Turning IPv6 Tunnels into Programmable Delay Lines for Pulsing DoS

At USENIX Security 2026, a team from Tsinghua University presented TED — a Pulsing Denial-of-Service technique that turns overly permissive tunnel hosts into programmable delay lines. Unlike classic attacks that lean on DNS, NTP or CDNs, TED works at the network layer, combining nested paths, delays induced by IPv6 extension headers (EH), and precise packet scheduling.

Why revisit tunnel security

Many widely deployed tunnel protocols offer neither authentication nor encryption by default. An exposed host happily accepts encapsulated traffic from anyone and forwards the decapsulated inner packets, effectively acting as an open relay. Meanwhile, Fragment, Routing and Destination Options headers can be chained, yet routers, firewalls and tunnel implementations handle them inconsistently. Deeply nested headers frequently survive decapsulation without normalization.

Five stages of the attack

TED runs through discovery of forwarding hosts, EH-aware delay measurement, construction of valid nested paths within Path MTU limits, scheduling (each path's estimated delay is subtracted from a common arrival time) and, finally, injection. Packets leave fairly evenly, but those on long paths go first and short paths last, so they all converge at a chosen instant.

The authors are candid about the prerequisites: raw-packet capability, paths that permit nested encapsulation, and one-way delay estimates that closely match reality. Route changes, filtering and loss all erode fidelity.

Scale and results

From June 2025 to January 2026, 44 randomized scans ran; cumulatively, 1,909,440 hosts passed forwarding tests across six protocols. Average EH survivability exceeded 70.9%, and in 81.6% of cases inserting headers noticeably increased processing delay.

In a controlled experiment against the team's own targets in China, Japan, Germany and the United States, a single-hop baseline produced a 12× pulse. TED, distributing over 35,000 packets across 4.2 seconds, gathered more than 34,000 of them into a quarter-second; within the critical 20 ms window, the peak rate exceeded the sender's average by more than 180 times. This is not byte amplification but temporal concentration.

What operators should do

The chief danger is invisibility: application-layer defences are useless, the target sees ordinary decapsulated traffic, and intermediate networks see only a low local rate. Among the vulnerable addresses were some associated with Starlink terminals.

The authors recommend restricting tunnel peers, validating inner and outer source addresses, treating nesting deeper than one as suspect, blocking the deprecated RH0 and needless header combinations, inspecting and logging after decapsulation, and monitoring short-window queue and arrival-rate spikes. The broader lesson is simple: mechanisms that are safe in isolation can interact unsafely.

Source: Lobsters