Nuovo passo verso la super-cifratura

Re: ipv6 non decolla
- Scritto da:
- Scritto da:

Sì, certo, è arrivato il genio che sentenzia che

gli esperti di reti che hanno inventato gli

standard non capiscono un cavolo.. ehhh! Ma per

favore


Non sono un genio ma a differenza tua che posti
il solito about riguardo ipv6 ho testato a fondo
questo nuovo protocollo per ben 4
anni.
la conclusione del mio lab è stata la seguente
è una cagata
e i motivi sono appunto la poca granularita
l'overhead e il routing dinamico.
invece di cacarmi il cazzo con questi paper metti
su una lan OpenBSD e gioca con l'ipv6 poi quando
ti accorgerai anche tu della merda che hanno
tirato fuori scoprirai perchè l'ipv6 se lo cagano
di pezza tutti
quanti.
ciao e buonanotteSì, certo.. sei un progettista, un genio.. sai tutto tu.. ehhh.. che vuoi che ne capiscano quelli di Cisco ad esempio ? Zero! Sei tu il genio ed "il tuo lab" .. ehhh! Le subnet non esistono in IPV6 .. vero? Sono poche ? Certo, per questo Cisco parla di tempi di scansione delle subnet di decine di anni visto il numero immenso di indirizzi nelle sottoreti.. ehh! -
http://www.cisco.com/web/about/security/security_s...3.1.1.2 IPv6 ConsiderationsThis section outlines the differences in the reconnaissance attack when moved to IPv6. Because port andapplication vulnerability scans are identical after a valid address is identified, this section focuses onidentifying valid addresses. The first subsection highlights technology differences independent ofcurrently available technology, and the latter outlines current capabilities in this area for the adversary andthe defender.3.1.1.2.1 Technology and Threat DifferencesWith regard to technology, IPv6 reconnaissance is different from IPv4 reconnaissance in two major ways.The first is that the ping sweep or port scan, when used to enumerate the hosts on a subnet, are muchmore difficult to complete in an IPv6 network. The second is that new multicast addresses in IPv6 enablean adversary to find a certain set of key systems (routers, Network Time Protocol [NTP] servers, and soon) more easily. Beyond these two differences, reconnaissance techniques in IPv6 are the same as inIPv4. Additionally, IPv6 networks are even more dependent on ICMPv6 to function properly. Aggressivefiltering of ICMPv6 can have negative effects on network functions. ICMPv6 filtering alternatives arereviewed in section 3.1.2.3.1.1.2.1.1 IPv6 Subnet Size DifferencesThe default subnet size of an IPv6 subnet is 64 bits, or 264, versus the most common subnet size in IPv4 of8 bits, or 28. This increases the scan size to check each host on a subnet by 264 - 28 (approximately 18quintillion). Additionally, the 64-bit address is derived based on the EUI-64 version of a host MACaddress, or in the case of IPv6 privacy extensions [8] (which are enabled by default in Windows XP andavailable on numerous other platforms), the number is pseudorandom and changes regularly. So anetwork that ordinarily required only the sending of 256 probes now requires sending more than 18quintillion probes to cover an entire subnet. Even if we assume that sound network design principles arediscounted and that the same 64-bit subnet now contains 10,000 hosts, that still means only one in every1.8 quadrillion addresses is actually occupied (assuming a uniform random distribution). And even at ascan rate of 1 million probes per second (more than 400 Mbps of traffic), it would take more than 28years of constant scanning to find the first active host, assuming the first success occurs after iteratingthrough 50 percent of the first 1.8 quadrillion addresses. If we assume a more typical subnet with 100active hosts, that number jumps to more than 28 centuries of constant 1-million-packet-per-secondscanning to find that first host on that first subnet of the victim network.Now it should be noted that many variables can make this scanning easier for the adversary. First, publicservices on the Internet edge need to be reachable with DNS, giving the adversary at least a small numberof critical hosts within the victim network to attack. Second, the large nature of IPv6 addresses and thelack of a strict requirement for Network Address Translation (NAT) will cause more networks to adoptdynamic DNS or other mechanisms to ensure that even hosts have a valid DNS name (typingFE80:CA01:0:56::ABCD:EF12:3456 to talk to your friends PC is no fun). This means that a compromise of a DNS server within the organization under attack could yield large caches of hosts. Third,administrators may opt for easy-to-remember host addresses for key systems (::10,::20,::F00D, and so on)that could be entered into a database used by the scanning tool. These easy-to-remember names couldinclude simply mapping the decimal v4 last octet to the hex v6 last octet, because dual stack will be thenorm for years to come (this was done in the lab detailed in Appendix B for convenience). Fourth, byfocusing on popular IEEE OUI designations for NIC vendors, an adversary could significantly reduce thenumber space of 264. And finally, by exploiting poorly secured routers or other gateway devices, anadversary could view the IPv6 neighbor-discovery cache data (the functional equivalent of an ARP cache)to find available hosts, or could simply turn on a packet-capture capability such as tcpdump to findaddresses available to scan.Also, like in IPv4 networks, the internal hosts should be protected by a firewall that limits or completelyprevents uninitiated conversations from reaching these systems.The implications of these larger subnets are significant. Todays network management systems often useping sweeps as a method of enumerating a network for an administrator. New techniques need to beadopted for this purpose (perhaps neighbor cache checks on routers). Based on initial testing, the neighborcache is populated on a router only when the device is communicated with by the router (such as sendingoff-net traffic).Additionally, this has potentially far-reaching implications for the way Internet worms are propagated,whether they are random address-based or use some form of hierarchical address designations. The basicassumption is that worms will have a much more difficult time propagating in the same manner as theyhave in IPv4. This is an area that requires further research; some ideas are highlighted in Appendix A.

Re: ipv6 non decolla
- Scritto da:

Sì, certo.. sei un progettista, un genio.. sai

tutto tu.. ehhh.. che vuoi che ne capiscano

quelli di Cisco ad esempio ? Zero! Sei tu il

genio ed "il tuo lab" .. ehhh!

Ma perché non fai come dice, testala anche tu e
poi trai le dovute
conclusioni.Ma sì, siamo tutti programmatori, progettisti... eh! Spuntano come funghi. Negli asili c'è chi progetta i router Cisco, eh!