[ipv6hackers] Zmap

[Fernando Gont]

Bill,

On 08/31/2013 10:09 PM, bmanning at vacation.karoshi.com wrote:
> 
> people have been scanning the entire v4 address space for nearly two decades.  (I think I was
> the first to do an exaustive scan)  Zmap is fraught with the primary problem of scanning, in
> that it is -very- noticable and will be blocked by even semi-comatose network admins.
> 
> For those of us in the research space, scanning v6 presents some novel challanges.  v4 techniques
> are not readily convertable to the v6 universe.  that said, there are a couple of projects which
> show promise for low cost, minimal impact scanning of IPv6.

Some of us have researched the IPv6 address scanning quite a bit. Some
references:

* scan6 tool (man scan6) of the IPv6 Toolkit:
<http://www.si6networks.com/tools/ipv6toolkit>

* An IETF I-D:
<http://tools.ietf.org/html/draft-ietf-opsec-ipv6-host-scanning>

* An article on the topic:
<http://searchsecurity.techtarget.com/tip/Analysis-Vast-IPv6-address-space-actually-enables-IPv6-attacks>

* A presentation on the topic:
<http://www.si6networks.com/presentations/confidence2013/fgont-confidence2013-ipv6-network-reconnaissance.pdf>

* (The address stats were produced with the addr6 tool of the
aforementioned toolkit)

Clearly, there are two separate challenges to "scan the whole IPv6
Internet". One is the prefix part, which has been explored by Robert
Barnes, and the other is the Interface ID part (discussed/tackled in the
above references).

There's still work to be done in the area, though.

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont at si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492