How to detect Teredo?

  • 1
  • Question
  • Updated 8 years ago
  • Answered
Can I detect Teredo on my network?
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes

Posted 8 years ago

  • 1
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes
Official Response
Teredo is a platform-independent protocol developed by Microsoft, which is enabled by default in Windows Vista. Teredo provides a way for nodes located behind an IPv4 NAT to connect to IPv6 nodes on the Internet. However, by tunneling IPv6 traffic over IPv4 UDP through the NAT and directly to the end node, Teredo raises some security concerns. Primary concerns include bypassing security controls, reducing defense in depth, and allowing unsolicited traffic. Additional security concerns associated with the use of Teredo include the capability of remote nodes to open the NAT for themselves, benefits to worms, ways to deny Teredo service, and the difficulty in finding all Teredo traffic to inspect.

For more discussion on ths issue see http://www.securiteam.com/securityrev...

At the moment you can use your LANGuardian to check for Teredo activity on your network as follows: Run the report -> Events by Signature -> and check for the events Policy :: Teredo :: Inbound Traffic Detected Policy :: Teredo :: Outbound Traffic Detected