Address Scanning Document comments

[Fred Baker <fred@cisco.com>]

>    It is also worth noting that worms that spread by scanning target
>    networks for hosts to re-attack have become more common in recent
>    times.  Thus a much more sparsely address-populated IPv6 network  
> will
>    have a more innate defense to such forms of worm infection,  
> although
>    there may still be significant scanning traffic generated.

I hear this comment, taken from the draft, a lot, and I'm not as sure  
that it is true. Finding the hosts on a remote LAN will require the  
use of different techniques, but I'm not at all sure they will be  
hard to find.

For example, when you receive this email, it will have a number of  
'receive' lines. In case you have forgotten how to manage your email  
tool, they look something like this:

> Received: 	from xbh-sjc-231.amer.cisco.com
> ([128.107.191.100]) by xmb-sjc-225.amer.cisco.com with Microsoft
> SMTPSVC(6.0.3790.211); Wed, 22 Mar 2006 15:21:53 -0800
> Received: 	from sj-iport-5.cisco.com ([171.68.10.87]) by
> xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211);
> Wed, 22 Mar 2006 15:21:52 -0800
> Received: 	from sj-core-4.cisco.com ([171.68.223.138]) by
> sj-iport-5.cisco.com with ESMTP; 22 Mar 2006 15:21:54 -0800
> Received: 	from xbh-sjc-211.amer.cisco.com
> (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-4.cisco.com
> (8.12.10/8.12.6) with ESMTP id k2MNLnYg005591 for
> <ipv6-interest@cisco.com>; Wed, 22 Mar 2006 15:21:49 -0800 (PST)
> Received: 	from xfe-sjc-211.amer.cisco.com
> ([171.70.151.174]) by xbh-sjc-211.amer.cisco.com with Microsoft
> SMTPSVC(6.0.3790.211); Wed, 22 Mar 2006 15:21:49 -0800
> Received: 	from cisco.com ([128.107.132.219]) by
> xfe-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211);
> Wed, 22 Mar 2006 15:21:48 -0800

As you can see, it contains the numeric address of the system. Any  
system that emits email is therefore known by any system that  
receives it, which is to say that IPv6 addresses of hosts on remote  
LANs are trivially easy to obtain. And if you can manage to infect  
one, the neighbor discovery protcool results in that system knowing  
all of its peers on said LAN even if they don't send mail.

Hence, I doubt that there will be any address scans, and I also doubt  
that there will be less attacks. They will just come in a different way.