On: Fail2Ban

[devwastaken]

You can scan ipv6 because the addresses aren't arbitrary. Blocks have to be purchased and then ranges within routed.

[ericpauley → devwastaken]

Individuals usually get a /64. Scanning a truly random address in that range is not feasible.

[t0mas88 → devwastaken]

You can try, but a lot of ISPs assign a big subnet to each user. Mine for example assigns a /48 to each home user fiber connection.

Even if I make no effort at all to hide things and just select xxxx:xxxx:xxxx:1:: as the subnet (leaving a factor 65535 options on the table) the devices behind it will randomize the next 64 bits meaning you'll have to scan 18 quintillion (1.8e19) addresses to find one.