Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: IPv6 Day Summary - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
IPv6 Day Summary

I just had a change to skip through our IPv6 logs from yesterday. There was a significant, but not huge increase in hosts accessing the site via IPv6. Usually we get maybe 200 or so hosts via IPv6, yesterday we got around 270.

Interestingly about 25% of the traffic (per IPv6 day as well as during IPv6 day) is due to hits to our rss feed. I will try to follow up on this to see why we get so much IPv6 traffic to it.

After an initial look at the logs, I didn't see any attacks via IPv6 against our web application.


Johannes B. Ullrich, Ph.D.
SANS Technology Institute

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS London June 2022


4479 Posts
ISC Handler
Jun 9th 2011
I suspect that in my case (and perhaps others) is that Google Reader was using IPV6 during IPV6 Day. I use ShowIP in FF and was aware that an IPV6 addr was showing for Google sites. And, even now, I see an IPV6 addr as I type this comment.

Sign Up for Free or Log In to start participating in the conversation!