An IPv6 address fast scanning method based on local domain name association

Abstract

Abstract With the increase of security issues in IPv6 networks, conducting address scanning in IPv6 networks proves beneficial for identifying potential security risks and vulnerabilities. To enhance the privacy of users’ IPv6 addresses, mainstream OS (Operating System) nodes currently employ randomized interface identifiers and temporary IPv6 addresses. Additionally, since most existing IPv6 address scanning methods rely on active scanning, which makes current on-link IPv6 address scanning methods face the challenges of incomplete scan results, poor coverage across different OSs, significant impact on network performance, and the inability to promptly detect subsequently joined hosts. To this end, An IPv6 address fast scanning method based on local domain name association (FScan6), which combines active scanning and passive listening, is proposed. The active scanning module targets different OSs using distinct protocols (Browser and DNS-SD) to obtain local domain names of on-link hosts. Meanwhile, the passive listening module monitors traffic to extract local domain names of on-link hosts. Then, it employs mDNS protocol to retrieve IPv6 addresses associated with these local domain names. A typical on-link IPv6 network environment was constructed, comprising 26 versions of Windows, Apple, and Linux OSs, and FScan6 was compared with 9 IPv6 address scanning methods. The experimental results show that FScan6 outperforms existing IPv6 address scanning methods in terms of OS coverage and scanning result completeness. Specifically, regarding OS coverage, FScan6 successfully detected all IPv6 addresses across 26 different OS versions, which outperformed 9 address scanning tools and scripts by a factor of 2.89 times at most. Regarding scanning result completeness, FScan6 identified up to 54 additional IPv6 addresses at most compared to these tools and scripts. Additionally, FScan6 has a minimal impact on network performance, with the packet loss rate induced by the tool consistently remaining at 0%.