DScan6: Fast IPv6 Address Scanning Technology Based on Cross-Kernel Asynchronously Sending and Receiving

Network address scanning is an important support for precise network governance, network situational analysis and network security management. IPv4 Internet-wide scanning is now easy to implement, however, traversal-based active probing is infeasible for scanning the IPv6 Internet. Existing IPv6 network scanning tools are based on the Linux kernel protocol stack, which is no longer sufficient for rapid IPv6 address scanning. To address the above problem, a fast IPv6 address scanning technology based on cross-kernel asynchronously sending and receiving, named DScan6, is proposed, which adopts the asynchronous method of packet transmission and reception separation, and utilizes the Data Plane Development Kit (DPDK) to bypass the Linux kernel protocol stack for realize direct packet transmission and reception between user-space and network interface card, effectively improving the packet transmission and reception speed. 26.9M IPv6 addresses are collected from 5 public data sources, including Rapid7, as the target address set, and a /64 prefix address segment is randomly designated as the target address segment to conduct a real network scan test on the IPv6 Internet, and compared with 4 scanning tools, including Masscan, Scan6, XMap and Zmapv6, the packet sending and receiving rate of the DScan6 technology reaches 99.3% of the theoretical maximum speed of Gigabit Ethernet link, and the scanning speed is 2.1~3.4 times faster than Masscan, Scan6, XMap and Zmapv6 on average.