4 ms·
there is no "easily bypassing this scheme with a port/address scan" when it comes to ipv6 /64 ranges. If you could scan 1 million IP addresses a second on a /6
by throwaway2048 5y ago
there is no "easily bypassing this scheme with a port/address scan" when it comes to ipv6 /64 ranges.
If you could scan 1 million IP addresses a second on a /64 (which is absurd), it would take 600K years to scan a full /64.
- toast0 5y ago1 million IPs per second is doable with gigE if we're just sending a syn to port 22. I'm going to go out on a limb and assume your server has at least gigE.
- throwaway2048 5y agoHowever I don't think my server has 600000 years of runtime, or a sane firewall config is gonna allow 1 million connections a second.
- waihtis 5y agoNot sure why youre getting downvoted, I think an nmap based attack against this kind of rotating setup sounds borderline ridiculous
- ryanlol 5y agoThis does not use a full /64. > If you could scan 1 million IP addresses a second on a /64 (which is absurd) Not at all, I regularly scan the internet at well over 20Mpps.