Researcher Demonstrates Silent IPv6 Hijack Attack on Enterprise Network and Fix

A security researcher built a simulated dual-stack enterprise network using GNS3 to expose a critical but often overlooked IPv6 vulnerability. The project demonstrated how SLAAC — IPv6's Stateless Address Autoconfiguration protocol — can be abused by an attacker on the same network segment to silently intercept all IPv6 traffic without any privileges on victim machines. Using only a Python script running on Kali Linux, the researcher broadcast forged Router Advertisement packets that redirected traffic from multiple hosts through an attacker-controlled gateway. The attack was fully mitigated by deploying RA Guard, a Cisco switch policy that blocks unauthorized Router Advertisement messages with no changes required on victim devices. The project highlights that enterprises with strong IPv4 controls may still be exposed if IPv6 traffic on the same physical links goes unmonitored and unprotected.