ICMPv6 provides ICMP function for IPv6. Table 1 shows the ICMPv6 events that are considered for scan detection and the suspicion level associated with each event. Events are classified by the first matching entry in the table.
Event | Destination address | Event classification |
---|---|---|
Receive Echo Request | Multicast | Very suspicious |
Receive Echo Request that is denied by Quality of Service (QoS) policy | Unicast | Normal |
Receive Echo Request with Routing Header | Unicast | Possibly suspicious |
Receive Echo Request without Routing Header | Unicast | Normal |