[ipv6hackers] Scanning for IPv6 addresses embedding TCP/UDP service ports

[Marc Heuse]

Hi Fernando,

> Based on Tor's suggestion, I'm planning to enhance the scan6 tool to be
> able to scan for IPv6 addresses embedding service ports (for example,
> addresses such as fc00:1::25, fc00.1::80, etc.).
...
> Has anyone seen these patterns? Does it make sense to add them as part
> of "scan for IPv6 addresses embedding service ports"?

well, thats what alive6 implements for two years now ;-)
(OK, OK, public since October 2012, but still)

I do not work with the full services list though but the most common
ones. (my assumption is that when such an addressing scheme is used,
several service addresses will point to the same server).

from my statistics (based on 350k addresses) you find one of the two
algorithms (but still still is public since my 2011 presentations):

::1:port, ::2:port, ...
  or
::port:1, ::port:2, ...

so you are missing the second form.


Greets,
Marc

--
Marc Heuse
Mobil: +49 177 9611560
Fax: +49 30 37309726
www.mh-sec.de

Marc Heuse - IT-Security Consulting
Winsstr. 68
10405 Berlin

Ust.-Ident.-Nr.: DE244222388
PGP: FEDD 5B50 C087 F8DF 5CB9  876F 7FDD E533 BF4F 891A