# How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this:

nmap -sP 192.168.*.*


or

nmap -sP 192.168.1.*


but if I need to do this with an IPv6, how would I do it?

• This question appears to be off-topic because it is about reading the help page of the tool you are using.... – user10211 Feb 14 '14 at 11:09
• It says right there.... the -6 flag enables IPv6 scanning... – user10211 Feb 14 '14 at 11:09
• I did google for it, but I couldn't understand the IPv6 method of doing it. Am I posting in the right place btw? – Ihsan Feb 14 '14 at 11:10
• -6 yes, I did that - nmap -sP -6 fe80::* - but unfortunately it gives out an error saying "Failed to resolve given IPv6 hostname/IP: fe80::*. Note that you can't use '/mask' or '[1-4,7,100-]' style ranges for IPv6. Error code -2: Name or service not known" - which I don't really get, so if anyone has an idea about this..? – Ihsan Feb 14 '14 at 11:12
• The latest version of Nmap, version 6.40 released in July 2013, supports CIDR-style addressing for IPv6. For link-scope addresses (fe80::/10), you need to specify which interface to use with -e. Ping won't work, you need ping6 and need to specify the interface like so: ping6 fe80::20f:20ff:fe70:7c0e%eth0 – bonsaiviking Feb 14 '14 at 14:58

I would assume that the range you are trying to scan is fe80:0000:0000:0000:0000:0000:0000:0000/112 which is the last 16 bits (the last section) of the address. That range includes 65,536 IPv6 addresses, probably all of which are going to time out when scanned. It will probably take most of a day (86,400 seconds - close enough to 65,536 at one second per timeout on average) just to ping that range to determine whether the machines are up or not.