Scanning IPv6 with Nmap: link-local discovery and why sweeps fail

You cannot sweep a /64

An IPv6 subnet is normally a /64, which holds 2 to the 64th addresses. Sweeping it address by address would take longer than the lifetime of the hardware. IPv6 discovery therefore relies on asking the network: multicast to all nodes, router advertisements, DNS records, and neighbor caches on hosts you control.

Nmap supports IPv6 with -6. Most scan types work, though OS detection and some scripts are less mature than their IPv4 counterparts.

Finding neighbors on the local link

The NSE script targets-ipv6-multicast-echo sends an ICMPv6 echo to ff02::1, the all-nodes multicast address, and adds every responder as a target. targets-ipv6-multicast-slaac and targets-ipv6-multicast-mld find hosts by other link-local behaviors. Each needs an interface name with -e.

You can also read the neighbor table on any host you administer with ip -6 neigh. Combined with DHCPv6 leases and DNS AAAA records, that gives a realistic inventory without sweeping.

Snippet

sudo nmap -6 -e enp0s8 --script targets-ipv6-multicast-echo --script-args newtargets -sn
ip -6 neigh show

Lab: compare IPv4 and IPv6 exposure

Many hosts get an IPv6 address automatically through SLAAC, and many firewall configurations only cover IPv4. On a Linux lab VM with ufw or iptables rules for IPv4, scan the same host over both protocols. If a service bound to all addresses shows filtered on IPv4 but open on IPv6, the firewall has a gap.

Fix it by writing rules for ip6tables or nftables inet tables, which apply to both families, then rescan over IPv6 to confirm.

Snippet

sudo nmap -p 22,80,5432 192.168.56.101
sudo nmap -6 -p 22,80,5432 fe80::a00:27ff:fe4e:66a1%enp0s8
sudo ip6tables -L -n -v

Defensive checklist for IPv6

Decide deliberately whether each network uses IPv6. If it does, give it the same firewall policy, logging, and monitoring as IPv4. If it does not, disable it consistently instead of leaving link-local addresses active and unwatched.

Watch for unexpected router advertisements on segments where you do not run IPv6. A rogue RA can make hosts prefer an attacker-controlled path, and RA Guard on switches is the usual control.

Diagram

Ways to find IPv6 hosts without sweeping

Ask the network instead of guessing addresses.

Multicast echo
Ping ff02::1 on the link and record every responder.
Neighbor cache
Read ip -6 neigh on hosts you manage.
DNS and DHCPv6
Export AAAA records and lease tables.
Router logs
Use the router’s neighbor discovery table.

Check yourself

1. Why does a sequential sweep of an IPv6 /64 fail?

2. What is ff02::1?

3. Port 5432 is filtered over IPv4 but open over IPv6. What is the fix?