CAS-001 · Question #419
A security administrator was doing a packet capture and noticed a system communicating with an address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into…
The correct answer is A. Investigate the network traffic and block UDP port 3544 at the firewall. The 2001::/32 prefix belongs to Teredo tunneling, which encapsulates IPv6 traffic over IPv4 using UDP port 3544. The best response is to investigate the traffic and block that port at the firewall.
Question
A security administrator was doing a packet capture and noticed a system communicating with an address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network. Which of the following is the BEST course of action?
Options
- AInvestigate the network traffic and block UDP port 3544 at the firewall
- BRemove the system from the network and disable IPv6 at the router
- CLocate and remove the unauthorized 6to4 relay from the network
- DDisable the switch port and block the 2001::/32 traffic at the firewall
How the community answered
(39 responses)- A62% (24)
- B5% (2)
- C21% (8)
- D13% (5)
Why each option
The 2001::/32 prefix belongs to Teredo tunneling, which encapsulates IPv6 traffic over IPv4 using UDP port 3544. The best response is to investigate the traffic and block that port at the firewall.
The 2001::/32 prefix is assigned to Teredo, a tunneling mechanism that transports IPv6 packets over IPv4 UDP using port 3544. Since no IPv6 routing exists on this network, a host communicating with this prefix is likely using Teredo to bypass controls. Investigating the traffic and blocking UDP 3544 at the firewall stops this tunneling method without requiring broader network changes.
Disabling IPv6 at the router is irrelevant because Teredo tunnels IPv6 inside IPv4 UDP packets, bypassing the router's IPv6 stack entirely.
The 2001::/32 prefix indicates Teredo, not 6to4; 6to4 uses the 2002::/16 prefix, making this identification and the proposed action incorrect.
Disabling the switch port is overly disruptive and premature without investigation, and blocking 2001::/32 at the firewall alone does not address the underlying Teredo UDP transport mechanism.
Concept tested: Teredo IPv6 tunneling detection and mitigation
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/ipv6/teredo-overview
Topics
Community Discussion
No community discussion yet for this question.