Nmap IPv6 Cheat Sheet: A Complete Guide to Scanning IPv6 Networks

IPv6 adoption has grown steadily over the last decade, and with it, the need for network professionals and penetration testers to understand how to scan and audit IPv6 networks properly. Most tutorials online still focus heavily on IPv4, leaving a knowledge gap when it comes to scanning the newer protocol. This guide fixes that gap by walking through everything needed to scan IPv6 networks with Nmap, from basic syntax to advanced techniques, along with practical examples, expected output, common pitfalls, and best practices.

Nmap (Network Mapper) has supported IPv6 scanning since version 4.x, and its IPv6 capabilities have matured significantly since then. Whether the goal is auditing a corporate network transitioning to IPv6, testing a dual-stack environment, or simply learning how address discovery differs between the two protocols, this cheat sheet covers it all.

Why IPv6 Scanning Is Different

Before diving into commands, it helps to understand why IPv6 scanning isn’t simply “IPv4 scanning with longer addresses.” A few structural differences matter:

1. Address space size: An IPv4 /24 subnet has 254 usable hosts, easily brute-forced with a ping sweep. A typical IPv6 /64 subnet has 18 quintillion addresses, making brute-force host discovery practically useless.
2. No ARP for neighbor discovery: IPv6 replaces ARP with Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages instead.
3. Multicast is central: IPv6 relies heavily on multicast addresses (like ff02::1, the all-nodes multicast address) for local network discovery.
4. Link-local addressing: Every IPv6-enabled interface automatically gets a link-local address (starting with fe80::), which is often used for local reconnaissance.

Because of these differences, Nmap requires an explicit flag to switch into IPv6 mode, and discovery strategies that work well on IPv4 (like sequential ping sweeps) simply don’t scale on IPv6.

Enabling IPv6 Scanning in Nmap

The single most important flag for this entire cheat sheet is -6. Without it, Nmap defaults to IPv4 behavior even if you supply an IPv6 address.

nmap -6 <target>

Example:

nmap -6 2001:db8::1

If you forget the -6 flag while targeting an IPv6 literal, Nmap will typically throw an error or fail to resolve the target correctly, so this is the first thing to check when troubleshooting failed scans.

Basic IPv6 Host Scan

To scan a single IPv6 host for open ports:

nmap -6 2001:db8::a1

Expected output looks similar to a standard IPv4 scan, just with the IPv6 address reflected in the header:

Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-16 10:00 UTC
Nmap scan report for 2001:db8::a1
Host is up (0.0021s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Scanning IPv6 Hostnames

Nmap can resolve hostnames to IPv6 addresses automatically when combined with -6:

nmap -6 example.com

This works only if the DNS record includes an AAAA entry. If the target only has an A record (IPv4), Nmap will fail to resolve an IPv6 address and return an error.

Link-Local Address Scanning

Link-local addresses (fe80::/10) are only valid within a single network segment and require specifying the interface Nmap should use, because the same link-local address could technically exist on multiple interfaces.

nmap -6 fe80::1%eth0

The %eth0 syntax tells the operating system (and Nmap) which network interface to use for the scan. On Windows, this syntax differs slightly and typically uses the interface index number instead of the name.

IPv6 Host Discovery Techniques

Because ping sweeps are impractical across an entire /64 subnet, IPv6 host discovery relies on different strategies:

1. Multicast Ping (Local Network Discovery)

nmap -6 --script=targets-ipv6-multicast-echo

This script sends an ICMPv6 echo request to the ff02::1 all-nodes multicast address and collects the responses, effectively discovering every IPv6-enabled host on the local link — the IPv6 equivalent of an ARP sweep.

2. Neighbor Solicitation Discovery

nmap -6 --script=targets-ipv6-multicast-invalid-dst

This script exploits certain implementation quirks where hosts respond to solicitations for addresses they don’t own, useful for uncovering additional hosts.

3. Router Advertisement based Discovery

nmap -6 --script=targets-ipv6-multicast-slaac

Since many IPv6 networks use SLAAC (Stateless Address Autoconfiguration), this script listens for router advertisements to infer the network prefix and generate potential host addresses.

4. Known Address List Scanning

If you already know a list of target IPv6 addresses (from DNS records, DHCPv6 logs, or asset inventories), the most reliable approach is simply feeding them directly:

nmap -6 -iL ipv6_targets.txt

Where ipv6_targets.txt contains one IPv6 address per line.

Port Scanning Options for IPv6

Most standard Nmap scan types work the same way over IPv6, but a few notes are worth mentioning:

Example combining several of these:

nmap -6 -sS -sV -p 1-1000 2001:db8::a1

Traceroute Over IPv6

nmap -6 --traceroute 2001:db8::a1

IPv6 traceroute uses ICMPv6 Time Exceeded messages instead of the ICMP used in IPv4, but the Nmap syntax and output format remain consistent with what you’d expect from IPv4 traceroutes.

Scanning an Entire IPv6 Subnet (Practical Approach)

Since sequential scanning of an entire /64 is not feasible, the realistic approach for scanning a known subnet combines external reconnaissance (DNS zone transfers, certificate transparency logs, DHCPv6 lease tables) with targeted host lists:

nmap -6 -iL known_hosts_ipv6.txt -p- -sV -oA ipv6_full_scan

The -oA flag saves output in all three formats (normal, XML, grepable) for later analysis, which is especially useful when scanning results need to feed into reporting tools or Python parsing scripts.

Using Nmap Scripting Engine (NSE) with IPv6

Most NSE scripts function normally over IPv6 as long as the underlying service doesn’t have IPv6-specific quirks. Example running vulnerability scripts against an IPv6 host:

nmap -6 --script vuln 2001:db8::a1

Some scripts are IPv6-specific (prefixed with targets-ipv6 or dealing with ICMPv6), which are primarily used for the discovery phase discussed earlier rather than post-discovery enumeration.

Combining IPv4 and IPv6 in One Scan Session

Nmap does not scan both protocols in a single invocation — you need two separate commands:

nmap -sV 192.168.1.10
nmap -6 -sV 2001:db8::10

A common workflow is to script both scans together in a shell wrapper or a Python automation script (see the companion article on working with Nmap through Python’s os and subprocess modules).

Saving and Exporting IPv6 Scan Results

nmap -6 -sV -oX ipv6_scan.xml 2001:db8::a1

XML output is particularly useful for IPv6 scans because address notation can get messy in plain text; XML parsing avoids manual string handling errors when addresses include zone IDs or compressed notation (::).

Common Errors and Troubleshooting

Error: “Failed to resolve given hostname/IP” Cause: Target has no AAAA DNS record, or -6 flag was omitted. Fix: Confirm the AAAA record exists with dig AAAA example.com, and always include -6.

Error: Scan returns no open ports on a host known to be up Cause: A host-based firewall may be silently dropping ICMPv6, causing Nmap’s host discovery to mark it as down before the port scan even runs. Fix: Add -Pn to skip host discovery and scan ports directly:

nmap -6 -Pn 2001:db8::a1

Error: Link-local address scan fails despite correct syntax Cause: Missing or incorrect interface specification. Fix: Confirm the correct interface name using ip -6 addr (Linux) or ipconfig (Windows), then append %interface to the address.

Slow or incomplete scans on large networks Cause: Attempting a brute-force sweep of an entire /64. Fix: Use multicast-based discovery scripts or externally gathered host lists instead of sequential scanning.

Security Best Practices for IPv6 Scanning

• Always get explicit written authorization before scanning any network, IPv6 included — legal exposure is identical to IPv4 scanning.
• Rate-limit scans on production networks using --max-rate to avoid triggering IDS/IPS alerts or overwhelming network equipment.
• Be aware that many organizations have far less mature IPv6 monitoring than IPv4, meaning IPv6 scans can go undetected longer — this cuts both ways for defenders and testers, so document all activity carefully.
• Combine active scanning with passive reconnaissance (DNS records, certificate transparency logs) since active discovery alone is often insufficient on IPv6.
• When scanning your own infrastructure, disable unnecessary multicast responses on production hosts to reduce reconnaissance surface.

Limitations of Nmap’s IPv6 Support

• OS fingerprinting for IPv6 has a smaller signature database than IPv4, so results are less reliable.
• Traceroute over IPv6 can behave inconsistently across different ISPs and tunneling setups (like 6to4 or Teredo).
• Not all NSE scripts have been updated to handle IPv6 addressing correctly, so occasional script errors are expected on less common scripts.
• Brute-force host discovery across large subnets is not practically feasible, which fundamentally changes reconnaissance methodology compared to IPv4.

Quick Reference Table

IPv6 Address Notation Quirks Worth Knowing

IPv6 addresses can be written in several shorthand forms, and understanding these matters when building target lists or parsing scan output:

• Compressed zeros: 2001:0db8:0000:0000:0000:0000:0000:0001 can be written as 2001:db8::1, collapsing consecutive groups of zeros with ::. This shorthand can only be used once per address, since using it twice would make the expansion ambiguous.
• Leading zeros: Each group can drop leading zeros, so 00a1 becomes a1.
• Mixed notation: IPv6 addresses can embed an IPv4 address in the last 32 bits, written like ::ffff:192.168.1.1, commonly used for IPv4-mapped addresses.

When writing scripts or host list files for Nmap, it’s safest to use the fully expanded or the canonical compressed form consistently, since mixing notations across a target file can occasionally cause confusion when cross-referencing results against DNS or asset inventories.

Dual-Stack Environments: Practical Considerations

Most real-world networks today run dual-stack, meaning hosts have both an IPv4 and an IPv6 address simultaneously. This has a few practical implications for scanning:

• A host might expose different services or have different firewall rules on its IPv4 versus IPv6 interface — it’s not safe to assume parity between the two.
• Vulnerability scanning should ideally cover both address families separately, since a hardened IPv4 configuration doesn’t guarantee the IPv6 side received the same treatment (a common real-world oversight during network hardening).
• DNS resolution during automated scans should explicitly request AAAA records rather than assuming a resolver will return them alongside A records.

A simple dual-stack scanning wrapper might look like this in a shell script:

#!/bin/bash
TARGET_V4="192.168.1.10"
TARGET_V6="2001:db8::10"

echo "Scanning IPv4 target..."
nmap -sV -oA results_v4 "$TARGET_V4"

echo "Scanning IPv6 target..."
nmap -6 -sV -oA results_v6 "$TARGET_V6"

Frequently Asked Questions

Does Nmap support both IPv4 and IPv6 in a single scan command? No. Nmap requires separate invocations for each protocol family — the -6 flag switches the entire scan into IPv6 mode, so a single command can’t mix both simultaneously.

Can I scan an IPv6 address without knowing the interface for link-local addresses? Not reliably. Because link-local addresses aren’t globally unique, the operating system needs to know which interface to send traffic out of, so omitting the %interface suffix will typically cause the scan to fail or behave unpredictably.

Why do IPv6 scans sometimes report far fewer hosts than expected on a subnet? This is almost always because sequential/brute-force host discovery doesn’t work at IPv6 scale. Relying on multicast discovery scripts, known host lists, or passive reconnaissance (DNS, certificate transparency) is necessary to build an accurate picture of what’s actually present.

Is IPv6 scanning legally different from IPv4 scanning? No — the same authorization requirements apply. Scanning any network, IPv4 or IPv6, without permission carries the same legal risk in most jurisdictions.

Does firewall evasion work the same way on IPv6? Mostly, though IPv6-specific extension headers introduce additional evasion and filtering considerations that don’t exist in IPv4. Many firewall products historically had less mature IPv6 rule sets, which is worth being aware of during assessments, though this gap has been narrowing over time.

Conclusion

Scanning IPv6 networks with Nmap isn’t fundamentally more difficult than IPv4 — it just requires a different mental model. The address space is too large for brute-force sweeps, multicast and neighbor discovery replace ARP, and link-local addresses need explicit interface binding. Once these differences are understood, the rest of Nmap’s functionality — port scanning, service detection, scripting, and output formatting — carries over almost identically. As more networks fully transition to IPv6, mastering these techniques becomes less optional and more essential for anyone working in network security or systems administration.