Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This sounds to be an issue specific to IPv4 - wouldn't going IPv6-only make IP scanning impractical for bad actors ?


Yes it's only IPv4 where it's practical to scan the whole address space in minutes but there are methods to find IPv6 addresses [0] certificate transpareny logs are also scanned for hostnames to get AAAA records. But from my experience it's multiple orders of magnitude less than v4.

[0]: http://netpatterns.blogspot.com/2016/01/the-rising-sophistic...


I'd love to switch everything to IPv6, but reachability is not yet there, I estimate it will be another 10 years with the current rate of adoption.


You still have to announce your used ranges, so unless you announce /64's it's pretty much the same thing.


Most ISPs don't allow BGP announcements smaller than /48 so you don't get any usefull information from that.


But the smallest range you can announce is /48, that's still way too vast to scan completely.


Depends on how many people are using random-ish addresses and how many are using ::2 and friends.


yes, but not impossible and it comes with other problems




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: