SANS Stay Sharp Training - Live Online: Quickly sharpen your skills with 2-day management courses. Register now.


SEC546: IPv6 Essentials

Course Syllabus  ·  12 CPEs  ·   Lab Requirements
Access Period: 4 months  ·  Price: 2,800 USD  ·  Instructor: Staff

Excellent. I wish my network team would come to SANS instead of spending all their training at CISCO

Joseph Stetler, Clark County

I have a much better understanding of IPv6, what it offers when implemented properly, and how to analyze traffic generated.

Bradley Hoover, ExxonMobil

We are out of IPv4 addresses. ISPs worldwide will have to rapidly adopt IPv6 over the next years to grow, in particular as mobile devices require more and more address space. Already, modern operating systems implement IPv6 by default. Windows 7, for example, ships with Teredo enabled by default. This course is designed not just for implementers of IPv6, but also for those who just need to learn how to detect IPv6 and defend against threats unintentional IPv6 use may bring.

IPv6 is currently being implemented at a rapid pace in Asia in response to the exhaustion of IPv4 address space, which is most urgently felt in rapidly growing networks in China and India. Even if you do not feel the same urgency of IP address exhaustion, you may have to connect to these IPv6 resources as they become more and more important to global commerce.

The Security Impact of IPv6

Implementing IPv6 should not happen without carefully considering the security impact of the new protocol. Even if you haven't implemented it yet, the ubiquitous IPv6 support in modern operating systems easily leads to unintentional IPv6 implementation, which may put your network at risk. In this course, we will start out by introducing the IPv6 protocol, explaining in detail many of its features like the IPv6 header, extension headers and auto configuration. Only by understanding the design of the protocols in depth will it be possible to appreciate the various attacks and mitigation techniques. The course will address how to take advantage of IPv6 to re-think how to assign addresses in your network and how to cope with what some suggest is the biggest security problem in IPv6: no more NAT! IPv6 doesn't stop at the network layer. Many application layer protocols change in order to support IPv6, and we will take a close look at protocols like DNS, DHCPv6 and more.

What You Will Learn

The course covers various security technologies like firewalls and Intrusion Detection and Prevention Systems (IDS/IPS). It also addresses the challenges in adequately configuring these systems and makes suggestions as to how apply existing best practices to IPv6. Upcoming IPv6 attacks are discussed using tools like the THC IPv6 attack suite and others as an example.

This course will introduce network administrators and security professionals to the basic concepts of IPv6. While it is an introduction to IPv6, it is not an introduction to networking concepts. You should understand and be aware of the basic concepts of IPv4, and networking in general. It is an ideal refresher if you took SEC503 Intrusion Detection in Depth. However, you do not need to know IPv4 in the full detail in which it is presented in SEC503. The networking and IPv4 principles taught in SEC401 Security Essentials should prepare you for this course.


Checkout the collection of free IPv6 Tools and Videos at the Internet Storm Center (ISC)!

Course Syllabus


This section introduces network administrators and security professionals to the basic conceptsof IPv6.

CPE/CMU Credits: 6


This section addresses the challenges in adequately configuring these systems and makes suggestions as to how apply existing best practices to IPv6. Upcoming IPv6 attacks are discussed using tools like the THC IPv6 attack suite and others as an example.

CPE/CMU Credits: 6

Additional Information

Students are required to bring a laptop with the following configuration:


  • DVD Drive
  • 60 GB Free Disk space
  • 8 GB RAM is required


  • Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.
  • It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
  • Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules.
  • Download and install VMware Workstation or VMware Fusion on your system prior to the start of the class.
  • If you own a licensed copy of VMware, make sure it is at least VMware Workstation Pro 15+, VMware Fusion 11+.
  • If you do not own a licensed copy of VMware, download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website. Download and install either VMware Workstation Pro 15.5.x, VMware Player 15.5.x or Fusion 11.5.x or higher versions before class.
  • Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.
  • VMware Workstation Pro and VMware Player on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions in this document.

Laptops running Windows or Linux should have VMware Workstation or Player. VMware Server may NOT work. OS X users should have VMware Fusion.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact

In this course, you will receive the following:

  • MP3 audio files of the complete course lecture

Author Statement

The first time I heard about IPv6, I heard about things like "unlimited address space", and "all your traffic will be encrypted". However, I knew little about the meaning of these statements. As I delved deeper into IPv6 and started to deploy it in some of my networks, I found that much of what was said about IPv6 was more myth than reality. Implementing IPv6, and in particular securing IPv6, turned out to be a much larger challenge then I originally planned. While many networks are already "IPv6 ready", you as a network administrator are likely not. This course should make you "IPv6 ready" as well.

- Johannes Ullrich

Price Options
2,800 USD