Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm seeing the following IPv6 addresses having requests dropped by our firewall. It doesn't seem to be anything too malicious, but there seems to be a strange pattern to them:

2aab:19a7:3971:94f4::80fe (62,050 requests)
bb2d:f96b:f097:bccd::80fe (31,392 requests)
aafb:2bc8:ccad:1451::80fe (26,400 requests)
be2b:2477:43c2:4447::80fe (21,754 requests)

That's just over the last 7 days. There are more, but the pattern is basically the same - they all end in ::80fe. Which makes me wonder if it was some sort of lame attempt into fooling me into thinking it's an fe80:: address (which to be honest, I almost fell for).

Has anyone else with IPv6 connectivity seen anything like this? I'm assuming it's some sort of port scan, but IPv6 was meant to make random port scanning a thing of the past (given the sheer size of IPv6)

share|improve this question
(P.S. Googling for those IPv6 addresses just shows up this question. Google are fast) – Mark Henderson Aug 8 '11 at 4:20
up vote 3 down vote accepted

What is the source of those addresses? The wider Internet, or something in your network? They actually rather look like some device reversed some link-local addresses and let them escape (except they don't have EUI-64 host parts). With the exception of the first one, though, they're not even (currently) valid unicast addresses, so if they did come at you from the Internet, how did they escape from wherever they came from (let alone get within cooee of your firewall)? uRPF and/or bare-basic sanity checking should have taken care of them long ago.

share|improve this answer
We only have one IPv6 /48 in use (which is not any of the above). I thought they looked like reversed link-local too, but then they must have been reversed two bytes at a time (because its 80fe instead of fe80. I shall investigate if that's actually what happened though... – Mark Henderson Aug 8 '11 at 4:55
I've only looked at the summary report for the firewall, I'll check the details and their interfaces now – Mark Henderson Aug 8 '11 at 4:59
Ok, after filtering through the requests by hand, it looks like be2b:2477:43c2:4447::80fe equals the real IP address of fe80::4447:43c2:be2b:2477 - it's just being totally mangled by the firewall summary report. I think I'll log this as a bug with them. Thanks. – Mark Henderson Aug 8 '11 at 5:32
@womble they are link-local addresses using the privacy extension (so they aren't based on the MAC), reversed. – bahamat Aug 8 '11 at 7:22
Link-local addresses aren't supposed to use privacy extensions; there's no privacy to be gained because the MAC address is already visible, because they're link-local. – womble Aug 8 '11 at 7:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.