Blocking IPv6 Neighbor Discovery Attacks with MLD Snooping on Switches

In my environment, I’ve seen more IPv6-based neighbor discovery attacks lately — especially in networks where RA guard isn’t deployed on access switches. Attackers spoof router advertisements to redirect traffic or perform denial-of-service. While RA guard is the ideal defense, many older or budget switches don’t support it. That’s where MLD snooping comes in. It’s not just for multicast efficiency; when properly configured, it can drop unsolicited neighbor advertisement and router solicitation packets that don’t match known multicast groups.

Why MLD snooping helps with ND security

MLD snooping listens to Multicast Listener Discovery reports to learn which ports need IPv6 multicast traffic. By default, it floods unknown multicast — but you can change that behavior. When you configure the switch to drop unregistered multicast packets, it effectively blocks unsolicited ND packets like fake RAs, since they’re sent to link-local multicast addresses (ff02::1 for nodes, ff02::2 for routers). If no host has reported interest in those groups via MLD, the switch drops the packet.

This isn’t a full replacement for RA guard, but in networks where you can’t enable RA guard on every access port, it’s a practical mitigation. I’ve used this on Cisco Catalyst switches and Linux bridges to stop lab-based ND spoofing tests from succeeding.

Enabling MLD snooping on Cisco switches

On Cisco IOS, you enable MLD snooping globally and optionally per VLAN. Then, you configure the switch to drop unregistered multicast traffic instead of flooding it.

Switch(config)# ipv6 mld snooping
Switch(config)# ipv6 mld snooping vlan 10
Switch(config)# ipv6 mld snooping vlan 10 robustness-variable 2
Switch(config-if)# ipv6 mld snooping immediate-leave

To drop unregistered multicast (key for security):

Switch(config)# ipv6 mld snooping vlan 10 report-suppression
Switch(config)# no ipv6 mld snooping vlan 10 flood-unregistered

The no flood-unregistered line is critical — it tells the switch to drop MLD traffic for groups no host has joined. Since attacker-generated RA/NA packets aren’t preceded by a valid MLD report, they get dropped.

Configuring MLD snooping on Linux bridges

If you’re using Linux bridges (e.g., in Proxmox or KVM), you can enable MLD snooping via sysfs or bridge utilities. First, check if it’s supported:

# cat /sys/module/bridge/parameters/mld_snooping
1

If it returns 1, the feature is available. Enable it on a bridge:

# echo 1 > /sys/devices/virtual/net/br0/bridge/mld_snooping
# echo 1 > /sys/devices/virtual/net/br0/bridge/mld_snooping_querier

To drop unregistered multicast (similar to Cisco):

# echo 0 > /sys/devices/virtual/net/br0/bridge/mld_snooping_multicast_router

This sets the multicast router port behavior to ignore unregistered traffic. You can verify with brctl showstp br0 or by monitoring tcpdump -i br0 ip6 — rogue RA packets should no longer appear on access ports.

Monitoring and validation

After enabling, test with a tool like scapy or thc-ipv6 to send fake RA packets. Use tcpdump to confirm they’re not forwarded:

# tcpdump -i eth0 -vv ip6[40] = 134 and ip6[40] = 135

Watch for drops in switch logs or bridge counters. On Cisco, check:

Switch# show ipv6 mld snooping vlan 10
Switch# show ipv6 mld snooping address vlan 10

On Linux, monitor bridge multicast tables:

# bridge mdb show dev br0

If the fake RA packets don’t show up in the MDB and aren’t forwarded, the mitigation is working.

Limitations and best practices

MLD snooping alone won’t stop all ND attacks — for example, it doesn’t protect against redirect spoofing or neighbor cache flooding if the packet somehow matches a known group. Always pair it with:

RA guard where supported (distribution/core layers)
DHCPv6 guard or trusted ports
Port security or 802.1X to limit rogue devices
Regular neighbor discovery monitoring via ndp -an or ip -6 neigh

I’ve written before about securing ARP on Linux bridges — similar principles apply: harden the layer where you can, even if the ideal tool isn’t available. (See: [Linux Köprüsünde ebtables ile ARP Spoofing Korumasını Otomatikleştirme](https://furkanikkan.com/urun/linux-koprusunde-ebtables-ile-arp-spoofing-korumasini-otomatiklestirme-77))

Final thoughts

You don’t need enterprise-grade features on every switch to get basic IPv6 ND protection. Enabling MLD snooping and blocking unregistered multicast is a low-overhead, widely supported step that blocks a large class of rogue RA attacks. It’s not sexy, but in a hardened network, these small layers add up. Test it in a lab first — especially if you have IPv6-only devices or multicast-heavy apps — but don’t overlook it as a practical defense-in-depth measure.

Cover image: Unknown · CC0 (Openverse / kamu malı) · https://www.rawpixel.com/image/6038427/photo-image-public-domain-technology-line