Hi, Again Thanks for your comments. > I do think it might be useful to recommend that DNS servers be configured as to > refuse requests to list DNS zones as a means to thwart attackers from looking > for IPv6 addresses. But assuming that such listing is disabled, I don't know why > listing a host's address in DNS would make that host a more likely target for > attack. In other words, why is DNS name probing any more feasible of an > attack than IPv6 address probing?
To do brute force scanning, you need to do brute force attacks against 2^64 addresses which might take years! If you are in the same LAN or can eavesdrops ICMPv6 messages exchanged among nodes or send ICMPv6 messages, then you can also find nodes. But if you are not access to these capabilities, the best next option is guessing and using DNS servers. If DNS is not secure then you can spoof the source IP address of the legitimate DNS server and ask for axfr. If it is secure then there are other ways to attack DNS server and obtain nodes that I explained in my other message. There is other way also to have a website that use it as a honey pot in order to store IP addresses of nodes. However, it might not occurrence because of NAT and many other reasons. Thanks, Best, Hosnieh -------------------------------------------------------------------- IETF IPv6 working group mailing list ipv6@ietf.org Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
