timswiki - User contributions [en-gb]

ScanAutomation

2023-12-20T20:44:24Z

Wikiadmin:

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Default test using curl===

'''$ curl -sS "https://www66.chappell-family.co.uk/cgi-bin6/ipscanfasttxt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"'''

or

'''$ curl -sS "https://www66.chappell-family.co.uk/cgi-bin6/ipscanfasttxt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1" |awk -F'[<> ]' 'BEGIN{printf("\nPORT\tSTATE\n")};{for(i=4;i<=NF;i++){if (index($i,"OPEN")>0 && $(i-1)=="=" && $(i-3)=="Port") {printf("%s\t%s\n",$(i-2),$i)}}};' '''

<pre>
PORT STATE
80 OPEN
443 OPEN
1080 OPEN
3128 OPEN
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www66.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www66.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2023-10-21T17:07:17Z

Wikiadmin: /* Testing on Ubiquity ERlite Routers */

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www66.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www66.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2023-10-21T17:06:37Z

Wikiadmin: /* Testing the UDP ports, the default TCP ports list and 3 custom TCP ports */

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2023-10-21T17:05:41Z

Wikiadmin: /* Testing the UDP ports and a single TCP port, e.g. 8080 */

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2023-10-21T17:04:47Z

Wikiadmin: /* Testing just the UDP and TCP default port list */

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www66.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www66.chappell-family.co.uk... 2001:470:971f:99::6
Connecting to www66.chappell-family.co.uk|2001:470:971f:99::6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2023-10-21T17:03:52Z

Wikiadmin: /* Rules for Forming the URL */

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www66.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6

2023-10-21T17:02:54Z

Wikiadmin: Update IPv6 addresses.

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from the www66.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:99::6'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of the Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit the '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6 DEBUG

2022-07-09T17:19:15Z

Wikiadmin: /* IPv6 DEBUG */

== IPv6 DEBUG ==

Debug suggestions related to IPv6 configuration issues that might be encountered when accessing the [https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 firewall tester.]

For general IPv6 debug please see:

* [http://www.getipv6.info/index.php/Troubleshoot_IPv6_Issues Arin IPv6 debug - many useful links]
* [http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/index.html Linux IPv6 HOWTO]
* [http://technet.microsoft.com/en-us/library/cc737698%28WS.10%29.aspx Microsoft IPv6 Howto.]
* [http://n1.netalyzr.icsi.berkeley.edu/analysis/ Berkeley University Network analysis tool - very thorough, but requires Java]

=== General IPv6 Connectivity ===

First check your general IPv6 connectivity. At a command prompt or terminal check that your machine has a global unicast IPv6 address allocated (i.e. 2000::/3, so begins either 2XXX or 3XXX) as shown in these examples:

C:\Users>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : home.example.com
'''IPv6 Address. . . . . . . . . . . : 2xxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx'''
Temporary IPv6 Address. . . . . . : 2xxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
Link-local IPv6 Address . . . . . : fe80::xxxx:xxxx:xxxx:xxxx%10
IPv4 Address. . . . . . . . . . . : 192.168.33.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::xxxx:xxxx:xxxx:xxxx%10
192.168.33.1

On a Linux machine, or similar, then when queried as root, the response would look similar to:

machine:/home/user1 # ifconfig

eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:192.168.33.254 Bcast:192.168.33.255 Mask:255.255.255.0
'''inet6 addr: 2XXX:XXXX:XXXX:XXXX::XXXX/64 Scope:Global'''
inet6 addr: fe80::abc:c0ff:fede:xxxx/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:225635003 errors:0 dropped:0 overruns:0 frame:0
TX packets:268102245 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1533376458 (1462.3 Mb) TX bytes:1466607126 (1398.6 Mb)
Interrupt:220

Note: The output will differ from the above examples if you are using a tunneled approach, although it would still be useful to check that a valid IPv6 address is being allocated to your machine.

If you do NOT have a global unicast IPv6 address allocated then you need to determine the reason (which address allocation method are you using? DHCPv6, SLAAC or statically assigned addresses? If you're using SLAAC then can you detect router advertisements (ICMPv6) being broadcast? Use Wireshark/tcpdump to determine this.)

If you DO have a global unicast address, then you can check basic IPv6 connectivity using either ping (Windows) or ping6 (Linux). If you are using a tunnel then verify that you can ping/ping6 the distant end of the tunnel.

ping6 ipv6.google.com

you should see a response similar to:

ping6 ipv6.google.com

PING ipv6.google.com(fx-in-x63.1e100.net) 56 data bytes
64 bytes from fx-in-x63.1e100.net: icmp_seq=1 ttl=56 time=24.7 ms
64 bytes from fx-in-x63.1e100.net: icmp_seq=2 ttl=56 time=25.6 ms
...

If this is NOT successful then either your DNS AAAA lookups or general IPv6 connectivity is broken (determine which based on your error messages).

If you have a name lookup error then it is possible to bypass the DNS lookups and ping google's IPv6 host directly:

ping6 -c 3 2a00:1450:400c:c01::67

PING 2a00:1450:400c:c01::67(2a00:1450:400c:c01::67) 56 data bytes
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=1 ttl=56 time=19.0 ms
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=2 ttl=56 time=18.3 ms
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=3 ttl=56 time=18.3 ms

'''Caution: google's ipv6 address changes frequently - this was correct in Jan 2012, it may not be now!
'''

If this fails to work then your general IPv6 connectivity is broken! A few things to check if this is the case:

* Can successfully ping your router?
* Check your IPv6 routing table:

C:\Users\user1>route print
===========================================================================
Interface List
11...XX XX XX XX XX XX ......Intel(R) Centrino(R) Advanced-N 6200 AGN
10...YY YY YY YY YY YY ......Atheros AR8131 PCI-E Gigabit Ethernet Controller
1...........................Software Loopback Interface 1
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================
IPv4 Route Table
===========================================================================
removed for clarity
...
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
'''11 281 ::/0 fe80::XXXX:XXXX:XXXX:XXXX'''
1 306 ::1/128 On-link
15 58 2XXX::/32 On-link
15 306 2XXX:X:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 33 2XXX:XXXX:XXXX:XXXX::/64 On-link
11 281 2XXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 2XXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 fe80::/64 On-link
15 306 fe80::/64 On-link
15 306 fe80::XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 fe80::XXXX:XXXX:XXXX:XXXX/128
On-link
1 306 ff00::/8 On-link
15 306 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Or for a linux host:

machine:/home/user1 # '''ip -6 route show'''
2XXX:XXXX:XXXX:XXXX::/64 via :: dev tun-ipv6 proto kernel metric 256 mtu 1280 advmss 1220 hoplimit 4294967295
2XXX:XXXX:XXXX:XX::/64 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 via :: dev tun-ipv6 proto kernel metric 256 mtu 1280 advmss 1220 hoplimit 4294967295
'''default via 2XXX:XXXX:XXXX:XXXX::X dev tun-ipv6 metric 1024 mtu 1280 advmss 1220 hoplimit 4294967295'''

=== DNS Related Issues ===

If the direct ping6 does work then your DNS AAAA-record lookups may be broken. To check whether you can perform IPv6 AAAA lookups, at a command prompt try:

nslookup -type=aaaa ipv6.chappell-family.com

you should see a response similar to:

Server: ::1
Address: ::1#53

Non-authoritative answer:
ipv6.chappell-family.com has AAAA address 2001:470:1f08:185c::2

Authoritative answers can be found from:
ipv6.chappell-family.com nameserver = ns4.he.net.
ipv6.chappell-family.com nameserver = ns2.he.net.
ipv6.chappell-family.com nameserver = ns1.he.net.
ipv6.chappell-family.com nameserver = ns3.he.net.
ns1.he.net internet address = 216.218.130.2
ns2.he.net internet address = 216.218.131.2
ns2.he.net has AAAA address 2001:470:200::2
ns3.he.net internet address = 216.218.132.2
ns3.he.net has AAAA address 2001:470:300::2
ns4.he.net internet address = 216.66.1.2
ns4.he.net has AAAA address 2001:470:400::2

Based on the fact that must have already accessed the IPscan domain using IPv4, in order to be reading this, then the following IPv4 A-record lookup should work:

'''nslookup ipv6.chappell-family.com'''

Server: ::1
Address: ::1#53

Non-authoritative answer:
Name: ipv6.chappell-family.com
Address: B.C.D.E

If you don't get a similar response then you need to investigate your DNS setup, or perhaps your ISP's.

=== DNS Resolver Issues ===

Some DNS services don't seem to reliably resolve AAAA lookups. In particular, some appear to resolve A and AAAA records with different delays, and/or reliability, which sometimes causes web-browsers to determine that only an IPv4 address exists since the IPv6 lookup resolves too slowly/unreliably. You can try one of the publicly accessible DNS resolvers as an alternative to your current providers' if you believe that this might be the case. For those using a tunneled IPv6 connection then it is likely that your tunnel provider also offers a DNS resolver:

* Hurricane Electric - see Available DNS resolvers section of your tunnel setup (may be 2001:470:20::2 and 74.82.42.42)

Other public IPv6 DNS resolvers:

* [https://developers.google.com/speed/public-dns/docs/using Google DNS Servers]
* [https://support.opendns.com/hc/en-us/articles/227986667-Does-OpenDNS-Support-IPv6- OpenDNS IPv6]

The order in which you list the resolvers in your DNS search list is important - so when trying a new resolver ensure that you place it at the front of your resolver list. Note that it is worth checking that you can communicate with the resolver '''before''' modifying your resolver list - if the resolver fails to respond then you may encounter significant delays when attempting to lookup a host. In a linux environment this can be checked using a command similar to:

machine:/home/user1 # '''host ipv6.chappell-family.com 2001:4860:4860::8888'''

Using domain server:
Name: 2001:4860:4860::8888
Address: 2001:4860:4860::8888#53
Aliases:

ipv6.chappell-family.com has address 212.159.122.74
ipv6.chappell-family.com has IPv6 address 2001:470:1f08:185c::2
ipv6.chappell-family.com mail is handled by 10 mail.ipv6.chappell-family.com.

Note that it isn't necessary to access your DNS resolver using IPv6 if you don't want to - as long as the DNS server supports AAAA queries then this is sufficient. The same query, but on a windows machine, using Google's IPv4 resolver:

C:\Users\user1>'''nslookup ipv6.chappell-family.com 8.8.4.4'''
Server: google-public-dns-b.google.com
Address: 8.8.4.4

Non-authoritative answer:
Name: ipv6.chappell-family.com
Addresses: 2001:470:1f08:185c::2
212.159.122.74

=== WINDOWS 7 RESPONSES ===

A correctly configured Windows 7 machine shows the following responses:

ipv6.chappell-family.com has two DNS entries (AAAA and A records) and consequently returns two addresses:

nslookup ipv6.chappell-family.com

Server: server.example.com
Address: 192.168.33.1

Non-authoritative answer:
Name: ipv6.chappell-family.com
Addresses: 2001:470:1f08:185c::2
212.159.122.74

www6.ipv6.chappell-family.co.uk has a single AAAA DNS record:

nslookup www6.ipv6.chappell-family.co.uk

Server: server.example.com
Address: 192.168.33.1

Name: www6.ipv6.chappell-family.co.uk
Address: 2001:470:1f08:185c::2

Assuming these work correctly then a ping should also resolve:

ping www6.ipv6.chappell-family.co.uk

Pinging www6.ipv6.chappell-family.co.uk [2001:470:1f08:185c::2] with 32 bytes of data:
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms

Ping statistics for 2001:470:1f08:185c::2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

=== Browser IPv6 Prioritisation ===

If all of the above was successful then your browser may not be prioritising IPv6 DNS requests. The following browsers are known to support IPv6 prioritisation:

* Microsoft's Internet Explorer,
* Google's Chrome
* Apple's Safari
* Mozilla's Firefox (but see the section below)
* w3m
* lynx

If you believe your browser is not prioritising IPv6 then check whether you can access the following URLs:

* [http://ipv6.google.com Google's IPv6-only-URL]
* [http://www6.chappell-family.co.uk/ An IPv6-only-URL]

Both of the above links are for IPv6-only websites - i.e. they have no IPv4 DNS entry - so if you get an error accessing these websites despite being able to perform the DNS lookups correctly then your browser is not prioritising IPv6.

At this point it would be worthwhile checking whether another browser (from the list above) gives the same result.

=== Firefox IPv6 DNS Prioritisation Specific ===

Firefox has a specific configuration option with which to disable IPv6 DNS queries (I recently came across Firefox on Linux Mint v12 being configured this way). The option can be displayed by entering the following url into firefox:

about:config

Accept the warning about dragons, and then in the filter bar enter:

ipv6

The resulting list should now show an entry:

network.dns.disableIPv6

If this entry is set to '''true''' then double click on the entry to change its sense to '''FALSE'''. Then try again!

=== IPv6-only URL Test ===

and finally pointing your web browser towards the [http://www64.chappell-family.co.uk/cgi-bin6/ipscanjs.cgi IPv6-only Raspberry Pi Powered port scanner] should also work.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2022-07-09T17:16:16Z

Wikiadmin:

==IPscan IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target the IPscan IPv6 host and IPv6 cgi-bin directory (www64.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6 SpecialTests

2022-07-09T17:14:46Z

Wikiadmin: /* Links to other material */

==IPv6 Special Tests==

IPscan includes the following tests to identify known weak protocols or poorly configured services, which may be exploited.

It is important to note that the same exploits may well apply to IPv4 hosts running the same protocols.

===Links to other material===

* [[IPv6]] - an overview of IPscan (IPv6 Port Scanner)
* [[IPv6_Firewalls]] - some observations on IPv6 firewalls and address selections
* [[IPv6_Ports]] - a list of the default TCP/IP and UDP/IP ports which IPscan will test
* [[ScanStatus]] - a description of the reportable states for each tested TCP/IP or UDP/IP port
* [[ScanAutomation]] - a quick overview of IPv6 TCP/UDP port scan automation using wget
* [[IPv6_DEBUG]] - some steps for debugging IPv6 access to the IPscan IPv6 Port Scanner
* [[IPv6_Windows7]] - some useful Win7 IPv6-related commands
* [[Raspberry_Pi_IPv6_firewall_tester]] - a quick HowTo describing the steps to make your own RasPi-powered IPv6 firewall tester.

===NTP Monitor List Query '''UDP/123[1]'''===

The NTP protocol daemon, in versions prior to 4.2.7, supported a feature which reported a list of up to 600 clients which had used the queried NTP server as their time reference.

If an attacker uses a spoofed source address then a victim can be flooded with considerable NTP traffic. The size of the response is typically considerably larger than the request and consequently the attacker is able to amplify the volume of traffic directed at the victim. Additionally, because the responses are legitimate data coming from valid servers, it is especially difficult to block these types of attacks. The solution is to disable “monlist” within the NTP server or to upgrade to the latest version of NTP (4.2.7) which disables the “monlist” functionality.

To prevent your NTP daemon being used in DDoS attacks it is necessary to disable “monlist” functionality. On a public-facing NTP server that cannot be updated to version 4.2.7 or later, add the “noquery” directive to the “restrict default” line in the system’s ntpd.conf, as shown below:

<pre>
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
</pre>

See [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211 CVE-2013-5211] for further details.

===SNMP Queries '''UDP/161'''===

IPscan performs three SNMP queries. SNMP supports a variety of versions and authentication methods and since IPscan cannot know the credentials to use to test your system it defaults to using commonly-used, and therefore '''''insecure''''', community strings.

<TABLE border="1" style="width:300px">
<TR><TH>Port/Special Case</TH><TH>SNMP version</TH><TH>Test performed, credentials used</TH></TR>
<TR><TD>UDP/161</TD><TD>v1</TD><TD>GET with 'public' community string</TD></TR>
<TR><TD>UDP/161[1]</TD><TD>v2c</TD><TD>GET with 'private' community string</TD></TR>
<TR><TD>UDP/161[2]</TD><TD>v3</TD><TD>EngineID Discovery, credentials not required</TD></TR>
</TABLE>

This website publishes a Privacy Policy. Continued use of this website implies your consent to the use of data outlined in the policy.
----

ScanStatus

2022-07-09T17:13:59Z

Wikiadmin: /* Reported Status for Tim's IPv6 Port Scanner */

== Reported Status for the IPscan IPv6 Port Scanner==

For an overview of the scanner, including example results and capabilities, please see the introduction at '''[[IPv6]]'''. For IANA ICMPv6 mappings please see '''[[ICMPv6_Types_Codes]]'''. If you're interested in test automation then please see the '''[[ScanAutomation]]''' section.

Each port tested by the '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 Port Scanner]''' will return one of the following states:

<table border="1">
<tr>
<th scope="col">Port Status</th>
<th scope="col">Definition</th>
</tr>

<tr>
<td bgcolor="red">OPEN</td>
<td>An IPv6 TCP connection was successfully established to this port. You should check that this is the expected outcome since an attacker may be able to compromise your machine by accessing this IPv6 address/port combination.</td>
</tr>

<tr>
<td bgcolor="green">STLTH</td>
<td>No response was received from your machine in the allocated time period. This is the ideal response since no-one can ascertain your machines' presence at this IPv6 address/port combination.</td>
</tr>

<tr>
<td bgcolor="yellow">ABRT</td>
<td>An abort indication was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">RFSD</td>
<td>A refused indication (TCP RST/ACK or ICMPv6 type 1 code 4) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">CRST</td>
<td>A connection reset request was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">NRST</td>
<td>A network reset request was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">PHBTD</td>
<td>An administratively prohibited response (ICMPv6 type 1 code 1) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">NUNRCH</td>
<td>An unreachable response (ICMPv6 type 1 code 0) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">HUNRCH</td>
<td>A No route to host response (ICMPv6 type 1 code 3 or ICMPv6 type 3) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">TOOBIG</td>
<td>A Packet too big response (ICMPv6 type 2) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="yellow">PRMPRB</td>
<td>A Parameter problem response (ICMPv6 type 4) was received when attempting to open this port. Someone can ascertain that your machine is responding on this IPv6 address/port combination, but cannot establish a TCP connection.</td>
</tr>

<tr>
<td bgcolor="red">UDPOPEN</td>
<td>A valid UDP response was received in response to the UDP packet sent to this port. You should check that this is the expected outcome since an attacker may be able to compromise your machine by accessing this IPv6 address/port combination.</td>
</tr>

<tr>
<td bgcolor="green">UDPSTEALTH</td>
<td>No UDP response was received from your machine in the allocated time period. This is the ideal response since no-one can ascertain your machines' presence at this IPv6 address/port combination.</td>
</tr>

</table>

'''NOTE: Results in the ICMPv6 ECHO REQUEST test marked as INDIRECT indicate an ICMPv6 error response was received from another host (e.g. a router or firewall) rather than the host under test. In this case the IPv6 address of the responding host is also displayed.
'''

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6 Ports

2022-07-09T17:12:35Z

Wikiadmin: /* IPv6 Firewall Tester Default Port List */

== IPv6 Firewall Tester Default Port List ==

IPscan tests a selection of the most commonly used service ports.

If you wish to test the firewall of your IPv6 host then please point your browser towards the '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 tester]'''. For an overview of the tester please see '''[[IPv6]]'''. For an explanation of test automation please see '''[[ScanAutomation]]'''.

The list of default IPv6 TCP ports which can be tested, and their common usage is defined in the table below:

==TCP Ports==

<table border="1">
<tr>
<th scope="col">Port Number</th>
<th scope="col">Description of the traffic usually assigned to this port</th>
</tr>

<tr>
<td>7</td>
<td>Echo - often used for test/development purposes.</td>
</tr>

<tr>
<td>21</td>
<td>File Transfer (FTP) control</td>
</tr>

<tr>
<td>22</td>
<td>The Secure Shell (SSH) Protocol</td>
</tr>

<tr>
<td>23</td>
<td>Telnet</td>
</tr>

<tr>
<td>25</td>
<td>Simple Mail Transfer Protocol (SMTP)</td>
</tr>

<tr>
<td>37</td>
<td>Time</td>
</tr>

<tr>
<td>53</td>
<td>Domain Name Server (DNS)</td>
</tr>

<tr>
<td>79</td>
<td>Finger</td>
</tr>

<tr>
<td>80</td>
<td>World Wide Web (HTTP)</td>
</tr>

<tr>
<td>88</td>
<td>Kerberos</td>
</tr>

<tr>
<td>110</td>
<td>Post Office Protocol - Version 3 (POP3)</td>
</tr>

<tr>
<td>111</td>
<td>Sun Remote Procedure Call (RPC)</td>
</tr>

<tr>
<td>113</td>
<td>Authentication Service (ident, auth)</td>
</tr>

<tr>
<td>119</td>
<td>Network News Transfer Protocol (NNTP)</td>
</tr>

<tr>
<td>135</td>
<td>DCE endpoint resolution (epmap), Microsoft EPMAP RPCs, Messenger services</td>
</tr>

<tr>
<td>137</td>
<td>NETBIOS Name Service</td>
</tr>

<tr>
<td>138</td>
<td>NETBIOS Datagram Service</td>
</tr>

<tr>
<td>139</td>
<td>NETBIOS Session Service</td>
</tr>

<tr>
<td>143</td>
<td>Internet Message Access Protocol (IMAP)</td>
</tr>

<tr>
<td>311</td>
<td>AppleShare IP WebAdmin, MAC OSX server admin</td>
</tr>

<tr>
<td>389</td>
<td>Lightweight Directory Access Protocol (LDAP)</td>
</tr>

<tr>
<td>427</td>
<td>Server Location (SLP)</td>
</tr>

<tr>
<td>443</td>
<td>HTTP Protocol over TLS/SSL (HTTPS)</td>
</tr>

<tr>
<td>445</td>
<td>Microsoft-DS (SMB, Samba)</td>
</tr>

<tr>
<td>514</td>
<td>Shell</td>
</tr>

<tr>
<td>543</td>
<td>Kerberos login</td>
</tr>

<tr>
<td>544</td>
<td>Kerberos remote shell</td>
</tr>

<tr>
<td>548</td>
<td>Apple Filing Protocol over TCP</td>
</tr>

<tr>
<td>631</td>
<td>Internet Printing Protocol (IPP)</td>
</tr>

<tr>
<td>749</td>
<td>Kerberos Administration</td>
</tr>

<tr>
<td>873</td>
<td>Rsync</td>
</tr>

<tr>
<td>993</td>
<td>IMAP4 Protocol over TLS/SSL (IMAPS)</td>
</tr>

<tr>
<td>1025</td>
<td>Network Blackjack, sometimes NFS, IIS or RFS</td>
</tr>

<tr>
<td>1026</td>
<td>Calendar Access Protocol (CAP), Microsoft DCOM</td>
</tr>

<tr>
<td>1029</td>
<td>Solid Mux Server, Microsoft DCOM</td>
</tr>

<tr>
<td>1030</td>
<td>BBN IAD</td>
</tr>

<tr>
<td>1080</td>
<td>SOCKS</td>
</tr>

<tr>
<td>1720</td>
<td>H.323 Hostcall - including Microsoft Netmeeting</td>
</tr>

<tr>
<td>2869</td>
<td>SSDP event notification</td>
</tr>

<tr>
<td>3128</td>
<td>Active API Server Port (also default for Squid proxy)</td>
</tr>

<tr>
<td>3306</td>
<td>MySQL</td>
</tr>

<tr>
<td>3389</td>
<td>MS Windows Based Terminal Server (RDP)</td>
</tr>

<tr>
<td>3689</td>
<td>Digital Audio Access Protocol (DAAP, iTunes)</td>
</tr>

<tr>
<td>5000</td>
<td>Commplex-main (Windows Universal Plug and Play service - UPNP)</td>
</tr>

<tr>
<td>5100</td>
<td>Socalia service mux, Yahoo Messenger, Webcams</td>
</tr>

<tr>
<td>5357</td>
<td>WSDAPI HTTP</td>
</tr>

<tr>
<td>5900</td>
<td>Remote Framebuffer (VNC Server)</td>
</tr>

<tr>
<td>8080</td>
<td>HTTP alternate</td>
</tr>

<tr>
<td>9090</td>
<td>WebSM</td>
</tr>

<tr>
<td>10243</td>
<td>WMP HTTP</td>
</tr>

<tr>
<td>11211</td>
<td>memcache</td>
</tr>

<tr>
<td>16992-4</td>
<td>Intel AMT</td>
</tr>

<tr>
<td>32764</td>
<td>Common Router backdoor</td>
</tr>

</table>

==UDP Ports==

The list of IPv6 UDP ports which will always be tested, and their common usage is defined in the table below:

<table border="1">
<tr>
<th scope="col">Port Number</th>
<th scope="col">Description of the traffic usually assigned to this port</th>
</tr>

<tr>
<td>53</td>
<td>DNS</td>
</tr>

<tr>
<td>69</td>
<td>TFTP</td>
</tr>

<tr>
<td>123</td>
<td>NTP</td>
</tr>

<tr>
<td>161</td>
<td>SNMP</td>
</tr>

<tr>
<td>500</td>
<td>IKE</td>
</tr>

<tr>
<td>521</td>
<td>RIPng</td>
</tr>

<tr>
<td>547</td>
<td>DHCPv6</td>
</tr>

<tr>
<td>1900</td>
<td>UPnP (SSDP)</td>
</tr>

<tr>
<td>3503</td>
<td>LSP Ping</td>
</tr>

<tr>
<td>4500</td>
<td>IKE-NATT</td>
</tr>

<tr>
<td>11211</td>
<td>memcache (ASCII and binary)</td>
</tr>

</table>

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6 Firewalls

2022-07-09T17:11:49Z

Wikiadmin: /* Testing your IPv6 Firewall */

==IPv6 Firewalls==

===General Observations===

IPv6 firewalls are separate from, and often control network traffic in different ways to, current IPv4 firewalls. IPv4 has evolved from its original flat architecture to involve multiple layers of hierarchy in order to support the burgeoning number of nodes that make up the internet. Not only can the imposed hierarchy offer some security in itself but clients have often relied on their online visibility and security being provided by another node (e.g. an ADSL router). This assumed protection, and the likelihood that it is missing if you connect your client to a foreign (non-home) network, is behind the frequently reported incidents of "coffee shop" wifi attacks.

IPv6 intends to revert the network hierarchy back towards a flat structure, where any node can talk directly to any other IPv6 node. In line with this approach routers '''may''' or '''may not''' firewall IPv6 traffic for clients that operate behind them. This has several implications for the clients:

* Clients may have globally routable IPv6 addresses
* Clients may be solely responsible for their own security/firewall protection (safest to assume this is the case for both IPv6 and IPv4)
* Clients may have more than one active IPv6 address
* Clients may frequently change their IPv6 address if using privacy addresses, as per [http://tools.ietf.org/html/rfc4941 RFC4941]

In response to this many of the current IPv6-enabled client devices (e.g. iOS and Android devices) include their own IPv6 firewalls, which are usually enabled by default.

IPv6 brings two other scenarios that mobile clients (i.e. those connecting to more than one network) need to consider:

* Currently shipping operating systems have IPv6 enabled by default
* Even if your home network doesn't have IPv6 enabled, you can't assume other networks won't have

As a consequence of all of the above changes it is imperative that you '''ensure that your IPv6-enabled client devices have their IPv6 firewall enabled''', and it is protecting the services running on your client. It is also advisable to disable any IPv6 services that you do not require (e.g. tunneling protocols that you are not actively using - this is especially applicable to Windows 7 clients).

One other change IPv6 introduces compared to IPv4 is that additional ICMP traffic flows are necessary for normal protocol signalling whereas it was predominantly used for error-case reporting in IPv4 networks. This requires IPv6 firewalls to admit certain [[ICMPv6_Types_Codes]] in order to handle IPv6 address allocation, neighbour discovery (IPv6 replacement for ARP) and several other IPv6 processes. For many client devices this will be handled directly by the firewall itself, but if you are developing your own IPv6 firewall then you need to ensure you follow the recommendations in [http://www.ietf.org/rfc/rfc4890.txt RFC4890] which includes an ip6tables packet filter example.

===IPv6 Addresses===

One other observation relates to the selection of an IPv6 address for your host. There are three main IPv6 address allocation approaches:

* Static unicast address allocation
* Stateless Address Autoconfiguration (SLAAC)
* DHCPv6

A full IPv6 address is composed of a network address part (perhaps 64 bits) and a host address part (often 64 bits). Dependant upon the scheme that your host uses you '''may''' be able to freely select the host address part - e.g. when using static address allocation. Despite what you may find written elsewhere you are only safe from IPv6 port scans if the address of your machine is not easily discoverable within its IPv6 subnet. On this basis I suggest that you fight the urge to allocate easy to type/remember addresses (e.g. <network-address-part>::1 and any that use a mix of frequently used hexadecimal addresses that spell words - i.e. 0xdead, 0xbeef, 0xface). Many machines appear to use such allocations in their host address part and if you were writing an IPv6 port scanner then surely addresses using such choices would be the place that you would start scanning? A DNS with suitable Quad-A entries is your friend in this situation.

Other useful links:

* [https://tools.ietf.org/id/draft-ietf-opsec-v6-12.html Operational Security Considerations for IPv6 Networks]
* [https://tools.ietf.org/html/rfc7707 Network Reconnaissance in IPv6 Networks]

===Testing your IPv6 Firewall===

As well as ensuring that your IPv6 firewall is enabled it is '''''strongly recommended''''' that you actively test that it is correctly protecting your host. I have received feedback from several disgruntled users detailing how their default firewall settings either weren't blocking any IPv6 traffic at all (e.g. some DLINK IPv6 enabled products and certain UK ISP-provided firewalls) or were leaving critical services open for remote access. That is not to say that any of these products are necessarily "broken", or "unfit for purpose", merely that they don't necessarily perform in the same way for IPv6 traffic as they did for IPv4 traffic.

If you wish to verify the operation of your IPv6 firewall then try the [https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 firewall checker] which checks your machine's IPv6 Ping response and scans a set of UDP ports and user-defined TCP ports.

A '''''starting point''''' for an IPv6 iptables-based firewall can be found in the [[Raspberry_Pi_IPv6_firewall_tester_installation]] section.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6

2022-07-09T17:10:15Z

Wikiadmin: /* Source code */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from the www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of the Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit the '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2022-07-09T17:09:46Z

Wikiadmin: /* Raspberry Pi Powered IPv6 Firewall Tester */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from the www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of the Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2022-07-09T17:09:28Z

Wikiadmin: /* Test Server Source IPv6 Addresses */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from the www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2022-07-09T17:09:09Z

Wikiadmin: /* The Test */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2022-07-09T17:08:13Z

Wikiadmin: /* Introduction */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

Main Page

2022-07-09T17:06:02Z

Wikiadmin: /* Introduction */

==Introduction==

Welcome to the IPscan wiki, for the online, [https://www.github.com/timsgit/ipscan opensource], IPv6 Port Scanner. This service supports testing of multiple IPv6 UDP and TCP ports on any internet connected host with a global IPv6 unicast address (2000::/3), irrespective of your IPv6 provider or device operating system. In order to be as flexible as possible the tested TCP ports are selectable from a mix of commonly-used ports and/or user-defined ports.

==IPv6 Port Scanner Related==

* '''[[IPv6]] Firewall tester''' - an overview of the [https://github.com/timsgit/ipscan Opensource] IPscan IPv6 Port Scanner
* '''[[IPv6_Firewalls]]''' - some observations on IPv6 firewalls and address selections
* '''IPv6 Firewall tester default [[IPv6_Ports]]''' - list of default TCP/IP and UDP/IP ports which the IPscan IPv6 Firewall Scanner will test
* '''IPv6 firewall tester [[ScanStatus]]''' - a description of the reportable states for each tested TCP/IP or UDP/IP port
* '''[[IPv6_SpecialTests]]''' - a description of specific protocol tests which IPscan performs
* '''IPv6 firewall [[ScanAutomation]]''' - a quick overview of IPv6 TCP/UDP port-scan automation using wget
* '''[[IPv6_DEBUG]]''' - some steps for debugging IPv6 access to the IPscan IPv6 Port Scanner
* '''[[IPv6_Windows7]]''' - some useful Win7 IPv6-related commands
* '''[[Raspberry_Pi_IPv6_firewall_tester]]''' - a quick HowTo describing the steps to make your own IPv6 firewall tester.
* '''[[Security_reporting_and_acknowledgements]]''' - a page describing our security policy and researcher acknowledgements

For those in a rush please follow the '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 firewall tester link]'''.

==Articles and Linux related==

* '''[[Articles]]''' - including topics like [https://ipv6.chappell-family.com/docs/ipsec_v01.pdf practical Linux IPsec] and ARM floating point programming
* '''[https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf Squid Proxy as an IPv4/IPv6 translator]''' - Allow '''''ALL''''' your client devices to access IPv4-only, IPv4/IPv6 dual-stacked and IPv6-only websites
* '''[[Linux]]''' - Linux related information
* '''[[Zyxel]]''' - Zyxel Prestige Modem commands
* '''[[Munin]] Printer Plugins''' - Plugins for HP [[DJ6840]], [[C309a]] and [[e710]] printers and AIO devices
* '''[[Munin]] Motherboard Plugins''' - Plugins for Intel [[D945GCLF2]] and [[DH67CF]] Motherboards
* '''[[Munin]] UPS Plugins''' - APC [[UPS]]

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

Main Page

2022-07-09T17:04:36Z

Wikiadmin: /* IPv6 Port Scanner Related */

==Introduction==

Welcome to the site of my online, [https://www.github.com/timsgit/ipscan opensource], IPv6 Port Scanner. This service supports testing of multiple IPv6 UDP and TCP ports on any internet connected host with a global IPv6 unicast address (2000::/3), irrespective of your IPv6 provider or device operating system. In order to be as flexible as possible the tested TCP ports are selectable from a mix of commonly-used ports and/or user-defined ports.

==IPv6 Port Scanner Related==

* '''[[IPv6]] Firewall tester''' - an overview of the [https://github.com/timsgit/ipscan Opensource] IPscan IPv6 Port Scanner
* '''[[IPv6_Firewalls]]''' - some observations on IPv6 firewalls and address selections
* '''IPv6 Firewall tester default [[IPv6_Ports]]''' - list of default TCP/IP and UDP/IP ports which the IPscan IPv6 Firewall Scanner will test
* '''IPv6 firewall tester [[ScanStatus]]''' - a description of the reportable states for each tested TCP/IP or UDP/IP port
* '''[[IPv6_SpecialTests]]''' - a description of specific protocol tests which IPscan performs
* '''IPv6 firewall [[ScanAutomation]]''' - a quick overview of IPv6 TCP/UDP port-scan automation using wget
* '''[[IPv6_DEBUG]]''' - some steps for debugging IPv6 access to the IPscan IPv6 Port Scanner
* '''[[IPv6_Windows7]]''' - some useful Win7 IPv6-related commands
* '''[[Raspberry_Pi_IPv6_firewall_tester]]''' - a quick HowTo describing the steps to make your own IPv6 firewall tester.
* '''[[Security_reporting_and_acknowledgements]]''' - a page describing our security policy and researcher acknowledgements

For those in a rush please follow the '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPscan IPv6 firewall tester link]'''.

==Articles and Linux related==

* '''[[Articles]]''' - including topics like [https://ipv6.chappell-family.com/docs/ipsec_v01.pdf practical Linux IPsec] and ARM floating point programming
* '''[https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf Squid Proxy as an IPv4/IPv6 translator]''' - Allow '''''ALL''''' your client devices to access IPv4-only, IPv4/IPv6 dual-stacked and IPv6-only websites
* '''[[Linux]]''' - Linux related information
* '''[[Zyxel]]''' - Zyxel Prestige Modem commands
* '''[[Munin]] Printer Plugins''' - Plugins for HP [[DJ6840]], [[C309a]] and [[e710]] printers and AIO devices
* '''[[Munin]] Motherboard Plugins''' - Plugins for Intel [[D945GCLF2]] and [[DH67CF]] Motherboards
* '''[[Munin]] UPS Plugins''' - APC [[UPS]]

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6

2022-07-09T17:02:22Z

Wikiadmin: /* Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner) */

==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

Security reporting and acknowledgements

2022-05-25T19:25:26Z

Wikiadmin: /* IPv6 Firewall Tester Security Reporting Policy */

= IPv6 Firewall Tester Security Reporting Policy =

Vulnerability researchers should securely and responsibly report discovered vulnerabilities relating to the [https://ipv6.chappell-family.com/ipv6tcptest IPv6 firewall tester website] using the email address and PGP key specified in the [https://ipv6.chappell-family.com/.well-known/security.txt .well-known/security.txt] file.

= IPv6 Firewall Tester Security Reporting Acknowledgements =

All researchers who responsibly report vulnerabilities will be credited here.

Security reporting and acknowledgements

2022-05-25T19:24:41Z

Wikiadmin: /* IPv6 Firewall Tester Security Reporting Policy */

= IPv6 Firewall Tester Security Reporting Policy =

Vulnerability researchers should securely and responsibly report discovered vulnerabilities related to the [https://ipv6.chappell-family.com/ipv6tcptest IPv6 firewall tester website] using the email address and PGP key specified in the [https://ipv6.chappell-family.com/.well-known/security.txt .well-known/security.txt] file.

= IPv6 Firewall Tester Security Reporting Acknowledgements =

All researchers who responsibly report vulnerabilities will be credited here.

Security reporting and acknowledgements

2022-05-25T19:23:26Z

Wikiadmin: Security policy and acknowledgements page

= IPv6 Firewall Tester Security Reporting Policy =

Vulnerability researchers should securely and responsibly report discovered vulnerabilities related to the ipv6.chappell-family.com website using the email address and PGP key specified in the [https://ipv6.chappell-family.com/.well-known/security.txt .well-known/security.txt] file.

= IPv6 Firewall Tester Security Reporting Acknowledgements =

All researchers who responsibly report vulnerabilities will be credited here.

Main Page

2022-05-25T19:13:30Z

Wikiadmin: /* IPv6 Port Scanner Related */

==Introduction==

Welcome to the site of my online, [https://www.github.com/timsgit/ipscan opensource], IPv6 Port Scanner. This service supports testing of multiple IPv6 UDP and TCP ports on any internet connected host with a global IPv6 unicast address (2000::/3), irrespective of your IPv6 provider or device operating system. In order to be as flexible as possible the tested TCP ports are selectable from a mix of commonly-used ports and/or user-defined ports.

==IPv6 Port Scanner Related==

* '''[[IPv6]] Firewall tester''' - an overview of my [https://github.com/timsgit/ipscan Opensource] IPv6 Port Scanner
* '''[[IPv6_Firewalls]]''' - some observations on IPv6 firewalls and address selections
* '''IPv6 Firewall tester default [[IPv6_Ports]]''' - list of default TCP/IP and UDP/IP ports which my IPv6 Firewall Scanner will test
* '''IPv6 firewall tester [[ScanStatus]]''' - a description of the reportable states for each tested TCP/IP or UDP/IP port
* '''[[IPv6_SpecialTests]]''' - a description of specific protocol tests which IPscan performs
* '''IPv6 firewall [[ScanAutomation]]''' - a quick overview of IPv6 TCP/UDP port scan automation using wget
* '''[[IPv6_DEBUG]]''' - some steps for debugging IPv6 access to my IPv6 Port Scanner
* '''[[IPv6_Windows7]]''' - some useful Win7 IPv6-related commands
* '''[[Raspberry_Pi_IPv6_firewall_tester]]''' - a quick HowTo describing the steps to make your own IPv6 firewall tester.
* '''[[Security_reporting_and_acknowledgements]]''' - a page describing our security policy and researcher acknowledgements

For those in a rush please follow the '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPv6 firewall tester link]'''.

==Articles and Linux related==

* '''[[Articles]]''' - including topics like [https://ipv6.chappell-family.com/docs/ipsec_v01.pdf practical Linux IPsec] and ARM floating point programming
* '''[https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf Squid Proxy as an IPv4/IPv6 translator]''' - Allow '''''ALL''''' your client devices to access IPv4-only, IPv4/IPv6 dual-stacked and IPv6-only websites
* '''[[Linux]]''' - Linux related information
* '''[[Zyxel]]''' - Zyxel Prestige Modem commands
* '''[[Munin]] Printer Plugins''' - Plugins for HP [[DJ6840]], [[C309a]] and [[e710]] printers and AIO devices
* '''[[Munin]] Motherboard Plugins''' - Plugins for Intel [[D945GCLF2]] and [[DH67CF]] Motherboards
* '''[[Munin]] UPS Plugins''' - APC [[UPS]]

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

File:IPscan results 2019.png

2019-09-26T19:30:35Z

Wikiadmin: Wikiadmin uploaded a new version of File:IPscan results 2019.png

== Summary ==
IPscan typical results 2019

File:IPscan results 2019.png

2019-09-26T19:06:12Z

Wikiadmin: Wikiadmin uploaded a new version of File:IPscan results 2019.png

== Summary ==
IPscan typical results 2019

File:IPscan results 2019.png

2019-09-26T19:02:33Z

Wikiadmin: Wikiadmin uploaded a new version of File:IPscan results 2019.png

== Summary ==
IPscan typical results 2019

File:IPscan results key1.png

2019-09-26T18:59:35Z

Wikiadmin: Wikiadmin uploaded a new version of File:IPscan results key1.png

== Summary ==
IPscan key results page 1, 2019

IPv6

2019-09-25T19:22:48Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2019-09-25T19:17:01Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2019-09-25T19:11:49Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figure below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:Results12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_results_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www6.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

Tests performed from my Raspberry Pi host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2019-09-25T19:08:12Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as encircled in the figure below.

[[File:IPscan_Landing_2019.png|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version (right-hand figures) can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version (left-hand figures) supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some OS and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:Kickoff12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_kickoff_LR.jpg |320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight kickoff page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figure below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:Results12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_results_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www6.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

Tests performed from my Raspberry Pi host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

IPv6

2019-09-25T19:07:13Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as encircled in the figure below.

[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_landing_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version (right-hand figures) can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version (left-hand figures) supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some OS and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:Kickoff12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_kickoff_LR.jpg |320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight kickoff page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figure below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:Results12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_results_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www6.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

Tests performed from my Raspberry Pi host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.

File:IPscan results key2.png

2019-09-25T19:03:15Z

Wikiadmin: IPscan key results page 2, 2019

== Summary ==
IPscan key results page 2, 2019

File:IPscan results key1.png

2019-09-25T19:00:16Z

Wikiadmin: IPscan key results page 1, 2019

== Summary ==
IPscan key results page 1, 2019

File:IPscan results 2019.png

2019-09-25T18:58:37Z

Wikiadmin: IPscan typical results 2019

== Summary ==
IPscan typical results 2019

File:IPscan kickoff 2019.png

2019-09-25T18:56:52Z

Wikiadmin: IPscan kickoff page 2019.

== Summary ==
IPscan kickoff page 2019.

File:IPscan Landing 2019.png

2019-09-25T18:51:49Z

Wikiadmin: IPscan Landing Page 2019.

== Summary ==
IPscan Landing Page 2019.

ScanAutomation

2019-09-25T18:31:50Z

Wikiadmin: Changes to reflect new server.

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www64.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www64.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1
Resolving www64.chappell-family.co.uk... 2001:470:971f:6::4
Connecting to www64.chappell-family.co.uk|2001:470:971f:6::4|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www64.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6 Ports

2019-07-20T16:12:16Z

Wikiadmin:

== IPv6 Firewall Tester Default Port List ==

IPscan tests a selection of the most commonly used service ports.

If you wish to test the firewall of your IPv6 host then please point your browser towards my '''[https://ipv6.chappell-family.com/ipv6tcptest/ IPv6 tester]'''. For an overview of the tester please see '''[[IPv6]]'''. For an explanation of test automation please see '''[[ScanAutomation]]'''.

The list of default IPv6 TCP ports which can be tested, and their common usage is defined in the table below:

==TCP Ports==

<table border="1">
<tr>
<th scope="col">Port Number</th>
<th scope="col">Description of the traffic usually assigned to this port</th>
</tr>

<tr>
<td>7</td>
<td>Echo - often used for test/development purposes.</td>
</tr>

<tr>
<td>21</td>
<td>File Transfer (FTP) control</td>
</tr>

<tr>
<td>22</td>
<td>The Secure Shell (SSH) Protocol</td>
</tr>

<tr>
<td>23</td>
<td>Telnet</td>
</tr>

<tr>
<td>25</td>
<td>Simple Mail Transfer Protocol (SMTP)</td>
</tr>

<tr>
<td>37</td>
<td>Time</td>
</tr>

<tr>
<td>53</td>
<td>Domain Name Server (DNS)</td>
</tr>

<tr>
<td>79</td>
<td>Finger</td>
</tr>

<tr>
<td>80</td>
<td>World Wide Web (HTTP)</td>
</tr>

<tr>
<td>88</td>
<td>Kerberos</td>
</tr>

<tr>
<td>110</td>
<td>Post Office Protocol - Version 3 (POP3)</td>
</tr>

<tr>
<td>111</td>
<td>Sun Remote Procedure Call (RPC)</td>
</tr>

<tr>
<td>113</td>
<td>Authentication Service (ident, auth)</td>
</tr>

<tr>
<td>119</td>
<td>Network News Transfer Protocol (NNTP)</td>
</tr>

<tr>
<td>135</td>
<td>DCE endpoint resolution (epmap), Microsoft EPMAP RPCs, Messenger services</td>
</tr>

<tr>
<td>137</td>
<td>NETBIOS Name Service</td>
</tr>

<tr>
<td>138</td>
<td>NETBIOS Datagram Service</td>
</tr>

<tr>
<td>139</td>
<td>NETBIOS Session Service</td>
</tr>

<tr>
<td>143</td>
<td>Internet Message Access Protocol (IMAP)</td>
</tr>

<tr>
<td>311</td>
<td>AppleShare IP WebAdmin, MAC OSX server admin</td>
</tr>

<tr>
<td>389</td>
<td>Lightweight Directory Access Protocol (LDAP)</td>
</tr>

<tr>
<td>427</td>
<td>Server Location (SLP)</td>
</tr>

<tr>
<td>443</td>
<td>HTTP Protocol over TLS/SSL (HTTPS)</td>
</tr>

<tr>
<td>445</td>
<td>Microsoft-DS (SMB, Samba)</td>
</tr>

<tr>
<td>514</td>
<td>Shell</td>
</tr>

<tr>
<td>543</td>
<td>Kerberos login</td>
</tr>

<tr>
<td>544</td>
<td>Kerberos remote shell</td>
</tr>

<tr>
<td>548</td>
<td>Apple Filing Protocol over TCP</td>
</tr>

<tr>
<td>631</td>
<td>Internet Printing Protocol (IPP)</td>
</tr>

<tr>
<td>749</td>
<td>Kerberos Administration</td>
</tr>

<tr>
<td>873</td>
<td>Rsync</td>
</tr>

<tr>
<td>993</td>
<td>IMAP4 Protocol over TLS/SSL (IMAPS)</td>
</tr>

<tr>
<td>1025</td>
<td>Network Blackjack, sometimes NFS, IIS or RFS</td>
</tr>

<tr>
<td>1026</td>
<td>Calendar Access Protocol (CAP), Microsoft DCOM</td>
</tr>

<tr>
<td>1029</td>
<td>Solid Mux Server, Microsoft DCOM</td>
</tr>

<tr>
<td>1030</td>
<td>BBN IAD</td>
</tr>

<tr>
<td>1080</td>
<td>SOCKS</td>
</tr>

<tr>
<td>1720</td>
<td>H.323 Hostcall - including Microsoft Netmeeting</td>
</tr>

<tr>
<td>2869</td>
<td>SSDP event notification</td>
</tr>

<tr>
<td>3128</td>
<td>Active API Server Port (also default for Squid proxy)</td>
</tr>

<tr>
<td>3306</td>
<td>MySQL</td>
</tr>

<tr>
<td>3389</td>
<td>MS Windows Based Terminal Server (RDP)</td>
</tr>

<tr>
<td>3689</td>
<td>Digital Audio Access Protocol (DAAP, iTunes)</td>
</tr>

<tr>
<td>5000</td>
<td>Commplex-main (Windows Universal Plug and Play service - UPNP)</td>
</tr>

<tr>
<td>5100</td>
<td>Socalia service mux, Yahoo Messenger, Webcams</td>
</tr>

<tr>
<td>5357</td>
<td>WSDAPI HTTP</td>
</tr>

<tr>
<td>5900</td>
<td>Remote Framebuffer (VNC Server)</td>
</tr>

<tr>
<td>8080</td>
<td>HTTP alternate</td>
</tr>

<tr>
<td>9090</td>
<td>WebSM</td>
</tr>

<tr>
<td>10243</td>
<td>WMP HTTP</td>
</tr>

<tr>
<td>11211</td>
<td>memcache</td>
</tr>

<tr>
<td>16992-4</td>
<td>Intel AMT</td>
</tr>

<tr>
<td>32764</td>
<td>Common Router backdoor</td>
</tr>

</table>

==UDP Ports==

The list of IPv6 UDP ports which will always be tested, and their common usage is defined in the table below:

<table border="1">
<tr>
<th scope="col">Port Number</th>
<th scope="col">Description of the traffic usually assigned to this port</th>
</tr>

<tr>
<td>53</td>
<td>DNS</td>
</tr>

<tr>
<td>69</td>
<td>TFTP</td>
</tr>

<tr>
<td>123</td>
<td>NTP</td>
</tr>

<tr>
<td>161</td>
<td>SNMP</td>
</tr>

<tr>
<td>500</td>
<td>IKE</td>
</tr>

<tr>
<td>521</td>
<td>RIPng</td>
</tr>

<tr>
<td>547</td>
<td>DHCPv6</td>
</tr>

<tr>
<td>1900</td>
<td>UPnP (SSDP)</td>
</tr>

<tr>
<td>3503</td>
<td>LSP Ping</td>
</tr>

<tr>
<td>4500</td>
<td>IKE-NATT</td>
</tr>

<tr>
<td>11211</td>
<td>memcache (ASCII and binary)</td>
</tr>

</table>

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

Timswiki:Privacy policy

2019-07-20T16:08:55Z

Wikiadmin: Update to reflect introduction of CloudFlare CDN and session cookies on the wiki.

In line with recent changes to the Privacy and Electronic Communications Regulations and the introduction of the General Data Protection Regulations (GPDR) please be aware of the following related to both this wiki and the associated [https://ipv6.chappell-family.com/ipv6tcptest/ IPv6 Port Scanner]:

*'''All scan results are deleted shortly after your scan completes.'''

*'''The only retained statistic is the total number of initiated scans.'''

*'''The IPv6 Port Scanner facility makes no use of cookies.'''

*'''This wiki website makes use of the CloudFlare CDN to improve performance and consequently 3rd party session cookies are used.'''

*'''These websites make no use of 3rd party advertising or analytics facilities.'''

*'''All webserver logs for the IPv6 port scanner are purged on a daily basis.'''

*'''If you ask for support to debug unexpected IPv6 port scan results then I may temporarily offer you the use of separate, debug-only, URLs. In order for such support to be offered, some debug-related logging may occur. This may include the summary of port scan results and partial (/48 only) IPv6 addresses.'''

----

ScanAutomation

2019-02-09T16:51:12Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2019-02-09T16:48:20Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''

'''sudo scp /tmp/ipv6.html <user>@<host>:'''

'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/result.txt
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2019-02-09T16:47:33Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''
'''sudo scp /tmp/ipv6.html <user>@<host>:'''
'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G <nowiki>'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi'</nowiki> --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/result.txt
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2019-02-09T16:45:59Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

On the router:

'''sudo /usr/bin/curl -G 'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi' --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''
'''sudo scp /tmp/ipv6.html <user>@<host>:'''
'''sudo rm -f /tmp/ipv6.html'''

Exchange <user> and <host> for an applicable account and machine name to transfer the results file to.

<pre>sudo /usr/bin/curl -G 'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi' --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/result.txt
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2844 100 2844 0 0 30 0 0:01:34 0:01:33 0:00:01 627
</pre>

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2019-02-09T16:42:27Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

'''<pre>sudo /usr/bin/curl -G 'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi' --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html'''
'''sudo scp /tmp/ipv6.html user@host:'''
'''sudo rm -f /tmp/ipv6.html</pre>'''

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

ScanAutomation

2019-02-09T16:40:58Z

Wikiadmin:

==IPv6 Port Scan Automation==

This section provides an overview of automated IPv6 firewall testing (IPv6 TCP and UDP port scans) using wget and IPscan.

===Terms of Use===

'''Please ensure that you accept the ''[https://wiki.chappell-family.com/wiki/index.php?title=Timswiki:About terms of use]'' and are authorised to perform IPv6 port scans against the machine that you wish to test ''BEFORE'' attempting any of the steps outlined below. Please also ensure that you are not accessing web pages using an HTTP proxy. If in doubt then a web proxy can be disabled by following the command-line examples shown below.'''

This website publishes a [[Timswiki:Privacy_policy]]. Continued use of this website implies your consent to the storage of data outlined in the policy.

----

===Rules for Forming the URL===

It is possible to request automatic scans using '''''wget''''' but the URLs must be constructed as shown below. In each case you '''MUST:'''

* target my IPv6 host and IPv6 cgi-bin directory (www6.chappell-family.co.uk/cgi-bin6/)
* use the text-browser compatible cgi target (ipscan-txt.cgi)
* include an includeexisting query term, setting it to either 1 (include default ports [[IPv6_Ports]]) or -1 (exclude default ports)
* include all 4 customport terms (numbered 0 to 3), setting them equal to nothing if they are unused
* include the termsaccepted term, setting it to 1 to indicate your acceptance of the terms and conditions
* ensure that there are no spaces in the query string, particularly if using cut'n'paste
* wrap the resulting URL in quotes to ensure that the ampersand characters are not mis-interpreted

Failure to follow all of the above rules will result in a failure to scan your host. I'd also suggest that you specify a desired output document in the wget command-line - otherwise the filename will be based on the called URL and so will be somewhat convoluted!

'''If you include the default ports (includeexisting=1) then the scan will take up to approximately 15 seconds to complete - please be patient!'''

===Windows Users - please READ===

If you're intending to test a windows PC, then you need to be careful which pre-compiled version of wget you have installed. Some of the available versions do not include IPv6 support. The download at the following link is known to work on windows 7:

* [http://gnuwin32.sourceforge.net/packages/wget.htm http://gnuwin32.sourceforge.net/packages/wget.htm]

Another good solution for PC users can be found within the [http://www.cygwin.com/ Cygwin] tool. Wget on Cygwin is built with the following options:

<pre>
$ wget -V
GNU Wget 1.13.4 built on cygwin.

+digest +https +ipv6 +iri +large-file +nls -ntlm +opie +ssl/gnutls
</pre>

==Example Scans==

Now for some concrete examples:

===Testing just the UDP and TCP default port list===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:28:03-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10147 (9.9K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,147 --.-K/s in 0s

2012-01-28 14:28:03 (165 MB/s) - `ipv6.html' saved [10147/10147]
</pre>

===Testing the UDP ports and a single TCP port, e.g. 8080===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:37:21-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=-1&customport0=8080&customport1=&customport2=&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 7323 (7.2K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 7,323 --.-K/s in 0s

2012-01-28 14:37:21 (112 MB/s) - `ipv6.html' saved [7323/7323]
</pre>

===Testing the UDP ports, the default TCP ports list and 3 custom TCP ports===

'''wget --no-proxy --output-document=ipv6.html <nowiki>"https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=&termsaccepted=1"</nowiki>'''

<pre>
--2012-01-28 14:39:53-- https://www6.chappell-family.co.uk/cgi-bin6/ipscan-txt.cgi?includeexisting=1&customport0=8080&customport1=33452&customport2=65535&customport3=
Resolving www6.chappell-family.co.uk... 2001:470:1f08:185c::2
Connecting to www6.chappell-family.co.uk|2001:470:1f08:185c::2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10263 (10K) [text/html]
Saving to: `ipv6.html'

100%[======================================>] 10,263 --.-K/s in 0s

2012-01-28 14:39:54 (222 MB/s) - `ipv6.html' saved [10263/10263]
</pre>

===Testing on Ubiquity ERlite Routers===

'''<pre>sudo /usr/bin/curl -G 'https://www6.chappell-family.co.uk/cgi-bin6/ipscantxt.cgi' --data-urlencode 'includeexisting=1' --data-urlencode 'customport0=' --data-urlencode 'customport1=' --data-urlencode 'customport2=' --data-urlencode 'customport3=' --data-urlencode 'termsaccepted=1' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Connection: keep-alive' 2>&1 >/tmp/ipv6.html</pre>'''
'''<pre>sudo scp /tmp/ipv6.html user@host:</pre>'''
'''<pre>sudo rm -f /tmp/ipv6.html</pre>'''

===HTML Results Scraping===

It is possible to open the resulting ipv6.html file in a local web-browser, however you may prefer to summarise the results for easier checking. Here is a very quick and inelegant example of [[ResultScraping]] the returned html file.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6 DEBUG

2019-01-22T19:36:46Z

Wikiadmin:

== IPv6 DEBUG ==

Debug suggestions related to IPv6 configuration issues that might be encountered when accessing my [https://ipv6.chappell-family.com/ipv6tcptest/ IPv6 firewall tester.]

For general IPv6 debug please see:

* [http://www.getipv6.info/index.php/Troubleshoot_IPv6_Issues Arin IPv6 debug - many useful links]
* [http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/index.html Linux IPv6 HOWTO]
* [http://technet.microsoft.com/en-us/library/cc737698%28WS.10%29.aspx Microsoft IPv6 Howto.]
* [http://n1.netalyzr.icsi.berkeley.edu/analysis/ Berkeley University Network analysis tool - very thorough, but requires Java]

=== General IPv6 Connectivity ===
First check your general IPv6 connectivity. At a command prompt or terminal check that your machine has a global unicast IPv6 address allocated (i.e. 2000::/3, so begins either 2XXX or 3XXX) as shown in these examples:

C:\Users>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : home.example.com
'''IPv6 Address. . . . . . . . . . . : 2xxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx'''
Temporary IPv6 Address. . . . . . : 2xxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
Link-local IPv6 Address . . . . . : fe80::xxxx:xxxx:xxxx:xxxx%10
IPv4 Address. . . . . . . . . . . : 192.168.33.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::xxxx:xxxx:xxxx:xxxx%10
192.168.33.1

On a Linux machine, or similar, then when queried as root, the response would look similar to:

machine:/home/user1 # ifconfig

eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:192.168.33.254 Bcast:192.168.33.255 Mask:255.255.255.0
'''inet6 addr: 2XXX:XXXX:XXXX:XXXX::XXXX/64 Scope:Global'''
inet6 addr: fe80::abc:c0ff:fede:xxxx/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:225635003 errors:0 dropped:0 overruns:0 frame:0
TX packets:268102245 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1533376458 (1462.3 Mb) TX bytes:1466607126 (1398.6 Mb)
Interrupt:220

Note: The output will differ from the above examples if you are using a tunneled approach, although it would still be useful to check that a valid IPv6 address is being allocated to your machine.

If you do NOT have a global unicast IPv6 address allocated then you need to determine the reason (which address allocation method are you using? DHCPv6, SLAAC or statically assigned addresses? If you're using SLAAC then can you detect router advertisements (ICMPv6) being broadcast? Use Wireshark/tcpdump to determine this.)

If you DO have a global unicast address, then you can check basic IPv6 connectivity using either ping (Windows) or ping6 (Linux). If you are using a tunnel then verify that you can ping/ping6 the distant end of the tunnel.

ping6 ipv6.google.com

you should see a response similar to:

ping6 ipv6.google.com

PING ipv6.google.com(fx-in-x63.1e100.net) 56 data bytes
64 bytes from fx-in-x63.1e100.net: icmp_seq=1 ttl=56 time=24.7 ms
64 bytes from fx-in-x63.1e100.net: icmp_seq=2 ttl=56 time=25.6 ms
...

If this is NOT successful then either your DNS AAAA lookups or general IPv6 connectivity is broken (determine which based on your error messages).

If you have a name lookup error then it is possible to bypass the DNS lookups and ping google's IPv6 host directly:

ping6 -c 3 2a00:1450:400c:c01::67

PING 2a00:1450:400c:c01::67(2a00:1450:400c:c01::67) 56 data bytes
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=1 ttl=56 time=19.0 ms
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=2 ttl=56 time=18.3 ms
64 bytes from 2a00:1450:400c:c01::67: icmp_seq=3 ttl=56 time=18.3 ms

'''Caution: google's ipv6 address changes frequently - this was correct in Jan 2012, it may not be now!
'''

If this fails to work then your general IPv6 connectivity is broken! A few things to check if this is the case:

* Can successfully ping your router?
* Check your IPv6 routing table:

C:\Users\user1>route print
===========================================================================
Interface List
11...XX XX XX XX XX XX ......Intel(R) Centrino(R) Advanced-N 6200 AGN
10...YY YY YY YY YY YY ......Atheros AR8131 PCI-E Gigabit Ethernet Controller
1...........................Software Loopback Interface 1
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================
IPv4 Route Table
===========================================================================
removed for clarity
...
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
'''11 281 ::/0 fe80::XXXX:XXXX:XXXX:XXXX'''
1 306 ::1/128 On-link
15 58 2XXX::/32 On-link
15 306 2XXX:X:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 33 2XXX:XXXX:XXXX:XXXX::/64 On-link
11 281 2XXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 2XXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 fe80::/64 On-link
15 306 fe80::/64 On-link
15 306 fe80::XXXX:XXXX:XXXX:XXXX/128
On-link
11 281 fe80::XXXX:XXXX:XXXX:XXXX/128
On-link
1 306 ff00::/8 On-link
15 306 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Or for a linux host:

machine:/home/user1 # '''ip -6 route show'''
2XXX:XXXX:XXXX:XXXX::/64 via :: dev tun-ipv6 proto kernel metric 256 mtu 1280 advmss 1220 hoplimit 4294967295
2XXX:XXXX:XXXX:XX::/64 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 via :: dev tun-ipv6 proto kernel metric 256 mtu 1280 advmss 1220 hoplimit 4294967295
'''default via 2XXX:XXXX:XXXX:XXXX::X dev tun-ipv6 metric 1024 mtu 1280 advmss 1220 hoplimit 4294967295'''

=== DNS Related Issues ===

If the direct ping6 does work then your DNS AAAA-record lookups may be broken. To check whether you can perform IPv6 AAAA lookups, at a command prompt try:

nslookup -type=aaaa ipv6.chappell-family.com

you should see a response similar to:

Server: ::1
Address: ::1#53

Non-authoritative answer:
ipv6.chappell-family.com has AAAA address 2001:470:1f08:185c::2

Authoritative answers can be found from:
ipv6.chappell-family.com nameserver = ns4.he.net.
ipv6.chappell-family.com nameserver = ns2.he.net.
ipv6.chappell-family.com nameserver = ns1.he.net.
ipv6.chappell-family.com nameserver = ns3.he.net.
ns1.he.net internet address = 216.218.130.2
ns2.he.net internet address = 216.218.131.2
ns2.he.net has AAAA address 2001:470:200::2
ns3.he.net internet address = 216.218.132.2
ns3.he.net has AAAA address 2001:470:300::2
ns4.he.net internet address = 216.66.1.2
ns4.he.net has AAAA address 2001:470:400::2

Based on the fact that must have already accessed my server using IPv4, in order to be reading this, then the following IPv4 A-record lookup should work:

'''nslookup ipv6.chappell-family.com'''

Server: ::1
Address: ::1#53

Non-authoritative answer:
Name: ipv6.chappell-family.com
Address: 212.159.122.74

If you don't get a similar response then you need to investigate your DNS setup, or perhaps your ISP's.

=== DNS Resolver Issues ===

Some DNS services don't seem to reliably resolve AAAA lookups. In particular, some appear to resolve A and AAAA records with different delays, and/or reliability, which sometimes causes web browsers to determine that only an IPv4 address exists since the IPv6 lookup resolves too slowly/unreliably. You can try one of the publicly accessible DNS resolvers as an alternative to your current providers' if you believe that this might be the case. For those using a tunneled IPv6 connection then it is likely that your tunnel provider also offers a DNS resolver:

* Hurricane Electric - see Available DNS resolvers section of your tunnel setup (may be 2001:470:20::2 and 74.82.42.42)

Other public IPv6 DNS resolvers:

* [https://developers.google.com/speed/public-dns/docs/using Google DNS Servers]
* [https://support.opendns.com/hc/en-us/articles/227986667-Does-OpenDNS-Support-IPv6- OpenDNS IPv6]

The order in which you list the resolvers in your DNS search list is important - so when trying a new resolver ensure that you place it at the front of your resolver list. Note that it is worth checking that you can communicate with the resolver '''before''' modifying your resolver list - if the resolver fails to respond then you may encounter significant delays when attempting to lookup a host. In a linux environment this can be checked using a command similar to:

machine:/home/user1 # '''host ipv6.chappell-family.com 2001:4860:4860::8888'''

Using domain server:
Name: 2001:4860:4860::8888
Address: 2001:4860:4860::8888#53
Aliases:

ipv6.chappell-family.com has address 212.159.122.74
ipv6.chappell-family.com has IPv6 address 2001:470:1f08:185c::2
ipv6.chappell-family.com mail is handled by 10 mail.ipv6.chappell-family.com.

Note that it isn't necessary to access your DNS resolver using IPv6 if you don't want to - as long as the DNS server supports AAAA queries then this is sufficient. The same query, but on a windows machine, using Google's IPv4 resolver:

C:\Users\user1>'''nslookup ipv6.chappell-family.com 8.8.4.4'''
Server: google-public-dns-b.google.com
Address: 8.8.4.4

Non-authoritative answer:
Name: ipv6.chappell-family.com
Addresses: 2001:470:1f08:185c::2
212.159.122.74

=== WINDOWS 7 RESPONSES ===

A correctly configured Windows 7 machine shows the following responses:

ipv6.chappell-family.com has two DNS entries (AAAA and A records) and consequently returns two addresses:

nslookup ipv6.chappell-family.com

Server: server.example.com
Address: 192.168.33.1

Non-authoritative answer:
Name: ipv6.chappell-family.com
Addresses: 2001:470:1f08:185c::2
212.159.122.74

www6.ipv6.chappell-family.co.uk has a single AAAA DNS record:

nslookup www6.ipv6.chappell-family.co.uk

Server: server.example.com
Address: 192.168.33.1

Name: www6.ipv6.chappell-family.co.uk
Address: 2001:470:1f08:185c::2

Assuming these work correctly then a ping should also resolve:

ping www6.ipv6.chappell-family.co.uk

Pinging www6.ipv6.chappell-family.co.uk [2001:470:1f08:185c::2] with 32 bytes of data:
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms
Reply from 2001:470:1f08:185c::2: time<1ms

Ping statistics for 2001:470:1f08:185c::2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

=== Browser IPv6 Prioritisation ===

If all of the above was successful then your browser may not be prioritising IPv6 DNS requests. The following browsers are known to support IPv6 prioritisation:

* Microsoft's Internet Explorer,
* Google's Chrome
* Apple's Safari
* Mozilla's Firefox (but see the section below)
* w3m
* lynx

If you believe your browser is not prioritising IPv6 then check whether you can access the following URLs:

* [http://ipv6.google.com Google's IPv6-only-URL]
* [http://www6.chappell-family.co.uk/ An IPv6-only-URL]

Both of the above links are for IPv6-only websites - i.e. they have no IPv4 DNS entry - so if you get an error accessing these websites despite being able to perform the DNS lookups correctly then your browser is not prioritising IPv6.

At this point it would be worthwhile checking whether another browser (from the list above) gives the same result.

=== Firefox IPv6 DNS Prioritisation Specific ===

Firefox has a specific configuration option with which to disable IPv6 DNS queries (I recently came across Firefox on Linux Mint v12 being configured this way). The option can be displayed by entering the following url into firefox:

about:config

Accept the warning about dragons, and then in the filter bar enter:

ipv6

The resulting list should now show an entry:

network.dns.disableIPv6

If this entry is set to '''true''' then double click on the entry to change its sense to '''FALSE'''. Then try again!

=== IPv6-only URL Test ===

and finally pointing your web browser towards my [http://www6.chappell-family.co.uk/ IPv6-only Raspberry Pi Powered port scanner] should also work.

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy.

IPv6

2019-01-22T19:33:24Z

Wikiadmin:

==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==

IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.

=== Introduction ===

Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as encircled in the figure below.

[[File:Landing12_selection.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Chrome. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_landing_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version (right-hand figures) can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version (left-hand figures) supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some OS and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.

Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]

=== The Test ===

The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.

[[File:Kickoff12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_kickoff_LR.jpg |320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight kickoff page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

The test begins by sending an ICMPv6 ECHO-REQUEST (an IPv6 ping) towards the host under test (HUT). The tester checks for related ICMPv6 responses from either the HUT or other hosts (e.g. routers and/or firewall devices protecting the HUT). If a response is detected from an host other than the HUT then the IPv6 address of this third-party is reported.

The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).

The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).

The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figure below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.

[[File:Results12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
[[File:W3m_results_LR.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]

<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>

'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''

=== Test Server Source IPv6 Addresses ===

Tests performed from my www6.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

=== Raspberry Pi Powered IPv6 Firewall Tester ===

Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.

Tests performed from my Raspberry Pi host will be sourced from IPv6 address: '''2001:470:971f:6::3'''.

=== Issues - Debugging ===

If you're having trouble accessing the landing page via IPv6 (i.e. your IP address is reported as IPv4) then please see the following '''[[IPv6_DEBUG]]''' section.

=== Observations on IPv6 firewalls and IPv6 Address Selection ===

For some general observations on IPv6 firewalls, as well as some useful references, please see the '''[[IPv6_Firewalls]]''' section.

=== Getting an IPv6 connection ===

If you don't already have an IPv6 connection but wish to get involved, then try a tunnel-broker such as [http://tunnelbroker.net Hurricane Electric].

=== Source code ===

If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.

=== Automation ===

If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.

=== URL for Sharing ===

If you find this utility useful then please feel free to share the following URL with new users:

'''https://ipv6.chappell-family.com/ipv6tcptest/''' IPv6 Firewall Tester

----

This website publishes a Privacy Policy (link at the bottom of every page). Continued use of this website implies your consent to the use of data outlined in the policy. All other registered trademarks are the property of their respective owners.