Summary

  • A /64 remains too large for ordinary exhaustive probing, yet predictable interface identifiers and operational data can collapse the useful search into much smaller candidate sets.
  • Discovery evidence is vantage-bound: DNS, flow records, neighbour caches and active probes reveal different populations, so none is a receipt for a complete device inventory.

In 2008, Tim Chown authored an IETF note on what IPv6 would do to network scanning. The arithmetic was reassuring but not magical. A sparsely populated IPv6 subnet gave a scanner far more empty addresses to cross than IPv4, while sequential numbering, published DNS records and other clues could still betray useful targets. The note warned operators not to rest their security on sparsity alone.

Eight years later, Chown appeared on the byline of the document that formally replaced his earlier one. RFC 7707, written with Fernando Gont, kept the arithmetic and changed the operating model. Five additional years of deployment evidence had shown that the relevant question was not whether an adversary could sweep every address in a /64. It was how many guesses remained after the adversary learned how the network constructed addresses and where it shed observations.

That is the durable contribution. IPv6 did not remove the search problem. It turned it into a problem of candidate generation.

The address plan is part of the exposure surface

An interface identifier may occupy 64 bits, but those bits do not always contain 64 bits of uncertainty. RFC 7707 catalogues the shortcuts created by familiar operating habits.

A DHCPv6 pool allocated in sequence may compress the useful range to eight or sixteen variable bits. A manually assigned server ending in ::1, ::25 or ::80 reveals a low-byte or service-port convention. An identifier derived from an IPv4 address inherits the much smaller IPv4 candidate set. Older SLAAC schemes based on a Modified EUI-64 identifier expose manufacturer structure: once a vendor prefix is known, the remaining search can fall to a 24-bit family, or to a narrower vendor-specific range in some virtual-machine deployments.

These are not universal scan times. They are conditional statements about deployed policy. A randomly selected identifier does not acquire a low-byte pattern merely because an RFC lists one. Conversely, allocating a /64 does not restore its nominal uncertainty if the organisation fills it with addresses chosen for human memory.

This distinction makes the address plan a control surface, not just an administrative worksheet. The policy for SLAAC, DHCPv6 and manual assignments determines which regularities an outsider can exploit. RFC 8064 later recommended stable, semantically opaque identifiers under RFC 7217 as the default alternative to stable link-layer-derived identifiers. That recommendation reduces correlation, scanning and device-specific exposure while retaining a stable address where operations require one. It does not turn the address into an access-control rule.

Reconnaissance can start without a scan

RFC 7707 is most useful when it leaves the scanner behind. Public DNS necessarily identifies mail relays and web services. Permissive zone transfers, predictable hostnames and reverse-DNS structure can expose more. Public archives, search indexes and peer-to-peer systems may yield addresses already seen in use.

Inside a network, the evidence becomes richer. A neighbour cache records peers encountered on a link. Routing tables and routing protocols reveal prefixes and infrastructure. Configuration files and logs remember dependencies. IPFIX can enumerate source addresses that crossed a particular exporter. SNMP can expose neighbour and route state if access is not properly controlled. Passive packet observation supplies addresses simply because endpoints communicated.

Each source is powerful precisely because it avoids searching the whole namespace. Each also has a boundary. A public AAAA record proves that a name published an address; it does not prove the service is listening now. An IPFIX exporter sees traffic through its observation point, not silent nodes or link-local exchanges elsewhere. A neighbour cache is local and transient. A reply to a probe demonstrates one address responded under one packet and policy condition; silence may mean absence, filtering, sleep or the wrong probe.

The result is a set of evidence receipts, not one master truth. Address, device identity, service availability, administrative ownership and compromise are separate claims. Joining them without provenance recreates the false certainty that IPv6’s scale was once assumed to provide.

The defender has the harder mirror problem

An adversary may need only one useful target. An operator needs to know what has been missed. That asymmetry is why RFC 9099 treats IPv6 inventory as a security requirement rather than a housekeeping task.

The document recommends a mixture of methods. Passive IPFIX efficiently finds nodes that sent traffic through the monitored router, but misses silent nodes and link-local addresses. Neighbour-cache collection can recover link-local participants at specific links. An all-nodes multicast query may help on a local segment. DNS, log analysis and service discovery add further views. None closes the inventory alone.

The practical control is therefore a reconciliation system. Authoritative IP address management and DHCPv6 lease history describe what should exist. SLAAC and router-advertisement policy describe how addresses may form. Neighbour and switch observations describe what appeared locally. Flow telemetry describes what crossed selected boundaries. DNS and service catalogues describe what the organisation intentionally published. Active validation tests whether a chosen address and service respond.

Differences between those lists are the signal. A device observed but not assigned may be unmanaged. An assignment never observed may be stale, silent or outside the telemetry path. A public record without an owner may be abandoned exposure. A responder absent from the service catalogue may be an undocumented dependency. The discrepancy must be investigated; it is not itself attribution.

Chown’s revision from RFC 5157 to RFC 7707 is valuable because it resists two symmetrical myths. The first is that IPv6 can be scanned like a small IPv4 subnet. The second is that a large address space can substitute for inventory, filtering or host security. Both fail once address policy and observation points enter the picture.

Sources