RE: Network Scanning

["Manfredi, Albert E" <albert.e.manfredi at boeing.com>]

> -----Original Message-----
> From: Jeroen Massar [mailto:jeroen at unfix.org] 

> Sean Siler wrote:
> > Microsoft based Operating Systems join the All Nodes On 
> > Link Multicast Group as specified by RFC 4291, but that
> > RFC does not mandate that nodes must reply to ICMP echo
> > requests.  So while we do not reply to pings to ff02::1,
> > we are also in compliance with the RFC.

And RFC 4443 (ICMPv6) also does not mandate a response to a multicast
query.

> Thus, as such, to identify this OS, one would just have to 
> send an MLD 
> Query on the link, receive the responses, and tada, you have, per the 
> RFC, all the hosts that at least comply to the RFC, then 
> substract the 
> ones you receive an ICMP echo from et voila you know what is 
> doing this 
> trick, which currently means that it is most likely 
> Windows-based

To which on link multicast address would the MLD query be transmitted,
for this idea to work? RFC 2710 does not mandate a reply to these
multicast addresses:

"When a node receives a General Query, it sets a delay timer for each
multicast address to which it is listening on the interface from which
it received the Query, EXCLUDING the link-scope all-nodes address and
any multicast addresses of scope 0 (reserved) or 1 (node-local)."

Hmmm. No way to do a network discovery?

Bert
--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6 at ietf.org
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------