4

I'm seeing the following IPv6 addresses having requests dropped by our firewall. It doesn't seem to be anything too malicious, but there seems to be a strange pattern to them:

2aab:19a7:3971:94f4::80fe (62,050 requests)
bb2d:f96b:f097:bccd::80fe (31,392 requests)
aafb:2bc8:ccad:1451::80fe (26,400 requests)
be2b:2477:43c2:4447::80fe (21,754 requests)

That's just over the last 7 days. There are more, but the pattern is basically the same - they all end in ::80fe. Which makes me wonder if it was some sort of lame attempt into fooling me into thinking it's an fe80:: address (which to be honest, I almost fell for).

Has anyone else with IPv6 connectivity seen anything like this? I'm assuming it's some sort of port scan, but IPv6 was meant to make random port scanning a thing of the past (given the sheer size of IPv6)

1
  • (P.S. Googling for those IPv6 addresses just shows up this question. Google are fast) Aug 8, 2011 at 4:20

1 Answer 1

3

What is the source of those addresses? The wider Internet, or something in your network? They actually rather look like some device reversed some link-local addresses and let them escape (except they don't have EUI-64 host parts). With the exception of the first one, though, they're not even (currently) valid unicast addresses, so if they did come at you from the Internet, how did they escape from wherever they came from (let alone get within cooee of your firewall)? uRPF and/or bare-basic sanity checking should have taken care of them long ago.

6
  • We only have one IPv6 /48 in use (which is not any of the above). I thought they looked like reversed link-local too, but then they must have been reversed two bytes at a time (because its 80fe instead of fe80. I shall investigate if that's actually what happened though... Aug 8, 2011 at 4:55
  • I've only looked at the summary report for the firewall, I'll check the details and their interfaces now Aug 8, 2011 at 4:59
  • Ok, after filtering through the requests by hand, it looks like be2b:2477:43c2:4447::80fe equals the real IP address of fe80::4447:43c2:be2b:2477 - it's just being totally mangled by the firewall summary report. I think I'll log this as a bug with them. Thanks. Aug 8, 2011 at 5:32
  • @womble they are link-local addresses using the privacy extension (so they aren't based on the MAC), reversed.
    – bahamat
    Aug 8, 2011 at 7:22
  • 3
    Link-local addresses aren't supposed to use privacy extensions; there's no privacy to be gained because the MAC address is already visible, because they're link-local.
    – womble
    Aug 8, 2011 at 7:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .