IRDP Spoofing Explained: How It Works, How It Differs From ICMP Redirect, and How to Defend

Key takeaways

• IRDP (RFC 1256) uses unauthenticated ICMP router advertisements, type 9.
• It needs local access and a victim that actually listens to IRDP, so it is rare today.
• It is different from ICMP redirect (type 5) and from ARP spoofing.
• Disable IRDP, ignore redirects where not needed, and protect access ports.

What is IRDP?

The ICMP Router Discovery Protocol (IRDP) lets a host find routers on its subnet without being configured by hand. Routers send ICMP Router Advertisement messages (type 9), and hosts can ask for them with Router Solicitation (type 10). It is defined in RFC 1256 from 1991: RFC 1256.

The weakness is the same one found in many old protocols: the advertisement is not authenticated. A host that listens to IRDP will believe any router advertisement that arrives on its link.

What IRDP spoofing means

IRDP spoofing is when someone on the same network segment sends forged router advertisements so that listening hosts adopt a different device as their default gateway. Traffic then passes through that device. From there it can be read, changed or dropped, which makes it a man-in-the-middle (MITM) or denial-of-service attack.

Two conditions must hold: the attacker must be on the local segment, and the victim must actually act on router advertisements. That second condition is why this attack is rare today.

Is it still a real risk?

For most networks, it is low. Many modern operating systems do not use IRDP by default, and routers normally have it switched off. It is more of a risk on old systems, unusual embedded devices and networks where IRDP was turned on deliberately. Do not assume either way for your estate: check.

• Linux: the kernel does not process IRDP by itself. A router discovery client daemon would have to be running.
• Cisco IOS: IRDP is configured per interface and is not on unless an administrator enables it with ip irdp.
• Windows: router discovery is a per-interface setting that can be inspected with netsh interface ipv4 show interface. Behaviour differs between versions, so test your own builds.

Do not confuse it with ICMP redirect

An earlier version of this article mixed up two different things. ICMP redirect (type 5) is a message from a router telling a host that a better next hop exists for a destination. It is a separate mechanism with a separate fix.

The IPv6 version of the same idea is a rogue Router Advertisement, which is defended with RA Guard on switches.

How do you check your own lab?

Do this on a VM or machine you own. The aim is to find out what your systems will accept, not to attack anything.

1. Check redirect handling on Linux: sysctl net.ipv4.conf.all.accept_redirects and net.ipv4.conf.all.secure_redirects. A value of 0 means redirects are ignored.
2. Check whether a router discovery daemon is running: systemctl list-units | grep -i rdisc or ps aux | grep -i rdisc.
3. On a Windows lab VM, view the interface settings with netsh interface ipv4 show interface and look at the router discovery line.
4. Capture traffic in Wireshark on the lab segment with the filter icmp.type == 9 || icmp.type == 10 || icmp.type == 5 and see whether any advertisements or redirects appear. On a normal network you will usually see none.

Testing for this against a network you do not own, or without written approval, is illegal under the IT Act. Keep experiments inside a lab segment.

Prevention

1. Do not run IRDP. Disable it on routers (no ip irdp on Cisco interfaces) and do not install router discovery clients on servers.
2. Use a configured default gateway through DHCP or static settings, especially on servers and critical hosts.
3. Ignore redirects. On Linux set net.ipv4.conf.all.accept_redirects=0 and net.ipv4.conf.all.send_redirects=0 on hosts that do not need them. Persist the change in /etc/sysctl.d/.
4. Control the access layer. Port security, DHCP snooping, dynamic ARP inspection and RA Guard limit what an untrusted port can send.
5. Segment the network. Keep guest and untrusted devices off the segments where servers live.
6. Encrypt traffic. HTTPS, SSH and VPNs mean an intercepted stream is far less useful.
7. Monitor. Alert on unexpected ICMP type 9 or type 5 messages in IDS or flow data.

Detection signs

• A host's default gateway changes without a DHCP or admin change.
• Route tables show host routes pointing to an unexpected next hop.
• Latency or traceroute shows an extra hop before the usual gateway.
• Router advertisements arrive from an address that is not a known router.

Why learn about it?

IRDP is a clean example of an unauthenticated discovery protocol. The same lesson applies to ARP, DHCP, IPv6 router advertisements and many others: if a device will believe any message on the wire, the access layer has to be protected. Knowing this helps in CEH, CCNA security topics and network design work.

Next steps

For hands-on attack and defence practice in a lab, see the VAPT course. Related reading: understanding man-in-the-middle attacks and MAC spoofing and how to prevent it.