"IPv6 is enabled by default on more and more devices. Because of the way it designed, it is capable of configuring many operational characteristics automatically without any user interaction. Therefore, even if you have not officially enabled IPv6 on your network, it may still be operational and open up avenues that can be utilized by an attacker. These avenues can even potentially bypass firewall rules since IPv4 firewall rules do not limit access to traffic via IPv6. After gaining access to a s ingle system, an attacker may use IPv6 as a jumping off point to attack other systems on the network. In this talk, I will examine various open source IPv6 tools that can be used to by network operators to identify hosts and services that are available through IPv6 on a network. One of the biggest hurtles is simply understanding how to handle the large address space that is available. Even a s imple ping network scan (which is taken for granted in IPv4) is not available in IPv6 due to the sheer size of an IPv6 subnet (2**64 which is twice as large as the size of the current internet). To make things even more interesting, ARP has been deprecated and replaced with ICMP messages that utilize multicast traffic. Understanding how this multicast traffic operates is vital to determining your exposure to IPv6 traffic – even if you have not done anything to configu e IPv6 on your network. Understanding th is multicast traffic is also crucial to understanding how to most effectively use the IPv6 tools that are available. These are the same tools that an attacker can use once he gains access to a system on the network. By understanding how to use these tools, not only will you understand your exposure via IPv6, but you will also get an idea of how a attacker can utilize IPv6 traffic on your network. I will also outline steps that you can take to reduce your exposure and thus harden your network against this potential threat."