Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: IPv6 Day Summary SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
IPv6 Day Summary

I just had a change to skip through our IPv6 logs from yesterday. There was a significant, but not huge increase in hosts accessing the site via IPv6. Usually we get maybe 200 or so hosts via IPv6, yesterday we got around 270.

Interestingly about 25% of the traffic (per IPv6 day as well as during IPv6 day) is due to hits to our rss feed. I will try to follow up on this to see why we get so much IPv6 traffic to it.

After an initial look at the logs, I didn't see any attacks via IPv6 against our web application.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Spring 2020

Johannes

3698 Posts
ISC Handler
I suspect that in my case (and perhaps others) is that Google Reader was using IPV6 during IPV6 Day. I use ShowIP in FF and was aware that an IPV6 addr was showing for Google sites. And, even now, I see an IPV6 addr as I type this comment.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!