5 ms·
I am not sure any computer is capable of sending and processing 2^126 packets (assuming global unicast, 1 packet out, 1 packet in) in under 5 minutes.
by chaz6 5y ago
I am not sure any computer is capable of sending and processing 2^126 packets (assuming global unicast, 1 packet out, 1 packet in) in under 5 minutes.
- jerf 5y agoWell, 5 minutes is about 2^8 seconds, you can get about 2^32 cycles per core per second nowadays, and you can have about 2^6 cores maximum, so with an incredibly, unspeakably generous "scan one IP in one cycle" a 64-core computer should be able to scan about 2^(8+32+6) = 2^46 addresses in a little under five minutes. We seem to be a wee bit short of 2^126, yes.
- gitfan86 5y agoLarge blocks of IPs are not part of the internet. 10. 172. Etc...
- signa11 5y agoall non-routeable addresses, multicast etc. etc.
- deleted 5y ago[deleted]
- jerf 5y agoThe IPv4 internet is merely 2^32, and people have been scanning that whole thing for years now. The /112 is referring to IPv6 addresses. Plus the copy about not hammering other networks won't matter when you're trying to scan entire /64s that are behind one home router or something. That's gonna get noticed. You can't really scan IPv6 like you can scan IPv4, the math I gave is part of why. The code to do it is trivial, but the hardware just isn't there.
- londons_explore 5y agoI'm really surprised shady figures aren't publishing lists of active IPv6 addresses to allow scanning. For example, someone with access to a backbone internet router could easily log src and destination ipv6 addresses, and sell the complete list sorted and compressed. Malware authors could then use the list to portscan for badly firewalled stuff.
- pixl97 5y agoWith IPv6 privacy extensions this gets really big really fast and is mostly empty.
- ryanlol 5y agoIt’s not surprising. Malware authors aren’t going to pay for something that’ll have no meaningful effect on their infection rates. There’s more than enough stuff on IPv4, IPv6 isn’t worth the effort. FWIW shodan was setting up their own public ntp servers to track down v6 users.
- dadrian 5y agoPeople absolutely do this, they're just not going to post it for free.
- pjf 5y agohttps://ipv6hitlist.github.io/ https://ipv6hitlist.github.io/ First time to be called shady, though ;)
- sva_ 5y agoI'm pretty sure the IPv4 internet is constantly being scanned. I blocked ICMP echo request (ping) in my firewall, and saw it throws a warning of an attempted ping every other minute.
- hsbauauvhabzb 5y agoScanning 2^32 wasn’t exactly viable 30 years ago, so never say never.
- jerf 5y agoYes, people often say this about IPv6 thinking they're being clever. It's not. 2^128 is big, relative to the universe itself. It is an accident of history that computing spent so much time at binary orders of magnitude that technology could catch up and make the previous limits seem small. At some point, the exponential curve takes off and no amount of physical resources can catch up to it, because our universe taps out at O(n^3). 2^128 is pretty much on the other side of that takeoff point. You can almost catch up to it... at the cost of the resources of an entire galaxy... or more. (Technically it's even sooner than O(n^3) if you also have to avoid black holes, but since the relevant comparison here is "exponential" the details hardly matter here.)
- hsbauauvhabzb 5y agoFair point, I just did the math and even with a botnet of 13m (pulled from googling ‘largest botnet’) it’d still take e+22 years, give or take a few billion. Still, network address obfuscation really shouldn’t be a security control.
- lol768 5y agoLots of people like to pretend the "entire internet" is synonymous with the IPv4 address space...
- ehPReth 5y agoMy ISP for one…
- birdyrooster 5y agoWell you can understand why in the case of masscan, it would be a pretty boring claim to say that masscan is “scanning the entire internet in 100 years from a single machine!”
- dmw_ng 5y agoThe v6 space has structure and is much smaller than that
- kalleboo 5y agoAside from Shodan's neat trick of infiltrating the NTP pool, are there any papers/blogs on successfully exploiting known properties of IPv6 (network prefixes, MAC vendors etc)? However I think about it it seems too massive
- lima 5y agoMany providers sell netflow data.
- tux3 5y ago....infiltrating the NTP pool! Oh my, that is clever =)
- dmw_ng 5y agoI was mostly thinking about the sparse structure of upper bits (which are easily enumerable e.g. by downloading a RIPE database dump). As for the lower 64, MAC address OUIs contribute at most around 15 bits, and the distribution is likely strongly skewed towards only a handful of vendors, so actual randomness is probably lower still.
- pjf 5y agohttps://www.entropy-ip.com/ https://www.entropy-ip.com/ https://arxiv.org/abs/1606.04327 https://arxiv.org/abs/1606.04327
- helge9210 5y agoYou can do it in parallel from several computers. Masscan has capability of dividing workload across multiple processes.
- martini333 5y ago> It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine
- OnlyMortal 5y agoAmateur!
- zamadatix 5y ago"Only" about a /15 worth of v6 is actively advertised on the internet. Still, good luck sending that many packets.
- birdyrooster 5y agoDefinitely but then click bait wouldn’t be click bait without some misleading information
- bmicraft 5y agoI would argue that most interesting (and unpatched?) servers do at least have an ipv4 address as well, if not exclusively