>> Welcome to the Nmap lesson on Nmap and IPv6.
In your Nmap scanning,
you may encounter local or remote targets
that are only configured using IPv6.
Unless you're scanning station is set up properly,
you won't be able to run Nmap scans against them.
This lesson is focused on
the most important points about running
Nmap scans against IPv6 targets.
>> Let's get started.
>> Here are the learning objectives for this lesson.
First, we'll go over some general IPv6 information
with regards to Nmap.
Next, we'll talk about Nmap's requirements
for the use of IPv6.
Finally, we'll go over
the command line options you need to know in order
to Nmap scans against IPv6 targets.
Since 2002, Nmap has supported IPV6.
IPv6 hasn't exactly taken the world by storm,
like most people, including me thought it might,
especially in the US.
I think this is thanks in part to
private addressing and network address translation.
Although ARIN has exhausted all of its IPv4 addresses,
I haven't seen a lot of instances where ISPs,
data centers, or Cloud service providers
haven't been able to provide
ample amount of IPv4 addresses
when justification has been provided.
Nevertheless, as network administrators
and information security professionals,
we must know how to deal with IPv6,
whether on a local network or over the Internet.
Most of Nmap scanning features work
just fine using IPv6 addresses.
For example, TCP only ping scanning,
connect scanning, and service
and application version detection.
One of the biggest pieces of advice I can
provide to you is that you run
Nmap scans against IPv6 targets
using their hostname instead of their IPv6 address.
The reason for this is pretty clear.
IPv6 addresses are a lot
longer and more complicated to type.
I'll go over the syntax later.
When you run your IPv6 scans,
you'll see that the output looks exactly the same.
The only difference is that you'll see
an IPv6 address at the top of your scan results.
This is nice because once you get used to
looking at scan results and Nmap,
the difference between v4 and v6 scans is negligible.
I've included a clip here from
an IPv6 scan with the address highlighted.
Here are some requirements for running
scans against IPv6 targets.
First, both your scanning station and
your target must be configured for IPv6.
When you're scanning a local network,
this usually isn't a problem.
You can scan either link local or site local addresses
>> without any problem at all.
>> However, if you're scanning a remote host,
you might run into more issues.
Even if you have an IPv6 configured on
your scanning station and
the remote target also has it configured,
your scan may fail.
The reason for this is that
your ISP hasn't provided you with
an IPv6 address or
your router or firewall is not configured with one.
In other words, your Nmap
scanning station must be able to
successfully route to your target using IPv6.
If your ISP hasn't provided you with
an IPv6 address you can use a tunnel broker service.
There are plenty of really good and free services
out there that will allow you to set up an account
and allow you to configure
your computer or your Internet access device
with IPv6 routing capabilities.
The last bullet point on this slide provides you
with a link to a really good tunnel broker service,
but feel free to search for others
>> and give them a shot.
>> Another way to do this is by using
6to4 IPv6 tunneling as described in RFC 3036.
Essentially this enables encapsulation of IPv6 packets
into IPv4 for transport across an IPv6 network.
For those who use Cisco pros,
this is essentially done using
dual stacking and it's pretty easy to accomplish.
Here are the command line options for
using IPv6 and Nmap.
Like I mentioned before, when you run
an Nmap scan against a target that uses IPv6,
you simply need to add the dash six option.
Or if you like to type,
you can use the dash, dash IPv6.
If you're scanning an IPv6 target
using its hostname or address,
one of these command lines which is essential.
The next option is dash capital S.
This command line switch allows you
to specify the source address.
In other words, you can use it to
specify a source address other than your own.
Essentially, this is IPv6 spoofing.
The third option here, dash,
dash hop dash limit space,
number of hops, sets the hop limit field and
packets sent from your scanning station.
This essentially determines how long
datagrams are allowed to exist on
the network and represents the number of
hops a packet can take before being dropped.
It acts very similarly to TTL and IPv4.
The last bullet point here
is a URL to this section and an
online Nmap book that
covers what I've talked about in this lesson.
It also provides you with a couple other
IPV6 command line options in case you're interested.
In this lesson, we went over the following;
>> First, we discussed some general IPv6 information
>> with regards to Nmap.
Next, we talked about Nmap's requirements
for the use of IPv6.
Finally, we went over
some command line options you need to know
in order to run Nmap scans against IPv6 targets.
Thanks so much for watching.
I'll see you in the next lesson.