How to scan ipv6 enabled hosts on my LAN?

Question

I want to discover all my neighbors who enabled ipv6 protocol and still alive. I tried ip -6 neighbor show but it shows nothing.

Can someone recommend a tool and show some examples? Thanks.

Solution

Best to ping a special all nodes on a link multicast address - ff02::1 - and wait for the responses:

~ $ ping6 -I eth0 ff02::1
PING ff02::1(ff02::1) from fe80::a11:96ff:fe04:50cc wlan0: 56 data bytes
64 bytes from fe80::a11:96ff:fe02:50ce: icmp_seq=1 ttl=64 time=0.080 ms
64 bytes from fe80::1eaf:f7ff:fe64:ec8e: icmp_seq=1 ttl=64 time=1.82 ms (DUP!)
64 bytes from fe80::6676:baff:feae:8c04: icmp_seq=1 ttl=64 time=4047 ms (DUP!)
64 bytes from fe80::5626:96ff:fede:ae5f: icmp_seq=1 ttl=64 time=4047 ms (DUP!)
64 bytes from fe80::5626:96ff:fede:ae5f: icmp_seq=1 ttl=64 time=3049 ms (DUP!)
64 bytes from fe80::6676:baff:feae:8c04: icmp_seq=1 ttl=64 time=3049 ms (DUP!)
[...]
^C

A couple of points here:

• you must specify the interface: -I eth0
• The responses are link-local addresses - they can easily be converted to your global address by replacing the leading fe80: with your subnet's prefix, e.g. with 2001:db8:1234:abcd: if that's your subnet's prefix.

See http://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml for some other multicast addresses other than ff02::1 that may be of an interest.

Comments

[cpt_fink]

Wireshark allows ipv6 as a filter, which would be one way to look for ND/RA packets.

[MLu]

@Douglas Su - if you are happy with the answer below please mark it as a correct answer to award the author for the time spent trying to help you. Thanks!

[kasperd]

Personally I prefer to use -c to have the ping command stop automatically and -n such that it won't attempt reverse DNS, like this: ping6 -c2 -n ff02::1%eth0. Replacing the link local prefix with the global prefix will often give you the node's global address, but not always, it depends on the specific configuration.

[znarf]

how awesome is that, i hope it's an electron app!!!!!111!

[BlueMonkMN]

Is there a way to do this from Windows? Windows' ping doesn't seem to have a "-I" equivalent.

[Christian]

I would assume "the black cmd box" is much more helpful in learning about a problem than any given black box software.

[Andyc]

How do you remove the duplicates and only get the different ones?