Re:Hello IPv6: a minimal tutorial for IPv4 users
by cyberax on Saturday January 27, 2024 @10:34PM
(#39162295)
> You mean, you can do a rough inventory of IPv4 devices that are well-behaved and want to be found.
Incorrect. It's pretty trivial to allowlist on the firewall only hosts that have an active DHCPv4 lease. I've done it for my home network.
So you absolutely can have a rogue device, but it won't be able to connect to the Internet. This can be done with OpenWRT or Mikrotik (I have the latter).
ARP attacks, and MAC spoofing require an additional level of sophistication. With IPv6 you can legitimately have devices without any means to find out WTF they are.
> As other commenters mentioned, you can get a similar level network surveillance for IPv6 using mDNS, but at least IPv6 isn't lulling you into a false sense that you can see all the devices on your network in the lease table.
mDNS simply Does Not Work right now. Plenty of IPv6-capable devices don't support it.
Incorrect. It's pretty trivial to allowlist on the firewall only hosts that have an active DHCPv4 lease. I've done it for my home network.
So you absolutely can have a rogue device, but it won't be able to connect to the Internet. This can be done with OpenWRT or Mikrotik (I have the latter).
ARP attacks, and MAC spoofing require an additional level of sophistication. With IPv6 you can legitimately have devices without any means to find out WTF they are.
> As other commenters mentioned, you can get a similar level network surveillance for IPv6 using mDNS, but at least IPv6 isn't lulling you into a false sense that you can see all the devices on your network in the lease table.
mDNS simply Does Not Work right now. Plenty of IPv6-capable devices don't support it.