9 ms·
You should block the whole /64, at least. It's often a single host. It's often but not always a single host, that's standardized.
by swinglock 11mo ago
You should block the whole /64, at least. It's often a single host. It's often but not always a single host, that's standardized.
- vladvasiliu 11mo agoUsually a /64 is a "local network", so in the case of consumer ISPs that's all the devices belonging to a given client, not a single device. Some ISPs provide multiple /64s, but in the default configuration the router only announces the first /64 to the local network.
- TZubiri 11mo agoPresumably a compromised device can request arbitrarily new ipv6 from the dhcp so the entire block would be compromised. It would be interesting to see if standard dhcp could limit auto leasing to guard reputation of the network
- vladvasiliu 11mo agoGenerally, IPv6 does autoconfiguration (never seen a home router with DHCPv6), so no need to ask for anything. Even for ipv4, I've never seen a home router enforce DHCP (even though it would force the public ip). But the point stands, you can't selectively punish a single device, you have to cut off the whole block, which may include well-behaved devices.
- swinglock 11mo agoIn mobile networks it's usually a single device.