> I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6.

I can do the same thing with mDNS, there’s no need to run a stateful DHCP server.

    avahi-browse -at

Done.

Sigh.

No. mDNS is not mandatory (e.g. my TrippLite UPS management card doesn't support it), and it requires active device participation. If a device is busy or slow to respond, you'll miss it.

DHCPv4 leases are authoritative, and they don't require device participation for discovery.

Sending hostnames isn’t required for DHCPv4 either. If we want to talk about ill-behaved clients, I don’t see why you can count this as a negative for mDNS but not stateful DHCP.

In practice, hostnames are sent by most clients, because it requires pretty much zero effort from the device. mDNS requires a complicated service that needs to be always on.

I happen to see hostnames for several of my devices at home.

  root@OpenWrt:~# ubus call dhcp ipv6leases | jq -r '.device["br-lan"].leases[].hostname'
   
  cp1
  syn
  wk1
  furnace
  cp1
   
   
  5c
  4b8
   
   
  5a
   
   
  5b
   
  5a
  cp3
  4b8
   
   
   
   
  cp2
  4b
  wk2
  5c
  5b
  wk3

These are not hostnames, but client IDs.

> I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6.

You mean, you can do a rough inventory of IPv4 devices that are well-behaved and want to be found.

Unless you have enterprise-y network gear, which can do port isolation and preferably 802.1x auth, it's trivial for a host to poison your switch's ARP tables to check whether the address it wants to use it free, and then simply use that address without requesting it from the DHCP server[1].

The DHCP server will check that no hosts are using that address (usually via ICMP) before assigning any leases to it, but won't (at least for any common DHCP servers) register a lease for any host it discovers, so the rogue device doesn't even need to worry about changing addresses when a new host joins the network. At best, you might discover the presence of such a device by checking your DHCP server's logs.

Since no common consumer-grade NAT implementations check whether the internal host has a valid lease before establishing NAT state, the rogue internal device is free to communicate with any external host. Even better, the rogue device can send packets with a from-address of other devices on your network, allowing it to punch arbitrary holes in your NAT.

As other commenters mentioned, you can get a similar level network surveillance for IPv6 using mDNS, but at least IPv6 isn't lulling you into a false sense that you can see all the devices on your network in the lease table.

[1] Actually, it doesn't even need to do that... it can simply start using an address and then change to another address if connectivity seems to be a problem.

> You mean, you can do a rough inventory of IPv4 devices that are well-behaved and want to be found.

Incorrect. It's pretty trivial to allowlist on the firewall only hosts that have an active DHCPv4 lease. I've done it for my home network.

So you absolutely can have a rogue device, but it won't be able to connect to the Internet. This can be done with OpenWRT or Mikrotik (I have the latter).

ARP attacks, and MAC spoofing require an additional level of sophistication. With IPv6 you can legitimately have devices without any means to find out WTF they are.

> As other commenters mentioned, you can get a similar level network surveillance for IPv6 using mDNS, but at least IPv6 isn't lulling you into a false sense that you can see all the devices on your network in the lease table.

mDNS simply Does Not Work right now. Plenty of IPv6-capable devices don't support it.