Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: nsp: ipv6

IPv6 port scanning observed

 

 

nsp ipv6 RSS feed   Index | Next | Previous | View Threaded


bjorn at mork

Nov 18, 2010, 1:29 AM

Post #1 of 2 (1461 views)
Permalink
IPv6 port scanning observed

Just to register that these things actually exist...

Got lucky and logged 15000 probes from a single IPv6 source address in a
couple of seconds.

Looks like it is targeted at two of the /64s I am using (could easily be
picked up from mail, web server logs etc). Not all of the /64s in use
were targetted, but those missing have probably never been used as
source addresses outside my network. But I may have missed a lot of
destinations as most of the prefix is null routed without any logging at
all.

Anyway, the destination protocols/ports logged are 22/tcp, 25/tcp,
53/udp, 443/tcp and 9511/tcp, and one I must admit I'm quite clueless
about: protocol 128. This is listed as "sscopmce" by IANA, without that
helping me a lot. Anyone? I'm wondering whether this is merely a
scanning bug, or if there could be something interesting around
processing such packets?

The destination interface id's look like they've been chosen to maximise
the chance of hitting manually configured boxes (possibly with some
holes - I've not scripted this list):

:: to ::2ff
::1000 to ::10ac
::2000 to ::2111
::1:0 to ::1:1ff
::500
::aaa
::fff
::1337
::3128
::2525
::5353
::6667
::8000
::aaaa
::abcd
::babe
::cafe
::beef
::ffff
::[0-9]:25
::[0-9]:53
::[0-9]:80



Bjørn


gert at space

Nov 22, 2010, 8:52 AM

Post #2 of 2 (1320 views)
Permalink
Re: IPv6 port scanning observed [In reply to]

Hi,

On Thu, Nov 18, 2010 at 10:29:06AM +0100, Bjørn Mork wrote:
> Just to register that these things actually exist...

Yep, I have also seen this one. Single IPv6 source, so far...

Gert Doering
-- NetMaster
--
did you enable IPv6 on something today...?

SpaceNet AG Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279

nsp ipv6 RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.