Which behavior is associated with NDP DoS?

• A. Spoofing non-existent addresses in NS requests
• B. Sending multiple DADs to NS requests
• C. Spoofing address in the NS request
• D. Spoofing a Router Advertisement (RA) to redirect traffic

Answer: (B)

NDP DoS is most effectively carried out by exhausting the resources used for address validation in IPv6 neighbor discovery. When a host configures a new IPv6 address, it performs Duplicate Address Detection by sending a Neighbor Solicitation to the targeted address’s solicited-node multicast. If an attacker floods the network with a large volume of these DAD-related messages, the devices on the link have to process many NS/NA exchanges and maintain numerous neighbor cache entries. This traffic load can overwhelm CPUs, memory, and processing capacity, leading to degraded performance or denial of service for legitimate traffic.

So, sending multiple DAD messages to check many addresses directly targets the DAD process and can cause resource exhaustion, which is why it’s the behavior associated with NDP DoS. Spoofing NS or NS requests, or spoofing Router Advertisements, can enable other types of attacks, but they don’t describe the DoS effect that comes from overwhelming the DAD mechanism.