IPv6 - Revision history

Wikiadmin: Update IPv6 addresses.

2023-10-21T17:02:54Z

Update IPv6 addresses.

Wikiadmin: /* Source code */

2022-07-09T17:10:15Z

Source code

Wikiadmin: /* Raspberry Pi Powered IPv6 Firewall Tester */

2022-07-09T17:09:46Z

Raspberry Pi Powered IPv6 Firewall Tester

Wikiadmin: /* Test Server Source IPv6 Addresses */

2022-07-09T17:09:28Z

Test Server Source IPv6 Addresses

Wikiadmin: /* The Test */

2022-07-09T17:09:09Z

The Test

Wikiadmin: /* Introduction */

2022-07-09T17:08:13Z

Introduction

Wikiadmin: /* Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner) */

2022-07-09T17:02:22Z

Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)

Wikiadmin at 19:22, 25 September 2019

2019-09-25T19:22:48Z

Wikiadmin at 19:17, 25 September 2019

2019-09-25T19:17:01Z

Wikiadmin at 19:11, 25 September 2019

2019-09-25T19:11:49Z

@@ Line 46: / Line 46: @@
 === Test Server Source IPv6 Addresses ===
-Tests performed from the www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.
+Tests performed from the www66.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:99::6'''.
 Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

@@ Line 74: / Line 74: @@
 === Source code ===
-If you would like to view or download the IPv6 firewall scanner source code then please visit my '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.
+If you would like to view or download the IPv6 firewall scanner source code then please visit the '''[https://github.com/timsgit/ipscan github]''' page. If you deploy the scanner on an internet facing machine then ''please'' ensure that you protect users' privacy by following the instructions given in point 10 of the embedded [https://github.com/timsgit/ipscan/blob/master/README README] file.
 === Automation ===

@@ Line 52: / Line 52: @@
 === Raspberry Pi Powered IPv6 Firewall Tester ===
-Outline details of my Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.
+Outline details of the Raspberry Pi Powered IPv6 firewall tester can be found here [[Raspberry_Pi_IPv6_firewall_tester]], along with more complete [[Raspberry_Pi_IPv6_firewall_tester_installation]] details.
 All tests performed during non-maintenance periods are now handled by a Raspberry Pi powered host.
 === Issues - Debugging ===

@@ Line 46: / Line 46: @@
 === Test Server Source IPv6 Addresses ===
-Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.
+Tests performed from the www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.
 Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.

@@ Line 39: / Line 39: @@
-<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that my webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>
+<font color="red">'''IMPORTANT:''' this scanner will direct IPv6 TCP, UDP and ICMPv6 traffic towards the IP address that the webserver determines the request originates from. Please do NOT attempt to test machines that are operating behind transparent HTTP proxies, unless you also administer the proxy and specifically intend that machine to be tested.</font>
-'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ my IPv6 portscanner.]'''
+'''If you wish to test your host now then please point your browser towards [https://ipv6.chappell-family.com/ipv6tcptest/ the IPv6 portscanner.]'''
 === Test Server Source IPv6 Addresses ===

@@ Line 5: / Line 5: @@
 === Introduction ===
-Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.
+Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. The ipv6.chappell-family.com domain has DNS entries for both IPv4 and IPv6 addresses. This makes it possible for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.
@@ Line 14: / Line 14: @@
-Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read my [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]
+Please do NOT attempt to test hosts which are located behind HTTP proxies. Such proxies are very common in both corporate environments and on commercially-operated free wifi networks. The landing page for IPscan attempts to detect the common headers which such proxies insert, but it cannot detect truly transparent proxies. An HTTP Proxy is typically used by corporate networks to ensure employees are using their PCs in line with corporate computer-use policies. If you are interested in deploying your own HTTP proxy then [http://www.squid-cache.org/ Squid] is highly recommended as a proxy able to perform not only the usual access control and content-caching tasks but also offering IPv4 and IPv6 inter-working between single and dual-stack clients and web-sites. For further details please read the [https://ipv6.chappell-family.com/docs/IPv6_Squid_v01.pdf IPv6 Squid Proxy article.]
 === The Test ===

@@ Line 1: / Line 1: @@
-==Tim's IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==
+==The IPscan IPv6 Firewall Tester (ICMPv6, IPv6 TCP and UDP Port Scanner)==
 IPscan offers much of the functionality you might hope to find in an IPv6 version of [https://www.grc.com/ GRC's ShieldsUp®] utility.
@@ Line 5: / Line 5: @@
 === Introduction ===
-Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.
+Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally-routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.
@@ Line 19: / Line 19: @@
 === The Test ===
 The tester allows a user to choose whether to include a commonly used set of '''TCP [[IPv6_Ports]]''' in their scan, as well as the ability to specify a number of their own specifically interesting TCP ports (this is intended to cover setups where you run services on non IANA-assigned ports, or just run less-common services). If you would like to see the list of commonly used ports expanded, or just changed, then please contact me.
@@ Line 51: / Line 50: @@
 Tests performed from my www64.chappell-family.co.uk host will be sourced from IPv6 address: '''2001:470:971f:6::4'''.
-Note: during periods of planned server maintenance, a reduced service supporting only TCP testing will be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.
+Note: during periods of planned server maintenance, a reduced service supporting only TCP testing may be offered, which will be sourced from an IPv6 address in the following range: '''2001:8d8:100f::/48'''.
 === Raspberry Pi Powered IPv6 Firewall Tester ===
@@ Line 83: / Line 82: @@
 === Automation ===
-If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see my '''[[ScanAutomation]]''' section and HTML '''[[ResultScraping]]''' section.
+If you'd like to automate IPv6 firewall testing, or run the same test a number of times on different hosts then please see the '''[[ScanAutomation]]''' and HTML '''[[ResultScraping]]''' sections.

@@ Line 24: / Line 24: @@
-[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
@@ Line 31: / Line 31: @@
 The test continues by scanning a fixed set of commonly used '''UDP [[IPv6_Ports]]'''. The IPv6 UDP port test sets its' socket tx/rx timeouts to be 2 seconds - consequently the results can take up to 2s per tested UDP port - although the actual time depends heavily upon the filtering that your system employs (e.g. firewalls which mark protected ports as 'unreachable' will resolve in much less than the allowed 2 second timeout assuming that your firewall sends the appropriate ICMPv6 packet in response).
-The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket tx/rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).
+The test finishes by scanning the user-selected IPv6 TCP ports. The IPv6 TCP port test sets its' socket Tx/Rx timeouts to be 1 second - consequently the results can take up to 1s per tested port - although this depends heavily upon the filtering your system employs (e.g. firewalls which mark protected ports as 'administratively prohibited' will resolve as PHBTD in much less than the allowed 1 second timeout assuming that your firewall sends an ICMPv6 type 1 code 1 packet in response).
 The tester will indicate the status of the tested UDP and TCP ports as either OPEN, STEALTHed or one of a series of other states depending on the positive or negative feedback received from your machine. A typical result is shown in the figures below. Note that if you run the test using an interactive gui-based browser then hovering over specific port numbers produces a pop-up describing the service run on that specific port. For a more detailed explanation of the reported states please read '''[[ScanStatus]]'''.
-[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original results page viewed using IE9. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_results_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
-[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_results_key1.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (1 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
-[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight results page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_results_key2.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) IPscan results key (2 of 2) viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]

@@ Line 5: / Line 5: @@
 === Introduction ===
-Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as encircled in the figure below.
+Recent web-browsers request IPv6 DNS lookups in preference to IPv4 if they are running on a host with IPv6 enabled. My domain (ipv6.chappell-family.com) has DNS entries for both IPv4 and IPv6 addresses, but defaults to IPv4. This makes it safe for IPv4-only hosts, which make up most of the current web traffic, including search engines, to use the same URL. Browsers running on IPv4-only hosts will not request an IPv6 address and will therefore access the website entirely using IPv4. The landing page, as linked below, attempts to determine whether your machine has a valid globally routable IPv6 address (2000::/3) and whether it is behind an HTTP proxy, by looking for well known HTTP header variables which indicate that this may be the case. Only if the hosts' IP address is determined to be globally routable unicast IPv6 and there are no tell-tale HTTP proxy variables will the landing page offer links to initiate the scan, as shown in the figure below.
-[[File:IPscan_Landing_2019.png|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_Landing_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) landing page viewed using Firefox. See https://ipv6.chappell-family.com/ipv6tcptest/]]
-The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version (right-hand figures) can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version (left-hand figures) supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some OS and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.
+The tester is made available in two basic versions - one for browsers supporting javascript and the other suitable for text-only browsers such as Lynx, w3m and ELinks. The lightweight text-only browser version can be used on hosts which do not sport their own GUI environment (e.g. servers and embedded devices like routers). The original javascript browser version supports ongoing updates of the test status, whereas the text-only version only produces a results page once all the selected ports have been tested. Additionally, a fast and standard version of both of these testers is provided. The fast version tests multiple TCP or UDP ports in parallel, whereas the standard version tests only 1 port at a time, at a default rate of 1 port per second. Please be aware that some operating systems and firewalls apply rate-limiting to their generation, or passing, of ICMPv6 responses on the basis that this behaviour is indicative of a port scan being performed. Consequently such rate-limiting might cause a port which would normally generate an ICMPv6 response (e.g. PHBTD) to send no response at all, which IPscan would report as STEALTHed. If you are testing a host or firewall (whether on the client under test or elsewhere in the path between your client and the test server) which implements such rate-limiting then you are advised to use the standard, slower versions of IPscan which should not trigger the rate-limiting behaviour. If you're unsure which version is appropriate for you, then try both and compare the results. Some Linux distributions and some ISP firewalls are known to implement such rate-limiting.
@@ Line 23: / Line 23: @@
-[[File:Kickoff12.jpg|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]
-[[File:W3m_kickoff_LR.jpg |320x480px|border|alt=IPv6 Port Scanner (Firewall tester) lightweight kickoff page viewed using w3m. See https://ipv6.chappell-family.com/ipv6tcptest/]]
+[[File:IPscan_kickoff_2019.png|320x480px|border|alt=IPv6 Port Scanner (Firewall tester) original kickoff page viewed using Safari. See https://ipv6.chappell-family.com/ipv6tcptest/]]