4 ms·
Seems like that's another benefit of IPv6. Without needing NAT everyone can have their own IP address and biz will be able to ban individual machines instead o
by nickthemagicman 5y ago
Seems like that's another benefit of IPv6.
Without needing NAT everyone can have their own IP address and biz will be able to ban individual machines instead of some giant NAT Network because one host using that IP address is compromised.
- laurensr 5y agoDoesn't it also mean addresses serving as the source of an attack become more disposable?
- nickthemagicman 5y agoThe hackers still have to compromise the host right?
- MrStonedOne 5y agoif you are sending packets but don't care about the reply, you can spoof the from header. The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.
- kazen44 5y agothis could be solved in ipv6 by implementing ipsec in AH mode.
- nickthemagicman 5y agoYep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails. Most machines don't have UDP services open to accept packets.
- MrStonedOne 5y agoall machines need udp opened to get response from ntp and dns. moving these to tcp would actually seriously help with filtering ddos, but good luck.
- nickthemagicman 5y agoYeah but as I understand it, Port 22 doesn't just sit open on a machine waiting for any connection. Running a quick netstat -p udp doesn't show any UDP entrys with LISTENING status.
- bluedino 5y agoA trillion hosts.deny entries?
- nickthemagicman 5y agoHow many hackers would it take to compromise a trillion hosts? the hackers are better than I thought!
- Gigachad 5y agoMost devices are configured to randomize part of the v6 address for privacy so you can no longer see more info than ipv4 would show.
- e2le 5y agoBan the prefix instead.