4 ms·

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 s

by cube00 5y ago

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.

cm2187 5y ago
The extra scan time? You certainly can't possibly physically scan the whole 128bit address space. I am not even sure you can if you know which /48 prefixes have been assigned.
chockchocschoir 5y ago
While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.
- jandrese 5y ago
  I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
  - chockchocschoir 5y ago
    Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent). Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.
    - jandrese 5y ago
      If you're scanning 10 million hosts per second and know the netblock you want to scan it will only take on average a touch under 30,000 years to find the host. In IPv4 land finding that same host would require scanning a single address.

by cube00 5y ago

cm2187 5y ago

The extra scan time? You certainly can't possibly physically scan the whole 128bit address space. I am not even sure you can if you know which /48 prefixes have been assigned.

chockchocschoir 5y ago

While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.

jandrese 5y ago
I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
- chockchocschoir 5y ago
  Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent). Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.
  - jandrese 5y ago
    If you're scanning 10 million hosts per second and know the netblock you want to scan it will only take on average a touch under 30,000 years to find the host. In IPv4 land finding that same host would require scanning a single address.