Researchers turn permissive IPv6 tunnels into pulsing denial-of-service lines
Original title: Turning IPv6 tunnels into programmable delay lines for pulsing DoS
Forty-four scans found 1,909,440 forwarding tunnel hosts; a controlled test peaked above 180 times the average send rate inside 20 ms.
A USENIX Security 2026 paper describes TED, which uses open IP tunnels, nested paths, and IPv6 extension-header delays to bunch traffic into a short pulse. From June 2025 to January 2026, 44 scans covering about 3.7 billion IPv4 addresses and 20 million IPv6 Hitlist addresses saw 1,909,440 hosts forward traffic for six tunnel protocols. On six controlled dual-stack targets, more than 34,000 of 35,029 packets arrived within 0.25 seconds. The authors did not attack operational third-party services.
Unconfirmed: Counts are cumulative observations, not a live census, and success depends on spoofing, stable delays, and permissive paths.
- Protocol totals were 6to4 552,762, GRE 539,237, IPIP 526,577, IP6IP6 206,131, 4in6 80,052, and GRE6 4,681.
- Average extension-header survivability exceeded 70.9 percent on tested IPv6 tunnel hosts.
- 82.5 percent of combined one-way-delay errors on the six targets were within plus or minus 10 ms.
- The 180-times figure is temporal concentration, not byte amplification by the tunnels.
- Hundreds of responsive GRE and GRE6 addresses were in AS14593 prefixes associated with Starlink.
Impact: Short high-rate packet burst against a chosen target
| Product | Affected |
|---|---|
| 6to4 | — |
| 4in6 | — |
| GRE | — |
| GRE6 | — |
| IPIP | — |
| IP6IP6 | — |
- 1.Require peer validation so tunnel endpoints do not relay unauthorized encapsulated traffic.
- 2.Normalize or reject unexpected IPv6 extension-header chains at decapsulation.
- Malware
- TED
- Countries
- ChinaJapanGermanyUnited States
From the original article
5 min read at blog.apnic.net
IP tunneling encapsulates packets in outer IP headers to support IPv4/IPv6 coexistence, site interconnection, and VPN, mobile, and satellite networks. An endpoint removes the outer header and forwards the inner packet, but this transparency becomes a security blind spot when it contains a complex IPv6 Extension Header (EH) chain.
By blog.apnic.net via robalex · blog.apnic.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.