An IPv6 address fast scanning method based on local domain name association

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• Increasing security concerns in IPv6 networks necessitate effective address scanning.
• Current IPv6 privacy features (randomized identifiers, temporary addresses) and active scanning methods lead to incomplete scans and poor OS coverage.
• Existing methods struggle with network performance impact and detecting new hosts promptly.

Purpose of the Study:

• To propose an efficient IPv6 address fast scanning method (FScan6) that overcomes the limitations of existing techniques.
• To enhance the completeness and OS coverage of on-link IPv6 address scanning.
• To minimize the impact of scanning on network performance.

Main Methods:

• FScan6 combines active scanning and passive listening for comprehensive IPv6 address discovery.
• Active scanning utilizes Browser and DNS-SD protocols to gather local domain names from various operating systems.
• Passive listening monitors network traffic to extract local domain names, with mDNS used to resolve associated IPv6 addresses.

Main Results:

• FScan6 demonstrated superior performance compared to nine existing IPv6 scanning methods across 26 OS versions.
• Achieved up to 2.89 times greater OS coverage, detecting all IPv6 addresses across diverse operating systems.
• Identified up to 54 additional IPv6 addresses, significantly improving scanning result completeness.
• Maintained a 0% packet loss rate, indicating minimal impact on network performance.

Conclusions:

• FScan6 offers a robust and efficient solution for IPv6 address scanning, addressing limitations of current methods.
• The combined active and passive approach significantly improves OS coverage and scan completeness.
• FScan6 is a valuable tool for identifying security risks in IPv6 networks with minimal performance degradation.