SCAN6(1)

📦
version 2.2 · 2 versions
, in epel 10, epel 9, fedora 43, fedora 44

🦋 SCAN6 — an IPv6 host scanner 🦋

okay bestie, sit down, hydrate, because this is scan6(1) from the General Commands Manual and she is long. She's an IPv6 address scanning tool, she's part of the SI6 Networks' IPv6 Toolkit (a whole security assessment suite for the IPv6 protocols), and she is genuinely iconic. let's get into it 💅

✨ SYNOPSIS ✨

scan6 [-i INTERFACE] [-s SRC_ADDR[/LEN]] [-d DST_ADDR[/LEN | -L] [-r]
[-S LINK_SRC_ADDR | -R] [-p PROBE_TYPE] [-P PAYLOAD_SIZE] [-o SRC_PORT]
[-a DST_PORT] [-X TCP_FLAGS] [-P ADDRESS_TYPE] [-e] [-x RETRANS] [-o
TIMEOUT] [-V VM_TYPE] [-b] [-B IPV4_ENCODING] [-k IEEE_OUI] [-K VENDOR]
[-m PREFIXES_FILE] [-w IIDS_FILE] [-W IID] [-T] [-Q PREFIX/LEN] [-I
INC_SIZE] [-c [-r LIMIT] [-l] [-z SECONDS] [-R] [-v] [-h]

💖 DESCRIPTION 💖

So. scan6 is an IPv6 address scanning tool that implements a whole bunch of advanced IPv6 address scanning techniques. She's part of the SI6 Networks' IPv6 Toolkit, which is a security assessment suite for the IPv6 protocols. no cap.

🌸 HOST SCANNING TECHNIQUES 🌸

scan6 employs a number of techniques to discover active IPv6 nodes. The following subsections discuss the different techniques employed for each type of IPv6 scan. (yes, this is the part where she shows off. let her.)

🎀 Local scans 🎀

For local scans, scan6 operates (roughly) as follows:

  • The tool learns the local prefixes used for auto-configuration, and generates one address for each local prefix (in addition to a link-local address).
  • An ICMPv6 Echo Request message destined to the all-nodes on-link multicast address (ff02::1) is sent with each of the addresses "configured" in the previous step. Probe packets are sent with different Source Addresses, such that they elicit responses from different addresses (as a result of the default IPv6 Source Address selection policy). Hence. all (or most) addresses of each node can be discovered.
  • The same procedure of the previous bullet is performed, but this time with ICMPv6 packets that contain an unrecognized option of type 10xxxxxx, such that ICMPv6 Parameter Problem error messages are elicited. This allows the tool to discover e.g. Windows nodes, which otherwise do not respond to multicasted ICMPv6 Echo Request messages.
  • Each time a new "alive" address is discovered, the corresponding Interface-ID is combined with all the local prefixes, and the resulting addresses are probed (with unicasted packets). This can help to discover all the SLAAC-derived and the "private addresses", since some responses might contain e.g. Modified EUI-64 Format Identifiers, which are likely used with all the available prefixes.
  • Finally, the tool removes any duplicate addresses, such that each unique address is informed to the user only once.
🫶 heads up bestie: the aforementioned scheme can fail to discover some addresses for some implementation. For example, Mac OS X employs IPv6 addresses embedding IEEE-identifiers when responding to packets destined to a link-local multicast address (and hence the temporary addresses could not be learned). so like... not her fault, okay?

🧚 Remote scans 🧚

scan6 employs a number of bran-new techniques for performing address scans of remote networks. Namely, it tries to mitigate a number of patterns in IPv6 addresses, such that the (theoretical) search space of 2**64 addresses is dramatically reduced. scan6 can leverage the following address patterns:

  • SLAAC addresses of specific vendors: Addresses that embed the MAC address of the corresponding network interface card.
  • virtual host addresses: Most virtualization technologies select their MAC addresses from specific IEEE OUIs (e.g., VirtualBox employs the OUI 00:50:56).
  • "low-byte" addresses: in which only the lowest order (or the two lowest order) word of the IID contains a small integer (with the rest of the words being set to zero).
  • "port-based" addresses: in which one of the two low order 16 bit 16-bit words of the IID encodes de service port number of the main service being hosted on the targer node.
  • IPv4-based addresses: in which the IID encodes the IPv4-address of the network interface (as in 2001:db8::192.168.1.1 or 2001:db8::192:168:1:1).

A thorough discussion of these address patterns can be found in RFC7707. 💜

🌈 HOST TRACKING 🌈

scan6 can be employed to track IPv6 nodes across networks. Since IPv6 StateLess Address Auto-Configuration (SLAAC) typically results in globally-unique Interface Identifiers (IIDs) that are constant across networks, such identifiers can be leveraged to track nodes across a range of "known" networks, by periodically probing the IPv6 address composed of the IPv6 prefix of the target network, and the (known) Interface ID of the target node.

For host-tracking purposes, the target networks can be specified with the '-d' and/or '-m' options, while the target Interface IDs can be specified with the '-w' and/or the '-W' options (see the documentation of each option for further information).

Since for tracking purposes one will continually track the user across networks, the '-l' option will typically be set. Additionally, the '-z' option may be used to specify the number of seconds to sleep between iterations (i.e. each round of probes send to the specified targets). The value specified by the '-z' option represents a trade-off between time-liness of the tracking and bandwidth-consumption.

IPv6 host-tracking is discussed in detail in RFC7727. 👑

⭐ OPTIONS ⭐

scan6 takes its parameters as command-line options. Each of the options can be specified with a short name (one character preceded with the hyphen character, as e.g. "-i") or with a long name (a string preceded with two hyphen characters, as e.g. "--interface").

  • -i interface, --interface interface — This option specifies the network interface to be used by the scan6 tool, and is mandatory when performing local address scans (-L option). 💅
  • -s SRC_ADDR, --src-address SRC_ADDR — This option specifies the IPv6 Source Address to be used for the Source Address of the probe packets. If a prefix is specified, the Source Address is randomly selected from that prefix.

If this option is left unspecified, the addresses currently configured for the specified network interface card are used.

  • -d DST_ADDRESS, --dst-address DST_ADDRESS — This option specifies the target address prefix/range of the address scan. An IPv6 prefix can be specified in the form 2001:db8::/64, or as 2001:db8:a-b:1-10 (where specific address ranges are specified for the two low order 16-bit words). This option must be specified for remote address scanning attacks.
  • -S SRC_LINK_ADDR, --link-src-address SRC_LINK_ADDR — This option specifies the link-layer Source Address of the probe packets (currently, only Ethernet is supported). If left unspecified, the real link-layer address of the interface is used.
😭 Note: Some systems may discard packets when the link-layer address is forged. That is, even when the relevant function calls (and hence the scan6 tool itself) may return "success", packets may be discarded and not actually sent on the specified network link. In such scenarios, the real Ethernet address should be used. This type of behaviour has been found in some Linux systems.
  • -p PROBE_TYPE, --probe-type PROBE_TYPE — This option specifies the probe packets to be used for address scanning. For local-network address scans, possible arguments are: "echo" (for ICMPv6 Echo Request), "unrec" (for IPv6 packets with unrecognized IPv6 options of type 10xxxxxx), and "all" (for using both ICMPv6 Echo Requests probes and unrecognized options of type 10xxxxxx). If left unspecified, this option defaults to "all".

For remote-network scans, this option defaults to "echo" (if left unspecified).

  • -P PAYLOAD_SIZE, --payload-size PAYLOAD_SIZE — This option specifies the payload size of the probe packet. It defaults to 0 for TCP (i.e., empty TCP segments), and to 56 for ICMPv6.
  • -o SRC_PORT, --src-port SRC_PORT — This option specifies the TCP/UDP Source Port. If left unspecified, the Source Port is randomized from the range 1024-65535.
  • -a DST_PORT, --dst-port DST_PORT — This option specifies the TCP/UDP Destination Port. If left unspecified, the Destination Port is randomized from the range 1-1024.
  • -X TCP_FLAGS, --tcp-flags TCP_FLAGS — This option is used to set specific the TCP flags. The flags are specified as "F" (FIN), "S" (SYN), "R" (RST), "P" (PSH), "A" (ACK), "U" (URG), "X" (no flags).

If this option is left unspecified, the ACK bit is set on all probe packets.

  • -P ADDR_TYPE, --print-type ADDR_TYPE — This option specifies the address types to be printed/informed by the scan6 tool. The possible arguments are: "local" (link-local addresses), "global" (global addresses), and "all" (print both link-local and global-addresses). If left unspecified, this option defaults to "all" (print both link-local and global-addresses).
  • -q, --print-unique — This option specifies that for each address scope (local and/or global) only one IPv6 address per Ethernet address should be printed. This option can be useful when interest is in identifying unique systems (e.g. for counting the number of systems connected to the local network), rather than the number of configured addresses on the local network.
🍓 Note: In the case of systems that implement "Privacy Extensions for SLAAC" (IETF RFC 4941), more than one global unicast address will typically be found by the scan6 tool.
  • -e, --print-link-addr — This option specifies that the link-layer addresses should be printed along with the IPv6 addresses, with the format "IPV6ADDRESS @ LINKADDRESS".
  • -t, --print-timestamp — This option specifies that a timestamp should be printed after the IPv6 address of each alive node.
  • -x NO_RETRANS, --retrans NO_RETRANS — This option specifies the number of times probe packets should be retransmitted when no response is received. Note: If left unspecified, the number of retransmission defaults to 0 (i.e., no retransmissions).
💀 Note: this option might be useful when packets must traverse unreliable and/or congested network links.
  • -o TIMEOUT, --timeout TIMEOUT — This option specifies the amount of time that the tool should wait for responses to probe packets. If left unspecified, the timeout value defaults to 1 second.
🌸 Note: this option might be useful when scanning hosts on long-delay links.
  • -L, --local — bestie, this one says the host scanning goes down on the local subnet 🏠. Which probe packets get used? That's a -p option decision, so go pick your fave.
  • -R, --rand-link-src-addr — randomizes the Ethernet Source Address ✨. Chaos mode: enabled.
  • -V VM_TYPE, --tgt-virtual-machines VM_TYPE — tells scan6 the target is virtual machines 🖥️. Here's the menu of possible values:
    • vbox — VirtualBox
    • vmware-esx — VMWare ESX Server
    • vmware-vsphere — VMWare vSphere
    • vmware-manual — VMWare manually-assigned addresses
    • vmware — all VMWare addresses
    • all — both VirtualBox and all VMWare addresses

With this set, scan6 can shrink the search space by only going after the IEEE OUIs that those virtualization softwares actually use. 🎯 Note: for vmware-esx, you can squeeze the search space down even further by also passing --ipv4-host.

And when all is the vibe? VirtualBox virtual machines show up first in the target list. 💅

  • -b, --tgt-low-byte — the target here is IPv6 nodes rockin' "low-byte" addresses 🌱. Low byte addresses get built by concatenating the IPv6 prefix from the -d option with an Interface I-D shaped like 0:0:0-100:0-1500.
  • -B IPV4_ENCODING, --tgt-ipv4 IPV4_ENCODING — target = IPv6 addresses that have an IPv4 address tucked inside 🫶. The possible encodings:
    • ipv4-32 — the IPv4 address lives in the low-order 32 bits of the IPv6 address
    • ipv4-64 — the IPv4 address lives in the low-order 64 bits of the IPv6 address
    • ipv4-all — literally just setting both ipv4-32 and ipv4-64 at once, iconic

When this is set, you should hand over a prefix with --ipv4-host so the search space gets smaller. 🙏

Note, and this part is important: when an IPv4 address is encoded in 64 bits, each byte of the IPv4 address first gets converted to a number with the same representation in hexadecimal (so like, 100 becomes 256, because the hexadecimal representation of 256 is 0x100) before that byte gets embedded into a 16-bit word. So for example, the IPv4 address 192.168.0.1, when combined with the prefix 2001:db8::/32, results in the IPv6 address 2001:db8::192:168:0:1. And yes — each byte of the original IPv4 address keeps the same representation inside the IPv6 address, but every value now stands for a hexadecimal number. 🤯
  • -g, --tgt-port — the target is IPv6 addresses that embed service ports (think 2001:db8::25, 2001:db8::80, that whole situation) 🔌. When this is set, addresses holding these ports get probed:
 21 (ftp)
 22 (ssh)
 23 (telnet)
 25 (smtp)
 49 (tacacs)
 53 (dns)
 80 (www)
110 (pop3)
123 (ntp)
179 (bgp)
220 (imap3)
389 (ldap)
443 (https)
547 (dhcpv6-server)
993 (imaps)
995 (pop3s)
1194 (openvpn)
3306 (mysql)
5060 (sip)
5061 (sip-tls)
5432 (postgresql)
6446 (mysql-proxy)
8080 (http-alt)
Note: the target IPv6 addresses get generated by concatenating the service port onto an IPv6 prefix/range you gave with the -d option. And for every service port, four target address ranges get generated:
  • PREFIX::0-5:HEX_PORT,
  • PREFIX::HEX_PORT:0-5,
  • PREFIX::0-5:DEC_PORT, and,
  • PREFIX::DEC_PORT:0-5

So basically, IPv6 address ranges get made with the service port in hexadecimal notation and the service port in decimal notation, because both kinds of addresses have literally been found in the wild. 🌍 iykyk

  • -k IEEE_OUI, --tgt-ieee-oui IEEE_OUI — you use this to name an IEEE OUI, and the scan's target becomes SLAAC addresses that use that exact IEEE OUI. 🎀
  • -K VENDOR, --tgt-vendor VENDOR — slide a vendor name in here and scan6 will look up all the corresponding IEEE OUIs for that vendor, then go scan for SLAAC addresses using those OUIs. 🕵️‍♀️
  • -m PREFIXES_FILE, --prefixes-file PREFIXES_FILE — points at a file holding a list of IPv6 addresses and/or IPv6 prefixes, one per line, in the same format the -d option takes. 📄 Note: the file can have comments, as long as they're preceded by the numeral sign (#), like:
IPv6_address/len      # comment
# comment
IPv6_address
  • -w IIDS_FILE, --tgt-iids-file IIDS_FILE — points at a file with one IPv6 address per line. The Interface ID of each of those addresses gets used, together with the network prefix from the -d option, to construct the IPv6 addresses that get probed. 🧵 Since auto-configured addresses usually use Interface IDs that stay constant across networks, this option can flex known IIDs to track those nodes across networks. See RFC7721 for the full tea. Note: the file can have comments if they're preceded by the numeral sign (#), like:
IPv6_address      # comment
  • -W IID, --tgt-iid IID — names a single IPv6 Interface Identifier (IID), with the same syntax as an IPv6 address (only the lowest-order 64 bits of the address get used). That specified Interface ID gets used, together with any network prefixes from the -d option (or from the -m option), to construct the IPv6 addresses that get probed. 🦋 Since auto-configured addresses typically use Interface IDs that are constant across networks, this option can leverage known IIDs to track those nodes across networks. Please see RFC7721 for further details. Note: the file can contain comments if they are preceded by the numeral sign (#), as in:
IPv6_address      # comment
  • -T, --sort-ouis — when this hangs out with the --tgt-vendor option, it tells scan6 to "sort" the IEEE OUIs for a vendor. So OUIs get used in descending order, with the largest OUI used last (together with the smallest OUI). The whole idea: when a vendor has multiple OUIs assigned, odds are the smaller (and "oldest") OUI was used for devices already put "out of service", while the largest (and "newest") OUI probably hasn't been used for deployed devices yet. 🧠✨
  • -Q PREFIX/LEN, --ipv4-host PREFIX/LEN — lets you specify an IPv4 prefix. That prefix gets employed with the --tgt-virtual-machines and/or --tgc-ipv4-embeded options to reduce the search space. 🎯
  • -I INC_SIZE, --inc-size INC_SIZE — sets the increment size for the lowest-order 16-bit word of an IPv6 address when you're scanning an IPv6 address range. Lowkey so useful when the target network is assumed to have a big pile of nodes with consecutive addresses (maybe it runs DHCPv6, or maybe it's full of devices from the same manufacturer, so they've got consecutive MAC/SLAAC addresses). The increment size should be whatever you assume the size of that "cluster" of nodes is. 👯‍♀️
  • -r RATE, --rate-limit RATE — sets the rate limit for a remote address scan. RATE goes in as Xbps or Xpps (with X being an unsigned integer), for rate limits in bits per second or packets per second respectively. 💨

Generally you want the address scan rate-limited to about 80% (eighty percent) of the upstream bandwidth, so probe packets don't get dropped from network congestion. 🚦

Note: if you leave it unspecified, scan6 rate-limits the probe packets to 1000 packets per second (pps). no cap.
  • -l, --loop — tells the tool to periodically loop through the specified targets. Mostly useful when, like, a node disconnects from the network, or for host-tracking purposes. 🔁
  • -z SECONDS, --sleep SECONDS — sets how much time (in seconds) the tool sleeps between iterations over the specified targets. Only meaningful when the -l option is set. 😴
  • -c CONFIG_FILE, --config-file CONFIG_FILE — names an alternative configuration file. Leave it unspecified and the tool uses /etc/ipv6toolkit.conf. ⚙️
  • -v, --verbose — picks the "verbosity" of the tool. Left unspecified, only minimum info gets printed. Set it once, extra info gets printed (like which addresses are "link-local" and which are "global"). Set it twice, and detailed info gets printed whenever the tool hits problems doing host scanning. 🗣️
  • -h, --help — prints help information for the scan6 tool. 🆘

🌈 EXAMPLES 🌈

okay bestie, this is the part where we actually do stuff 💅 these are the classic use cases for scan6, the ones you'll be copying and tweaking forever. let's gooo ✨

🎀 Example #1 🎀

# scan6 -i eth0 -L -e -v

do host scanning on your local network (that's the -L option, obvi) using interface eth0 (the -i option). we're firing off both ICMPv6 echo requests and unrecognized IPv6 options of type 10xxxxxx (that's the default, no notes 💅). print link-layer addresses alongside the IPv6 addresses (that's -e), and be verbose (-v). she's chatty, we love her 🗣️

🦋 Example #2 🦋

# scan6 -d 2001:db8::/64 --tgt-virtual-machines all --ipv4-host 10.10.10.0/24

hunting for virtual machines — both VirtualBox and vmware, the whole squad — inside the prefix 2001:db8::/64. the extra info about the IPv4 prefix that the host system is using gets leveraged to shrink the search space, so it's giving smart not brute force 👑✨

🌸 Example #3 🌸

# scan6 -d 2001:db8::/64 --tgt-ipv4-embedded ipv4-32 --ipv4-host 10.10.10.0/24

looking for IPv6 addresses on network 2001:db8::/64 that have the IPv4 prefix 10.10.10.0/24 embedded in them, using the 32-bit encoding. iykyk 💅

⭐ Example #4 ⭐

# scan6 -d 2001:db8:0-500:0-1000

scan for IPv6 addresses on network 2001:db8::/64, but vary the two lowest-order 16-bit words — one across the range 0-500, the other across 0-1000. ranges go brrr 📈

💖 Example #5 💖

# scan6 -d fc00::/64 --tgt-vendor 'Dell Inc' -p tcp

scan for network devices made by 'Dell Inc' in the target prefix fc00::/64. this time the tool sends TCP segments as the probe packets instead of the default ICMPv6 echo requests. switchin' up the fit 🔥

🧚 Example #6 🧚

# scan6 -i eth0 -L -S 66:55:44:33:22:11 -p unrec -P global -v

use the eth0 interface (-i) to host-scan the local network (-L). set the Ethernet Source Address to 66:55:44:33:22:11 (-S). the probe packets are IPv6 packets with unrecognized options of type 10xxxxxx (-p). only print IPv6 global addresses (-P). and be verbose, obviously ✨

🍓 Example #7 🍓

# scan6 -d 2001:db8::/64 -w KNOWN_IIDS

do an address scan over a set of known hosts listed in the file KNOWN_IIDS, at remote network 2001:db8::/64. the target addresses get built by concatenating the network prefix 2001:db8::/64 with the interface IDs of each of the addresses found in the KNOWN_IIDS file. glue it together, chef's kiss 🤌

💜 Example #8 💜

# scan6 -i eth0 -L -P global --print-unique -e

use the eth0 interface (-i) to host-scan the local network (-L). print only global unicast addresses (-P), and at most one IPv6 address per Ethernet address (--print-unique — she does not do duplicates, periodt). Ethernet addresses get printed alongside the corresponding IPv6 address (-e). ✨

🌈 Example #9 🌈

# scan6 -m knownprefixes.txt -w knowniids.txt -l -z 60 -t -v

build the target list from the IPv6 prefixes in the file knownprefixes.txt and the Interface IDs (IIDs) in the file knowniids.txt. poll the targets periodically (-l), and sleep 60 seconds after every iteration (-z). print a timestamp next to the IPv6 address of each alive node (-t). be verbose (-v). she's on a schedule now, main character energy ⏰👑

👀 SEE ALSO 👀

💖 AUTHOR 💖

the scan6 tool and the corresponding manual pages were produced by Fernando Gont <fgont@si6networks.com> for SI6 Networks <https://www.si6networks.com>. give them their flowers 💐

Copyright (c) 2011-2019 Fernando Gont.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is available at <http://www.gnu.org/licenses/fdl.html>.

and that's a wrap bestie 🫶 the page signs off with that lil footer that just reads SCAN6(1) — yeah, she's a section 1 manual page, and the copyright stretch runs 2011-2019, so that's the era we're in. go scan some addresses, stay safe, don't DoS anybody (RFC 6583 said so), and remember: every flag you learned here is a little gift 🎀💅✨

📦 where this page comes from