Unveiling IPv6 Scanning Dynamics#

Hammas Bin Tanveer (University of Iowa) et al. (Akamai, CAIDA/UCSD, MPI-INF, IPinfo, Walton Institute, MIT; kc Claffy, UC San Diego)

• Why: IPv6's address space was supposed to make scanning moot; this dataset shows a sustained two-year increase in IPv6 scanning anyway, and characterizes how scanners actually work — directly relevant to your network-security interests and to any assumption that v6 reachability implies obscurity.
• What: The largest-ever IPv6 proactive telescope, deployed in a production ISP, collecting 600M+ unsolicited packets from ~1.9k ASes over 10 months. The paper characterizes scan sources, evaluates five defense-relevant features across the stack, and reverse-engineers scanner strategies (from abstract only).
• How: Proactive vantage points that attract scan traffic (telescope infrastructure) plus longitudinal measurement and source/strategy classification across the dataset.
• Where applicable: IPv6 security posture generally — informing whether v6-only services can rely on address obscurity (spoiler: decreasingly), rate limiting, and scan-detection design. Measurement done in a production ISP but findings generalize to v6 deployments broadly.