Lessons from an (Unsuccessful?) IPv6 Amplification Honeypot Deployment

While DRDoS attacks are well-understood in IPv4, it is not known to what extend attackers also make use of services on the IPv6 Internet to perform DRDoS attacks.In this work, we adapted an IPv4-only DRDoS honeypot to observe DRDoS attacks in IPv6.To attract scanners, we publicized our honeypots' addresses on the TUM IPv6 Hitlist.After one year of data collection, however, we observed little to no attackers exploiting IPv6 UDP services for DRDoS attacks.This paper presents our setup, findings, and the lessons learned from trying attract scanners to our DRDoS honeypot: we analyze the interactions we observed over time as well as the source addresses of scanners, and discuss how our choice of the IPv6 Hitlist as an address exposure method possibly impacted our findings.Although we managed to attract several scanners also observed by previous work, our results show that there are currently no attackers performing DRDoS attacks in IPv6, at least among these that rely on the IPv6 Hitlist to discover vulnerable hots.