path6 - A versatile IPv6-based traceroute tool

       The path6 tool and the corresponding manual pages were produced by Fernando Gont  <fgont@si6networks.com>
       for SI6 Networks <http://www.si6networks.com>.

       Copyright (c) 2014-2015 Fernando Gont.

       Permission  is  granted  to  copy, distribute and/or modify this document under the terms of the GNU Free
       Documentation License, Version 1.3 or any later version published by the Free Software  Foundation;  with
       no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.  A copy of the license is available
       at <http://www.gnu.org/licenses/fdl.html>.

                                                                                                        PATH6(1)

path6  is  an  IPv6  traceroute tool, with full support for IPv6 Extension Headers. It is part of the SI6
       Networks' IPv6 Toolkit: a security assessment suite for the IPv6 protocols.

       The following sections illustrate typical use cases of the path6 tool.

       Example#1

       # scan6 -i eth0 -L -e -v

       Perform host scanning on the local network ("-L" option) using interface "eth0" ("-i" option).  Use  both
       ICMPv6  echo  requests  and  unrecognized  IPv6 options of type 10xxxxxx (default). Print link-link layer
       addresses along with IPv6 addresses ("-e" option). Be verbose ("-v" option).

       Example#2

       # scan6 -d 2001:db8::/64 --tgt-virtual-machines all --ipv4-host 10.10.10.0/24

       Scan for virtual machines (both VirtualBox and  vmware)  in  the  prefix  2001:db8::/64.  The  additional
       information about the IPv4 prefix employed by the host system is leveraged to reduce the search space.

       Example#3

       # scan6 -d 2001:db8::/64 --tgt-ipv4-embedded ipv4-32 --ipv4-host 10.10.10.0/24

       Scan  for  IPv6 addresses of the network 2001:db8::/64 that embed the IPv4 prefix 10.10.10.0/24 (with the
       32-bit encoding).

       Example#4

       # scan6 -d 2001:db8:0-500:0-1000

       Scan for IPv6 addresses of the network 2001:db8::/64, varying the two lowest order 16-bit  words  of  the
       addresses in the range 0-500 and 0-1000, respectively.

       Example#5

       # scan6 -d fc00::/64 --tgt-vendor 'Dell Inc' -p tcp

       Scan  for network devices manufactured by 'Dell Inc' in the target prefix fc00::/64. The tool will employ
       TCP segments as the probe packets (rather than the default ICMPv6 echo requests).

       path6 - A versatile IPv6-based traceroute tool

path6 takes its parameters as command-line options. Each of the options can be  specified  with  a  short
       name  (one  character  preceded  with  the  hyphen character, as e.g. "-i") or with a long name (a string
       preceded with two hyphen characters, as e.g. "--interface").

       Most of probe packet details can be specified by means of the available options. When TCP  or  UDP  probe
       packets are employed, the Source Port of the probe packets is used to encode the probe packet number.

       The  current version of the tool will only print IPv6 addresses and will not try to reverse-map such IPv6
       addresses into hostnames.

       -iinterface,--interfaceinterface

              This option specifies the network interface to be used by the path6tool.Itcanbeusedforoverridingtheoutputinterfaceselectedbasedonthelocalroutingtable.-sSRC_ADDR,--src-addressSRC_ADDR

              This  option  specifies the IPv6 source address (or IPv6 prefix) to be used for the Source Address
              of the attack packets. If a prefix is specified, the Source Address is randomly selected from that
              prefix.

       -dDST_ADDR,--dst-addressDST_ADDR

              This option specifies the IPv6 Destination Address of the target.

       -SSRC_LINK_ADDR,--src-link-addressSRC_LINK_ADDR

              This option can be used to override the link-layer Source Address of the packets.

       -DDST_LINK_ADDR,--dst-link-addressDST_LINK_ADDR

              This option can be used to override the link-layer Destination Address of the outgoing packets.

       -ySIZE,--frag-hdrSIZE

              This option specifies that the probe packets  must  be  fragmented.  The  fragment  size  must  be
              specified as an argument to this option.

       -uHDR_SIZE,--dst-opt-hdrHDR_SIZE

              This  option  specifies  that  a  Destination  Options  header  is  to be included in the outgoing
              packet(s). The extension header size must be specified as an argument to this option  (the  header
              is filled with padding options). Multiple Destination Options headers may be specified by means of
              multiple "-u" options.

       -UHDR_SIZE,--dst-opt-u-hdrHDR_SIZE

              This  option specifies a Destination Options header to be included in the "unfragmentable part" of
              the outgoing packet(s). The header size must be specified as  an  argument  to  this  option  (the
              header  is  filled with padding options). Multiple Destination Options headers may be specified by
              means of multiple "-U" options.

       -HHDR_SIZE,--hbh-opt-hdrHDR_SIZE

              This option specifies that a  Hop-by-Hop  Options  header  is  to  be  included  in  the  outgoing
              packet(s).  The  header size must be specified as an argument to this option (the header is filled
              with padding options). Multiple Hop-by-Hop Options headers may be specified by means  of  multiple
              "-H" options.

       -pPROBE_TYPE,--probe-typePROBE_TYPE

              This  option  specifies  the  protocol  to  be used for the probe packets. Possible arguments are:
              "icmp" (for ICMPv6 Echo Request), "tcp" (for TCP), and "udp" (for UDP). If left  unspecified,  the
              probe packets default to ICMPv6 Echo Request.

       -PPAYLOAD_SIZE,--payload-sizePAYLOAD_SIZE

              This option specifies the payload size of the probe packets.

       -oSRC_PORT,--src-portSRC_PORT

              This  option specifies the TCP/UDP Source Port. If left unspecified, the Source Port is randomized
              from the range 1024-65535.

       -aDST_PORT,--dst-portDST_PORT

              This option specifies the TCP/UDP Destination Port. If  left  unspecified,  the  Destination  Port
              defaults  to  80  for  the TCP case, and a randomized value (in the range 60000-65000) for the UDP
              case.

       -XTCP_FLAGS,--tcp-flagsTCP_FLAGS

              This option is used to set specific the TCP flags. The flags  are  specified  as  "F"  (FIN),  "S"
              (SYN), "R" (RST), "P" (PSH), "A" (ACK), "U" (URG), "X" (no flags).

              If this option is left unspecified, the ACK bit is set on all probe packets.

       -v, --verbose

              This  option selects the "verbosity" of the tool. If this option is left unspecified, only minimum
              information is printed.

       -h, --help

              Print help information for the path6 tool.

ipv6toolkit.conf(5)

       draft-ietf-opsec-ipv6-host-scanning                      eal-world>)lafor a discussion of support of IPv6
       <http://tools.ietf.org/html/draft-gont-v6ops-ipv6-ehs-in-
       packets with extension headers in the IPv6 Internet.

path6  [-d]  [-iINTERFACE] [-sSRC_ADDR[/LEN]] [-SLINK_SRC_ADDR] [-DLINK_DST_ADDR] [-yFRAG_SIZE] [-uDST_OPT_HDR_SIZE]  [-UDST_OPT_U_HDR_SIZE]  [-HHBH_OPT_HDR_SIZE]  [-rLIMIT]  [-pPROBE_TYPE]   [-PPAYLOAD_SIZE] [-aDST_PORT] [-XTCP_FLAGS] [-v] [-h]