Linux

Detect IPv6 hosts

There is no arp table like in Ethernet/IPv4. But we can sim­u­late is as fol­lows to list all neight­bours / direct­ly reach­able hosts:

ping6 -c 5 ff02::1%eth0 >/dev/null
ip -6 neigh

Bonus: ip neigh shows the IPv4 address res­o­lu­tion table like the arp com­mand does.

Detect IPv6 addresses for known IPv4 addresses

Sce­nario: You know a IPv4 address from a tar­get. You don’t know the IPv6 address which you want to scan.

1. Send a mul­ti­cast ping to all inter­face-local and link-local address­es:
   ping6 -c 5 ff02::1%eth0
2. Check the neigh­bours cache:
   ip neigh
3. Check which MAC address the device has with the IPv4 address you know.
4. Search through the out­put where the same MAC address appears again.

Exam­ple:

# ping6 -c 2 ff02::1%eth0
...

root@slingshot:/tmp/jwp0ppy# ip neigh
192.168.178.21 dev eth0 lladdr 38:f9:d3:04:9b:32 REACHABLE
192.168.178.1 dev eth0 lladdr dc:39:6f:41:c8:52 STALE
192.168.178.67 dev eth0 lladdr 00:0c:29:57:25:7c STALE
fe80::811:8e3e:4b7:8bdf dev eth0 lladdr 38:f9:d3:04:9b:32 REACHABLE
2001:a61:5e2:b201:45ae:677a:96cc:aff9 dev eth0 lladdr 00:0c:29:57:25:7c STALE
fe80::6680:2d5d:4265:c42d dev eth0 lladdr 74:da:38:00:6a:a0 REACHABLE
fe80::3a9e:a01b:2eb5:bcda dev eth0 lladdr 00:0c:29:57:25:7c REACHABLE
fe80::20c:29ff:fe07:5872 dev eth0 lladdr 8c:85:90:5e:08:33 REACHABLE
fe80::c12:759d:2d68:5c73 dev eth0 lladdr 70:14:a6:63:40:d6 REACHABLE

Now we know that the device with IPv4 192.168.178.67 is also reach­able via IPv6 fe80::3a9e:a01b:2eb5:bcda. Note that this is a link-local address, which means that you have to pro­vide the inter­face name at each usage. E.g. nmap -sT fe80::3a9e:a01b:2eb5:bcda%eth0.

Tools

• thc-ipv6: Ton of tools for IPv6 networking.