# Efficient IPv6 address scanning based on hostname correlation in IPv6-only network

## TL;DR

This paper introduces HFinder6, a new method for scanning IPv6 addresses in networks that only use IPv6, by using hostnames to find active devices more efficiently.

## Contribution

HFinder6 is a novel IPv6 address scanning method for IPv6-only networks that uses hostname correlation and active triggering to improve scanning efficiency and completeness.

## Key findings

- HFinder6 discovers 43 IPv6 addresses across 18 OS versions in an average of 10.29 seconds in IPv6-only networks.
- HFinder6 outperforms existing tools by identifying 3.67 more IPv6 addresses per second and scanning 35 more addresses.
- HFinder6 successfully identifies 14 additional OS versions compared to other tools, enhancing scanning completeness by up to 5.37 times.

## Abstract

Existing on-link IPv6 address scanning technologies based on IPv6-only information, such as multicast Ping6 scanning, invalid extension header scanning, multicast listener discovery (MLD) scanning, and stateless address auto-configuration scanning, rely on protocol features such as ICMPv6, MLD, and other protocol features to induce responses. However, these scanning packets are easily intercepted by the default security mechanisms of modern OSs (Operating Systems), leading to issues such as low OS coverage and incomplete IPv6 address scan results of alive nodes. On-link IPv6 address scanning technologies based on dual-stack correlation information (e.g., FScan6, LLMNR6, and LinkScan6) utilize local domain names, hostnames, and other dual-stack correlation information to enhance IPv6 address discovery capabilities. However, these technologies overly rely on IPv4 networks, resulting in low IPv6 address scanning efficiency and inability to operate in IPv6-only networks. To this end, we propose HFinder6, an efficient IPv6 address scanning technology for IPv6-only network based on hostname correlation. HFinder6 combines the passive capture of DHCPv6 Solicit messages from active IPv6 nodes with an active triggering mechanism. By constructing Router Advertisement messages of NDP protocol, it forces nodes to proactively send Solicit messages, enabling rapid hostname acquisition. Subsequently, the IPv6 address information is queried in parallel using the mDNS protocol and LLMNR protocol, thereby achieving efficient scanning of IPv6 addresses for alive nodes in IPv6-only network. A typical IPv6-only and IPv4/IPv6 dual-stack network environment was established, comprising 20 versions of OSs such as Windows and Linux. HFinder6 was tested in this environment and compared with 4 IPv6-only network IPv6 address scanning scripts from the Nmap tool and 3 dual-stack network IPv6 address scanning tools (e.g., LinkScan6, LLMNR6, and FScan6). Experimental results show that HFinder6 can discover 43 IPv6 addresses across 18 OS versions in an average of just 10.29 seconds within IPv6-only network. In terms of OS coverage and IPv6 address scanning completeness, HFinder6 performs on par with FScan6 and outperforms 6 other scripts and tools, successfully identifies at more 14 additional OS versions and scans 35 more IPv6 addresses, thereby enhancing the completeness of IPv6 address scanning by up to 5.37 times. Moreover, in terms of IPv6 address scanning efficiency, HFinder6 can identify 3.67 more IPv6 addresses per second, outperforming these 7 scripts and tools.