofing & DDoS Amplification [OR]
        
            1.3.1.1 DNS/NTP reflection attacks
            1.3.1.2 TCP middlebox amplification (SYN-ACK)
            
        1.3.2 BGP Hijacking & Route Leaks [OR]
        
            1.3.2.1 Prefix hijacking for traffic interception
            1.3.2.2 Route leaks causing traffic blackholes
            
        1.3.3 TTL Expiry Attacks [OR]
        
            1.3.3.1 ICMP Time Exceeded flooding
            1.3.3.2 TTL-based resource exhaustion
            
        1.3.4 Geolocation Spoofing [OR]
        
            1.3.4.1 Proxy/VPN evasion of geo-blocks
            1.3.4.2 ASN spoofing for trust exploitation

Nitty gritty risk table¶

Attack Path	Technical Complexity	Resources Required	Risk Level	Notes
1.1.1.1 Teardrop attacks	Medium	Low	Medium	Classic DoS; mitigated on most systems.
1.1.1.2 Overlapping fragment firewall evasion	High	Medium	High	Needs careful crafting; firewall-specific.
1.1.2.1 Smurf attacks	Low	Medium	Medium	Low complexity, needs broadcast network.
1.1.2.2 ICMP tunnelling	Medium	Medium	Medium	For data exfiltration; requires stealth.
1.1.3.1 Gratuitous ARP (MitM)	Medium	Low	Medium	Effective on LANs; physical access often required.
1.1.3.2 ARP cache poisoning (DoS)	Low	Low	Low	Limited scope; easily detectable.
1.1.4.1 NAT table exhaustion	Medium	Medium	Medium	Targets network devices; resource-limited.
1.1.4.2 NAT traversal for unauthorised access	Medium	Medium	Medium	Exploits existing NAT behaviour; technical knowledge required.
1.2.1.1 Rogue RA (MitM)	High	Medium	High	Requires IPv6 knowledge; can intercept traffic.
1.2.1.2 RA flooding for DoS	Medium	Medium	Medium	Localised impact; network resources needed.
1.2.2.1 Neighbour Advertisement spoofing	High	Medium	High	Network-level attack; stealth varies.
1.2.2.2 DAD DoS	Medium	Medium	Medium	Can disrupt IPv6 address assignment; requires network access.
1.2.3.1 Hop-by-Hop firewall evasion	High	Medium	High	Sophisticated; requires deep packet crafting.
1.2.3.2 Complex header resource exhaustion	High	Medium	High	Can cause device/network failure; technical expertise needed.
1.2.4.1 Bypassing IPv4 security via unmonitored IPv6	Medium	Medium	Medium	Exploits misconfiguration; easier in dual-stack networks.
1.2.4.2 Tunnelling IPv4 over IPv6	Medium	Medium	Medium	Requires network skill; detection depends on monitoring.
1.3.1.1 DNS/NTP reflection attacks	Medium	Medium	Medium	Classic DDoS; amplification multiplies effect.
1.3.1.2 TCP middlebox amplification	High	Medium	High	Needs specific network targets; effective but targeted.
1.3.2.1 BGP prefix hijacking	Very High	High	Very High	Requires access to routing infrastructure; high impact.
1.3.2.2 Route leaks causing blackholes	High	Medium	High	Misconfig-driven; limited but disruptive.
1.3.3.1 ICMP Time Exceeded flooding	Medium	Medium	Medium	Can congest network; limited to TTL expiry.
1.3.3.2 TTL-based resource exhaustion	Medium	Medium	Medium	Needs high packet rates; detectable.
1.3.4.1 Proxy/VPN geo evasion	Low	Low	Low	Simple; mainly circumvents restrictions.
1.3.4.2 ASN spoofing	High	Medium	High	Requires BGP knowledge; trickier than geo-spoofing.