ipv6 find all hosts in a prefix

Question

Using the ping6 command you can find the link-local address of ipv6 hosts out of an interface using:

 ping6 -I eth0 ff02::1

This will ping everything in the subnet and so you can see what is out there. This can be viewed in ndp.

Is it possible to ping everything in a prefix so you can determine the global-scope unicast addresses of hosts? Note that this assumes that the ipv6 addresses are statically assigned rather than auto-configured from a rad - so we can't just work it out from a mac address.

In ipv4 terms, this would be functionally equivalent to ping -b 192.168.1.0/24

Lets say our prefix is 2001:470:1f09:131::/64, am looking for a way of doing something like:

ping6 -b 2001:470:1f09:131::/64

(I know that -b is buffer size, this for illustration only)

Note that this is OpenBSD which doesn't support an IP address in -I:

 -I interface
         Source packets with the given interface address.  This flag ap-
         plies if the ping destination is a multicast address, or link-lo-
         cal/site-local unicast address.

Answer 1

Putting together the bits from Celada's answer and Bort's comment gives the wanted result: You need both the -I and the -S option.

So assuming the network interface vr0 with IPv6 address 2001:1418:153:0:2e0:c5ff:fe3f:caef you'd need this command to do your broadcast ping:

ping6 -I vr0 -S 2001:1418:153:0:2e0:c5ff:fe3f:caef ff02::1

(Removing the -S results in echo replies from the link-local addresses only; removing the -I results in getting no answers at all anymore.)

Answer 2

Try:

ping6 ff02::1%yournic0

Where yournic0 is whatever the interface name facing the link in question.

Answer 3

The -I argument can be an IP address as well as an interface name. It looks like if you specify an interface name then it uses the link-local address on that interface as the source address. The trick to getting replies from hosts coming from their global scope addresses is to send the ping from your own global scope address:

ping6 -I 2001:db8:xxxx::your:own:ip:address ff02::1

Answer 4

ping6 -c4 ff02::1%$(ip r|grep default|head -n1|awk '{print $NF}')

-c4 so that it does not go on for ever
ff02::1 broadcast address
% (you could use -I for interface)
ip r|grep default|awk '{print $NF}' # finds the default interface

Answer 5

My apologizes, this answer is not directly related to the original question. But almost 8 years later while looking for the same issue on a Linux system, a popular search engine redirects me on this post.

So if you are using a BSD-like system, the answer provided by Vucar still works today (tested on Mac-OS 10.15.16)

ping6 -I vr0 -S 2001:1418:153:0:2e0:c5ff:fe3f:caef ff02::1

But, if you are using a Linux based system with ping utility from package iputils-ping version 20190709, the syntax is slightly different:

ping6 -I 2001:1418:153:0:2e0:c5ff:fe3f:caef ff02::1%eth0

Without the outgoing interface associated to the destination address, it produces the following error:

ping6: sendmsg: Invalid argument

Without the -I argument, the other hosts will answer with their Link Local Address. The goal here is to retrieve the Global Unicast Addresses present on the local network.