IPv6 newsservers sorted on IPv6 address

 ... shows which newsservers are hosted on the same IPv6 address, or in the same IPv6 ranges.

$ grep "has IPv6 address" *.txt | sed -e 's/\.txt:/ /'  | awk '{ print $1 " " $2 " " $NF }' | awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }' | sort -u 

1:67c:174:101:0:65:ff02:177 news.usenetdeal.com news.usenetdeal.com

2001:49f0:d086:1000::1:2 bonus.frugalusenet.com bonus.frugalusenet.com

2001:4de0:1::128 post6.eweka.nl post6.eweka.nl

2001:4de0:1::201 news6.astraweb.com news6.astraweb.com

2001:4de0:1::203 news6.astraweb.com news6.astraweb.com

2001:4de0:1::205 news6.eweka.nl news6.eweka.nl

2001:4de0:1::219 news6.eweka.nl news6.eweka.nl

2001:4de0:1::220 eu.geo.newsleecher.com eu.newsleecher.com

2001:4de0:1::220 eu.geo.newsleecher.com news.newsleecher.com

2001:4de0:1::220 news.am4.highwinds-media.com news.snelnl.com

2001:4de0:1::220 news.am4.highwinds-media.com power2.usenet.nl

2001:4de0:1::220 news.am4.highwinds-media.com ssl-news.snelnl.com

2001:4de0:1::220 news.ams.highwinds-media.com news-nl.newsgroup.ninja

2001:4de0:1::220 nl.sslusenet.com nl.sslusenet.com

2001:4de0:1::220 secure.newsfarm.ams2.highwinds-media.com europessl.usenet-access.com

2001:4de0:1::220 secure.newsfarm.ams2.highwinds-media.com news.ssl.nl.prepaid-usenet.de

2001:4de0:1::224 news6.ams.newshosting.com news6.ams.newshosting.com

2001:4de0:1::224 news6.ams.newshosting.com news-eu6.newshosting.com

2001:4de0:1::224 news6.ams.newshosting.com news-nl6.newshosting.com

2001:4de0:1::225 news6.ams.usenetserver.com news6.ams.usenetserver.com

2001:4de0:1::225 news6.eu.usenetserver.com news6.eu.usenetserver.com

2001:4de0:1::225 news6.eu.usenetserver.com news-eu6.usenetserver.com

2001:4de0:1::233 news6.eweka.nl news6.eweka.nl

2001:4de0:1::234 eu.geo.newsleecher.com eu.newsleecher.com

2001:4de0:1::234 eu.geo.newsleecher.com news.newsleecher.com

2001:4de0:1::234 news.am4.highwinds-media.com news.snelnl.com

2001:4de0:1::234 news.am4.highwinds-media.com power2.usenet.nl

2001:4de0:1::234 news.am4.highwinds-media.com ssl-news.snelnl.com

2001:4de0:1::234 news.ams.highwinds-media.com news-nl.newsgroup.ninja

2001:4de0:1::234 nl.sslusenet.com nl.sslusenet.com

2001:4de0:1::234 secure.newsfarm.ams2.highwinds-media.com europessl.usenet-access.com

2001:4de0:1::234 secure.newsfarm.ams2.highwinds-media.com news.ssl.nl.prepaid-usenet.de

2001:4de0:1::238 news6.ams.newshosting.com news6.ams.newshosting.com

2001:4de0:1::238 news6.ams.newshosting.com news-eu6.newshosting.com

2001:4de0:1::238 news6.ams.newshosting.com news-nl6.newshosting.com

2001:4de0:1::239 news6.ams.usenetserver.com news6.ams.usenetserver.com

2001:4de0:1::239 news6.eu.usenetserver.com news6.eu.usenetserver.com

2001:4de0:1::239 news6.eu.usenetserver.com news-eu6.usenetserver.com

2001:4de0:3:119::101 ams2.sslusenet.com ams2.sslusenet.com

2001:4de0:3:119::101 de.sslusenet.com de.sslusenet.com

2001:4de0:3:119::101 de.sslusenet.com news.sslusenet.com

2001:4de0:3:119::101 news.fr7.highwinds-media.com news3.snelnl.com

2001:4de0:3:119::101 news.fr7.highwinds-media.com news-de.newsgroup.ninja

2001:4de0:3:119::101 news.fr7.highwinds-media.com news.newsgroup.ninja

2001:4de0:3:119::101 news.fr7.highwinds-media.com news.premium-news.de

2001:4de0:3:119::101 news.fr7.highwinds-media.com news.shemes.com

2001:4de0:3:119::101 news.fr7.highwinds-media.com reader.snelnl.com

2001:4de0:3:119::109 secure6.news.eu.easynews.com secure6.news.easynews.com

2001:4de0:3:119::109 secure6.news.eu.easynews.com secure6.news.eu.easynews.com

2001:4de0:3:119::109 test-secure-eu-ipv6.news.easynews.com test-secure-eu-ipv6.news.easynews.com

2001:4de0:3:119::109 test-secure-eu.news.easynews.com test-secure-eu.news.easynews.com

2001:4de0:3:119::129 news6.fr7.newshosting.com news6.fr7.newshosting.com

2001:4de0:3:119::129 news6.fr7.newshosting.com news6.newshosting.com

2001:4de0:3:119::129 news6.fr7.newshosting.com news-de6.newshosting.com

2001:4de0:3:119::160 extremeusenet.sslusenet.com news.extremeusenet.nl

2001:4de0:3:119::160 extremeusenet.sslusenet.com reader.extremeusenet.nl

2001:4de0:3:119::161 pro.sslusenet.com pro.sslusenet.com

2001:4de0:3:119::162 news6.xlned.com news6.xlned.com

2001:4de0:3:119::163 news6.sunnyusenet.com news6.sunnyusenet.com

2001:4de0:3:119::164 news6.pureusenet.nl news6.pureusenet.nl

2001:4de0:3:119::170 extremeusenet.sslusenet.com news.extremeusenet.nl

2001:4de0:3:119::170 extremeusenet.sslusenet.com reader.extremeusenet.nl

2001:4de0:3:119::171 pro.sslusenet.com pro.sslusenet.com

2001:4de0:3:119::172 news6.xlned.com news6.xlned.com

2001:4de0:3:119::173 news6.sunnyusenet.com news6.sunnyusenet.com

2001:4de0:3:119::174 news6.pureusenet.nl news6.pureusenet.nl

2001:4de0:3:119::175 usenetbucket.sslusenet.com news.usenetbucket.com

2001:4de0:3:119::175 usenetbucket.sslusenet.com reader.usenetbucket.com

2001:4de0:3:119::176 news6.tweaknews.nl news6.tweaknews.nl

2001:4de0:3:119::177 news6.tweaknews.eu news6.tweaknews.eu

2001:4de0:3:119::64 news6.eu.usenetserver.com news6.eu.usenetserver.com

2001:4de0:3:119::64 news6.eu.usenetserver.com news-eu6.usenetserver.com

2001:4de0:3:119::64 news6.fr7.usenetserver.com news6.fr7.usenetserver.com

2001:4de0:3:119::64 news6.fr7.usenetserver.com news6.usenetserver.com

2001:4de0:3:119::65 news6.fr7.newshosting.com news6.fr7.newshosting.com

2001:4de0:3:119::65 news6.fr7.newshosting.com news6.newshosting.com

2001:4de0:3:119::65 news6.fr7.newshosting.com news-de6.newshosting.com

2001:4de0:3:119::69 ams2.sslusenet.com ams2.sslusenet.com

2001:4de0:3:119::69 de.sslusenet.com de.sslusenet.com

2001:4de0:3:119::69 de.sslusenet.com news.sslusenet.com

2001:4de0:3:119::69 news.fr7.highwinds-media.com news3.snelnl.com

2001:4de0:3:119::69 news.fr7.highwinds-media.com news-de.newsgroup.ninja

2001:4de0:3:119::69 news.fr7.highwinds-media.com news.newsgroup.ninja

2001:4de0:3:119::69 news.fr7.highwinds-media.com news.premium-news.de

2001:4de0:3:119::69 news.fr7.highwinds-media.com news.shemes.com

2001:4de0:3:119::69 news.fr7.highwinds-media.com reader.snelnl.com

2001:4de0:3:119::76 news6.eu.easynews.com news6.easynews.com

2001:4de0:3:119::76 news6.eu.easynews.com news6.eu.easynews.com

2001:4de0:3:119::76 test-eu-ipv6.news.easynews.com test-eu-ipv6.news.easynews.com

2001:4de0:3:119::76 test-eu.news.easynews.com test-eu.news.easynews.com

2001:4de0:3:119::96 news6.eu.usenetserver.com news6.eu.usenetserver.com

2001:4de0:3:119::96 news6.eu.usenetserver.com news-eu6.usenetserver.com

2001:4de0:3:119::96 news6.fr7.usenetserver.com news6.fr7.usenetserver.com

2001:4de0:3:119::96 news6.fr7.usenetserver.com news6.usenetserver.com

2001:4de0:3:119::97 news6.fr7.newshosting.com news6.fr7.newshosting.com

2001:4de0:3:119::97 news6.fr7.newshosting.com news6.newshosting.com

2001:4de0:3:119::97 news6.fr7.newshosting.com news-de6.newshosting.com

2001:67c:174:101:0:65:ff02:122 reader6.newsxs.nl reader6.newsxs.nl

2001:67c:174:101:0:65:ff02:126 news.gebruikhet.net news.gebruikhet.net

2001:67c:174:101:0:65:ff02:128 nl.eu.easyusenet.nntpnet.com news.easyusenet.nl

2001:67c:174:101:0:65:ff02:128 nl.eu.easyusenet.nntpnet.com reader.easyusenet.nl

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com news.xsnews.nl

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.com

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.co.uk

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.de

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.es

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.fr

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.it

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.nl

2001:67c:174:101:0:65:ff02:131 nl.eu.xsnews.nntpnet.com reader.xsnews.pt

2001:67c:174:101:0:65:ff02:154 news.bulknews.eu news.bulknews.eu

2001:67c:174:101:0:65:ff02:155 reader.usenetdiscounter.com reader.usenetdiscounter.com

2001:67c:174:101:0:65:ff02:167 reader.usenet.agency reader.usenet.agency

2001:67c:174:101:0:65:ff02:168 news.stingyusenet.com news.stingyusenet.com

2001:67c:174:101:0:65:ff02:169 news.usenet.org news.usenet.org

2001:67c:174:101:0:65:ff02:170 reader.usenight.com reader.usenight.com

2001:67c:174:101:0:65:ff02:171 news.kpn.nl news.kpn.nl

2001:67c:174:101:0:65:ff02:172 news.xs4all.nl news.xs4all.nl

2001:67c:174:101:0:65:ff02:172 newszilla.xs4all.nl newszilla.xs4all.nl

2001:67c:174:101:0:65:ff02:174 news.hitnews.com news.hitnews.com

2001:67c:174:101:0:65:ff02:181 reader.turbousenet.com reader.turbousenet.com

2001:67c:174:101::1002 news.xennanews.com news.xennanews.com

2001:67c:174:101:1:65:201:236 test.xsnews.com test.xsnews.com

2607:bc40:0:119::2:1 news-v6.frugalusenet.com news-v6.frugalusenet.com

2607:bc40:0:119::2:2 news-v6.frugalusenet.com news-v6.frugalusenet.com

2607:bc40:0:119::2:3 news-v6.frugalusenet.com news-v6.frugalusenet.com

2607:bc40:0:119::2:4 news-v6.frugalusenet.com news-v6.frugalusenet.com

2607:bc40:100::2 asnews-v6.frugalusenet.com asnews-v6.frugalusenet.com

2607:bc40:101::2 sanews-v6.frugalusenet.com sanews-v6.frugalusenet.com

2607:bc40:102::3 aunews-v6.frugalusenet.com aunews-v6.frugalusenet.com

2607:bc40:2:119::1:1 eunews-v6.blocknews.net eunews-v6.blocknews.net

2607:bc40:2:119::1:2 eunews-v6.blocknews.net eunews-v6.blocknews.net

2607:bc40:2:119::1:3 eunews-v6.blocknews.net eunews-v6.blocknews.net

2607:bc40:2:119::1:4 eunews-v6.blocknews.net eunews-v6.blocknews.net

2607:bc40:2:119::2:1 eunews-v6.frugalusenet.com eunews-v6.frugalusenet.com

2607:bc40:2:119::2:2 eunews-v6.frugalusenet.com eunews-v6.frugalusenet.com

2607:bc40:2:119::2:3 eunews-v6.frugalusenet.com eunews-v6.frugalusenet.com

2607:bc40:2:119::2:4 eunews-v6.frugalusenet.com eunews-v6.frugalusenet.com

2607:bc40:2:119::3:1 eunews-v6.usenetnow.net eunews-v6.usenetnow.net

2607:bc40:2:119::3:2 eunews-v6.usenetnow.net eunews-v6.usenetnow.net

2607:bc40:2:119::3:3 eunews-v6.usenetnow.net eunews-v6.usenetnow.net

2607:bc40:2:119::3:4 eunews-v6.usenetnow.net eunews-v6.usenetnow.net

2a00:1d38:fa:1001:119::1 news6.usenet.farm news6.usenet.farm

2a00:1d38:fa:1001:119::1 news.usenet.farm news.usenet.farm

2a00:1d38:fa:1001:119::1 news.usenet.farm news.usenetfarm.eu

2a00:1d38:fa:1001:119::2 blue.usenetnews.net blue.usenetnews.net

2a00:1d38:fa:1001:119::4 news6.usenet.farm news6.usenet.farm

2a00:1d38:fa:1001:119::4 news.usenet.farm news.usenet.farm

2a00:1d38:fa:1001:119::4 news.usenet.farm news.usenetfarm.eu

2a00:1d38:fa:1001:119::6 rid47.usenet.business farm.newsgroupdirect.com

2a01:4f8:1c17:f346::1 news.solani.org news.solani.org

2a01:4f8:c010:63b5::1 news.solani.org news.solani.org

2a01:4f9:4b:44c2::2 news.eternal-september.org news.eternal-september.org

2a01:4f9:c012:f55a::1 nntp.eternal-september.org reader443.eternal-september.org

2a01:788:4:100::217 iad.sslusenet.com iad.sslusenet.com

2a01:788:4:100::217 news.iad.highwinds-media.com news2.snelnl.com

2a01:788:4:100::217 news.iad.highwinds-media.com news-us.newsgroup.ninja

2a01:788:4:100::217 news.iad.highwinds-media.com ssl-news2.snelnl.com

2a01:788:4:100::217 secure.newsfarm.iad.highwinds-media.com news.ssl.usa.prepaid-usenet.de

2a01:788:4:100::217 secure.newsfarm.iad.highwinds-media.com secure.newsgroup-binaries.com

2a01:788:4:100::217 secure.newsfarm.iad.highwinds-media.com ssl.usenet-access.com

2a01:788:4:100::217 us.geo.newsleecher.com us.newsleecher.com

2a01:788:4:100::217 us.sslusenet.com us.sslusenet.com

2a01:788:4:100::219 us6.astraweb.com us6.astraweb.com

2a01:788:4:100::220 iad.sslusenet.com iad.sslusenet.com

2a01:788:4:100::220 news.iad.highwinds-media.com news2.snelnl.com

2a01:788:4:100::220 news.iad.highwinds-media.com news-us.newsgroup.ninja

2a01:788:4:100::220 news.iad.highwinds-media.com ssl-news2.snelnl.com

2a01:788:4:100::220 secure.newsfarm.iad.highwinds-media.com news.ssl.usa.prepaid-usenet.de

2a01:788:4:100::220 secure.newsfarm.iad.highwinds-media.com secure.newsgroup-binaries.com

2a01:788:4:100::220 secure.newsfarm.iad.highwinds-media.com ssl.usenet-access.com

2a01:788:4:100::220 us.geo.newsleecher.com us.newsleecher.com

2a01:788:4:100::220 us.sslusenet.com us.sslusenet.com

2a01:788:4:100::221 news6.iad.usenetserver.com news6.iad.usenetserver.com

2a01:788:4:100::221 news6.iad.usenetserver.com news-us6.usenetserver.com

2a01:788:4:100::225 news6.iad.newshosting.com news6.iad.newshosting.com

2a01:788:4:100::225 news6.iad.newshosting.com news-us6.newshosting.com

2a01:788:4:100::230 news6.us.easynews.com news6.us.easynews.com

2a01:788:4:100::230 test-us-ipv6.news.easynews.com test-us-ipv6.news.easynews.com

2a01:788:4:100::230 test-us.news.easynews.com test-us.news.easynews.com

2a01:788:4:100::231 secure6.news.us.easynews.com secure6.news.us.easynews.com

2a01:788:4:100::231 test-secure-us-ipv6.news.easynews.com test-secure-us-ipv6.news.easynews.com

2a01:788:4:100::231 test-secure-us.news.easynews.com test-secure-us.news.easynews.com

2a01:788:4:100::240 news6.iad.usenetserver.com news6.iad.usenetserver.com

2a01:788:4:100::240 news6.iad.usenetserver.com news-us6.usenetserver.com

2a01:788:4:100::243 news6.us.easynews.com news6.us.easynews.com

2a01:788:4:100::243 test-us-ipv6.news.easynews.com test-us-ipv6.news.easynews.com

2a01:788:4:100::243 test-us.news.easynews.com test-us.news.easynews.com

2a01:788:4:100::244 secure6.news.us.easynews.com secure6.news.us.easynews.com

2a01:788:4:100::244 test-secure-us-ipv6.news.easynews.com test-secure-us-ipv6.news.easynews.com

2a01:788:4:100::244 test-secure-us.news.easynews.com test-secure-us.news.easynews.com

2a01:788:4:100::251 news6.iad.newshosting.com news6.iad.newshosting.com

2a01:788:4:100::251 news6.iad.newshosting.com news-us6.newshosting.com

2a01:788:4:100::254 us6.astraweb.com us6.astraweb.com

2a02:d28:10:1b:0:431:ff02:164 news.cheapnews.eu news.cheapnews.eu

2a02:d28:10:1b:0:431:ff02:165 block.cheapnews.eu block.cheapnews.eu

2a07:8080:119:1fe::132 news.usenetexpress.com news.usenetexpress.com

2a07:8080:119:1fe::133 nd.tlsusenet.com europe.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com europe-ssl.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com news.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com nl.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com useast.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com us.newsdemon.com

2a07:8080:119:1fe::133 nd.tlsusenet.com us-secure.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com europe.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com europe-ssl.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com news.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com nl.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com useast.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com us.newsdemon.com

2a07:8080:119:1fe::157 nd.tlsusenet.com us-secure.newsdemon.com

2a07:8080:119:1fe::158 news.usenetexpress.com news.usenetexpress.com

2a07:8080:119:fe::121 news.newsgroupdirect.com de.newsgroupdirect.com

2a07:8080:119:fe::121 news.newsgroupdirect.com news-eu.newsgroupdirect.com

2a07:8080:119:fe::121 news.newsgroupdirect.com news-eu-ssl.newsgroupdirect.com

2a07:8080:119:fe::121 news.newsgroupdirect.com news.maximumusenet.com

2a07:8080:119:fe::121 news.newsgroupdirect.com news.newsgroupdirect.com

2a07:8080:119:fe::121 news.newsgroupdirect.com news-ssl.newsgroupdirect.com

2a07:8080:119:fe::121 news.newsgroupdirect.com useast.maximumusenet.com

2a07:8080:119:fe::121 news.newsgroupdirect.com us-secure.maximumusenet.com

2a07:8080:119:fe::124 usenetprime.tlsusenet.com news.usenetprime.com

2a07:8085:119:fe::170 news-eu.usenetexpress.com news-eu.usenetexpress.com

2a07:8085:119:fe::176 nd-eu.tlsusenet.com eu.newsdemon.com

2a07:8085:119:fe::180 news-eu.usenetexpress.com news-eu.usenetexpress.com

2a07:8085:119:fe::181 eu-tst.newsgroupdirect.com eu-tst.newsgroupdirect.com

2a07:8085:119:fe::186 nd-eu.tlsusenet.com eu.newsdemon.com

2a13:d6c0:1:16::119 news6.dwld.link news6.dwld.link

2a13:d6c0:1:16::119 news.dwld.link news.dwld.link

2a13:d6c0:1:16::119 news.dwld.link reader.high-way.me

2a13:d6c0:1:16::119 news.dwld.link reader.simply-premium.com

IPv6 ranges of newsservers

Based on the overview on https://www.appelboor.com/newsservers/newsservers-with-SSL-TLS-OK.html with about 300 newsservers, I did resolving, and some sorting to find IPv6 ranges of newsservers:

$ lynx --dump https://www.appelboor.com/newsservers/newsservers-with-SSL-TLS-OK.html | grep -E ".*\..*\."  | awk '{ print "host " $1 " > " $1 ".txt"  }' | sh

and only using the left 4x4-octet parts (what's the official name?):

$ cat *.txt | grep "has IPv6 address"   | awk '{ print $NF }'   | awk -F\: '{ print $1 ":" $2 ":" $3 ":" $4 "::" }'   | sort | uniq -c | sort -rn

     59 2001:4de0:3:119::

     40 2a01:788:4:100::

     36 2001:4de0:1:::

     26 2001:67c:174:101::

     16 2a07:8080:119:1fe::

     12 2607:bc40:2:119::

      9 2a07:8080:119:fe::

      8 2a00:1d38:fa:1001::

      5 2a07:8085:119:fe::

      4 2a13:d6c0:1:16::

      4 2607:bc40:0:119::

      2 2a02:d28:10:1b::

      1 2a01:4f9:c012:f55a::

      1 2a01:4f9:4b:44c2::

      1 2a01:4f8:c010:63b5::

      1 2a01:4f8:1c17:f346::

      1 2607:bc40:102:::

      1 2607:bc40:101:::

      1 2607:bc40:100:::

      1 2001:49f0:d086:1000::

      1 1:67c:174:101::

So 2001:4de0:3:119:: is the most occuring IPv6 range (note the funny 119 ... port 119 of NNTP). Which is Eweka. 

Let's see which newsserver point to this range:

$ grep 2001:4de0:3:119 *.txt | awk -F\: '{ print $1 }'   | sort -u | sed -e 's/.txt//'

ams2.sslusenet.com

de.sslusenet.com

news3.snelnl.com

news6.easynews.com

news6.eu.easynews.com

news6.eu.usenetserver.com

news6.fr7.newshosting.com

news6.fr7.usenetserver.com

news6.newshosting.com

news6.pureusenet.nl

news6.sunnyusenet.com

news6.tweaknews.eu

news6.tweaknews.nl

news6.usenetserver.com

news6.xlned.com

news-de6.newshosting.com

news-de.newsgroup.ninja

news-eu6.usenetserver.com

news.extremeusenet.nl

news.newsgroup.ninja

news.premium-news.de

news.shemes.com

news.sslusenet.com

news.usenetbucket.com

pro.sslusenet.com

reader.extremeusenet.nl

reader.snelnl.com

reader.usenetbucket.com

secure6.news.easynews.com

secure6.news.eu.easynews.com

test-eu-ipv6.news.easynews.com

test-eu.news.easynews.com

test-secure-eu-ipv6.news.easynews.com

test-secure-eu.news.easynews.com

Ah: Eweka itself is in another range

$ host news6.eweka.nl

news6.eweka.nl has IPv6 address 2001:4de0:1::219

news6.eweka.nl has IPv6 address 2001:4de0:1::205

news6.eweka.nl has IPv6 address 2001:4de0:1::233

So let's use less octets from the IPv6 addresses: just 2x4octets:

$ cat *.txt | grep "has IPv6 address"   | awk '{ print $NF }'   | awk -F\: '{ print $1 ":" $2 "::" }'   | sort | uniq -c | sort -rn

     95 2001:4de0::

     40 2a01:788::

     26 2001:67c::

     25 2a07:8080::

     19 2607:bc40::

      8 2a00:1d38::

      5 2a07:8085::

      4 2a13:d6c0::

      2 2a02:d28::

      2 2a01:4f9::

      2 2a01:4f8::

      1 2001:49f0::

      1 1:67c::

Eweka number one!

And now the interesting part: which newsservers have IPv4, but have not configured the corresponding IPv6 address in their DNS / name resolving. Bad, bad, bad!!!

IPv6 or no IPv6 ... inferring an IPv6 address of a IPv4-only newsserver

Very hacky, but nice:

The newsserver eu.usenetprime.com has no IPv6 address:

$ host eu.usenetprime.com

eu.usenetprime.com is an alias for usenetprime-eu.tlsusenet.com.

usenetprime-eu.tlsusenet.com has address 185.151.15.173

Pity. But with some analysis of others newsservers, I could infer the IPv6 address, and bingo:

$ telnet -6 2a07:8085:119:fe::173 nntp

Trying 2a07:8085:119:fe::173...

Connected to 2a07:8085:119:fe::173.

Escape character is '^]'.

200 Welcome to UsenetPrime

quit

205 Goodbye

Connection closed by foreign host.

These newsservers are hosted by a wholesaler, and there is logic between IPv4 and IPv6 address:

185.151.15.X --- 2a07:8085:119:fe::X

with X written the same. Which means on the left decimal, and hexadecimal on the right. Just ignore that.

See below how I did it.

Ugly logging of "host <newsserver>" commands:

eu.newsdemon.com.txt-eu.newsdemon.com is an alias for nd-eu.tlsusenet.com.

eu.newsdemon.com.txt:nd-eu.tlsusenet.com has address 185.151.15.176

eu.newsdemon.com.txt:nd-eu.tlsusenet.com has address 185.151.15.186

eu.newsdemon.com.txt-nd-eu.tlsusenet.com has IPv6 address 2a07:8085:119:fe::176

eu.newsdemon.com.txt-nd-eu.tlsusenet.com has IPv6 address 2a07:8085:119:fe::186

eu-tst.newsgroupdirect.com.txt:eu-tst.newsgroupdirect.com has address 185.151.15.171

eu-tst.newsgroupdirect.com.txt:eu-tst.newsgroupdirect.com has address 185.151.15.181

eu-tst.newsgroupdirect.com.txt-eu-tst.newsgroupdirect.com has IPv6 address 2a07:8085:119:fe::181

news-eu.usenetexpress.com.txt:news-eu.usenetexpress.com has address 185.151.15.180

news-eu.usenetexpress.com.txt:news-eu.usenetexpress.com has address 185.151.15.170

news-eu.usenetexpress.com.txt-news-eu.usenetexpress.com has IPv6 address 2a07:8085:119:fe::180

news-eu.usenetexpress.com.txt-news-eu.usenetexpress.com has IPv6 address 2a07:8085:119:fe::170

Manual check that telnet works:

$ telnet -6 2a07:8085:119:fe::180 nntp

Trying 2a07:8085:119:fe::180...

Connected to 2a07:8085:119:fe::180.

Escape character is '^]'.

200 Welcome to UsenetExpress (fe02)

quit

205 Goodbye

Connection closed by foreign host.

Good.

Now the IPv4-only newsserver of which we want to infer the IPv6 address:

$ host eu.usenetprime.com

eu.usenetprime.com is an alias for usenetprime-eu.tlsusenet.com.

usenetprime-eu.tlsusenet.com has address 185.151.15.173

... ending in "117", so let's try 2a07:8085:119:fe::173

$ telnet -6 2a07:8085:119:fe::173 nntp

Trying 2a07:8085:119:fe::173...

Connected to 2a07:8085:119:fe::173.

Escape character is '^]'.

200 Welcome to UsenetPrime

quit

205 Goodbye

Connection closed by foreign host.

Bingo!

Easy, bare IPv6 test without DNS: ping 2600::

If you want to test IPv6, without DNS involved, that's easy: ping to 2600::

Fun fact: 2600:: is owned by telco Sprint, and "2600 hertz (2600 Hz) is a frequency in hertz (cycles per second) that was used in telecommunication signaling in mid-20th century long-distance telephone networks using carrier systems". Coincidence ... ?

Linux:

$ ping -c5 2600::

PING 2600::(2600::) 56 data bytes

64 bytes from 2600::: icmp_seq=1 ttl=53 time=13.3 ms

64 bytes from 2600::: icmp_seq=2 ttl=53 time=14.3 ms

64 bytes from 2600::: icmp_seq=3 ttl=53 time=14.4 ms

64 bytes from 2600::: icmp_seq=4 ttl=53 time=14.4 ms

64 bytes from 2600::: icmp_seq=5 ttl=53 time=15.0 ms

--- 2600:: ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4008ms

rtt min/avg/max/mdev = 13.295/14.281/15.014/0.555 ms

Windows:

PS C:\> ping 2600::

Pinging 2600:: with 32 bytes of data:

Reply from 2600::: time=14ms

Reply from 2600::: time=14ms

Reply from 2600::: time=15ms

Reply from 2600::: time=16ms

Ping statistics for 2600:::

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 14ms, Maximum = 16ms, Average = 14ms

PS C:\>

IPv6 inside WSL2 on Windows

 IPv6 inside WSL2 on Windows

If your Windows has IPv6, by default the WSL (Windows Subsystem for Linux) has no IPv6.

It's easy to solve this (if you use WSL2): in your Windows home directory, create a file .wslconfig to contain this:

[wsl2]

networkingMode=mirrored

You can do this from inside WSL with nano, as long as you make sure it's inside your Windows home directory (so /mnt/c/Users/<windows-user-name/)

If you use notepad from Windows, make sure the .wslconfig has no extension.

Then reboot Windows, start wsl, and "ip address show" should show your IPv6 inside WSL.

Check WSL version

To check that you have WSL2: from Windows, type "wsl.exe -l -v"

PS C:\> wsl -l -v

  NAME      STATE           VERSION

* Ubuntu    Running         2

IPv6 inside docker container

By default, a docker container is behind NAT, and thus has no IPv6.

If the host has IPV6, and you want IPv6 inside the docker docker container, in the container startup, use

--network host

so for example:

docker run -it --network host ubuntu:latest /bin/bash

... and then the docker container has the same IP addresses as the host, thus also IPv6.

For fun: disable IPv4 on Ubuntu and go IPv6-only

People often confuse "IPv6" with "IPv6-only". And then state wrong statements. Pity.

But, hey, Let's try what you happens when you go IPV6-only. So let's turn off IPv4.

On Ubuntu, you can do it like this:

sudo nm-connection-editor

In there, go to your active Wifi network, then go to the tab IPv4 Settings. At Method, select "Disabled".  Click Save.

To activate it, disable Wifi, and enable Wifi. And ... bingo ... IPv6-only!

Results:

Ubuntu works

Google, Microsoft and Facebook work

x.com results in a webpage with an error

A lot of Netherlands government sites work

KLM works, Transavia not

Smaller sites don't work

 Measure IPv6 versus IPv4 traffic on Windows

On Windows, you can see the amount of IPv6 packets:

PS C:\> netsh interface ipv6 show ipstats | find /i """Receives"""

In Receives:                        3606021

... and IPv4 packets:

PS C:\> netsh interface ipv4 show ipstats | find /i """Receives"""

In Receives:                        71758

So, safely assuming IPv6 and IPv4 have about the same mean packet size, 98% of my traffic is IPv6 traffic.

Note: These are packets. To get an indication of the amount of bytes, multiply with something between 1200 and 1500 (= bytes per packet). The above 3606021 IPv6 packets means about 4.3 GB in bytes IPv6 traffic.

let Apache logging show source port for NAT444 forensic logging

With NAT444 / CGNAT, different users share one IPv4 address. So only logging the IPv4 address is not enough to find the specific user; you need to log the source port too. I guess legal intercept logging can then find the individual user.

So ... how do you let Apache webserver log the source IP address plus the source port? Answer: on Ubuntu, in the file /etc/apache2/apache2.conf, as root change the line

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

to

LogFormat "%h:%{remote}p %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

So instead of only the remote IP address %h , the IP address plus the source port :%{remote}p is logged.

Example result from /var/log/apache2/access.log

18.12.12.65:63022 - - [18/Jul/2022:18:16:10 +0200] "GET /dump/ HTTP/1.1" 200 1571 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"

The source port is 63022

Videoland en "Oeps, we konden de video niet afspelen. Het starten van de video is mislukt. Playservice error."

Op Videoland kreeg ik foutmelding "Oeps, we konden de video niet afspelen. Het starten van de video is mislukt. Playservice error.". 

Oorzaak gevonden: mijn IPv6-tunnel via Hurricane Electric. Na het uitschakelen van de IPv6-tunnel kon ik wel Videoland kijken.

Gokje: Videoland beschouwt the IPv6-tunnel als buiten-EU / buiten-Nederland, en weigert daarom met die cryptische melding om af te spelen. En nettere foutmelding (bijv: "u / uw IP-adres xyz komt van buiten de EU, daarom spelen we niet af") zou duidelijker zijn.

Oeps, we konden de video niet afspelen

Het starten van de video is mislukt.

Playservice error

Ah, de Videoland-app geeft een betere foutmelding als de IPv6-tunnel aanstaat: "Videoland is helaas niet beschikbaar in Verenigde Staten" 

PCExtreme with "IPv6-only" VPS ... certain IPv4 traffic is working, from behind NAT

 

PCExtreme offers "Standard Server 1GB IPv6 only" for only €1 ex VAT per month. See https://www.pcextreme.com/cloud-servers/standard

I wanted to try that out, because: how does IPv6-only work in practice? Is that working in 2022?

So I bought a VPS, and now I'm a bit disappointed: the VPS does have IPv4 after all. It's behind NAT. Just like a device on a home LAN with an ISP connection.

However, some of my IPv4 traffic failed, like git connections to special git ports (no problem via https). So I did some research by trying to connect to outside ports

Some checks: HTTP and HTTPS are both allowed:

port 80 is allowed

port 443 is allowed

SMTP Port 25 is of course not possible:

port 25 not reached

Other ports ... to find out.

Suddenly FD...-addresses, aka Unique Local IPv6 Unicast Addresses

Suddenly I saw IPv6 addresses starting with FD in my ifconfig.

On Linux 3.13:

          inet6 addr: fdd6:5a2d:3f20:0:213:77ff:fefa:63e3/64 Scope:Global
          inet6 addr: fdd6:5a2d:3f20:0:6001:f53f:1e8:3850/64 Scope:Global

and on Linux 4.14:

        inet6 fdd6:5a2d:3f20:0:ce90:a2cc:655b:416e  prefixlen 64  scopeid 0x0


It appears these are "Unique Local IPv6 Unicast Addresses", defined in RFC4193. They are world wide unique (well, at least: very probably unique), and to be used within a site.

At first I thought this was a new Linux setting, but these addresses also showed up on my old Ubuntu 14.04.
So ... what is going on? Ah, it's my new Fiber modem/router Genexis Platinum that is providing these addresses.

My use so far: you can use the FD address without specifying the interface. So handier than the FE80 addresses.

I checked a Windows 10 machine, but Windows 10 did not show these addresses. Maybe a Windows policy?

Update (2018-11-11):
Both Android and MacOSX show the FD... addresses too.

KPN IPv6 statistics shows impressive growth

The KPN IPv6 statistics for the last four months:

• 2016-08: 6.8% IPv6 
• 2016-12: 14.8% IPv6

So + 8% in four months time, or + 2% per month. Well done, KPN!

That could mean KPN could be at 14% + 12*2% = 38% IPv6 traffic at the end of 2017. We'll see in one year time.

Source of KPN graph: http://www.worldipv6launch.org/apps/ipv6week/measurement/images/graphs/KPN.png

FWIW: in the last 8 months the other Netherlands ISP Ziggo has only gone down. See here

Netherlands IPv6 - KPN versus Ziggo

Based on the measurements from Worldipv6launch you can see the status of IPv6 in the Netherlands of the two biggest ISPs KPN and Ziggo (October 2016):

Hacked together in one overview with KPN in orange and Ziggo in red:

So:

• KPN is at 9% IPv6 traffic, with a nice rise in August and September 2016: +3% in two months.
• Ziggo is at 8% IPv6 traffic, and ... going down. Ziggo's IPv6 rollout looked very promising in Q1-2016 going from about 1% to almost 9%, but since then it's declining. So that looks like Ziggo has stopped deploying IPv6 to more customers. EDIT: or Ziggo is migrating users from the UPC-AS to Ziggo-AS without giving them IPv6?

I'm curious what the situation will be in a few months. To be continued ...

Netflix, IPv6 and "You seem to be using an unblocker or proxy."

Trying to watch a movie via Netflix, I get:

Whoops, something went wrong...
Streaming Error
You seem to be using an unblocker or proxy. Please turn off any of these services and try again. For more help, visit netflix.com/proxy. 

Error Code: M7111-1331-5059

The cause seems to be that I use an IPv6 tunnel (from Hurrican Electric). See http://seclists.org/nanog/2016/Jun/26 .
Great ... :-(

I don't understand why Netflix doesn't use IPv4 to detect the real origin of the customer, and then offers the 'correct'/meant offering via IPv6.


Anyway. Workarounds:

• Turn off IPv6 altogether
• Start Chrome without IPv6 ... option does not exist anymore: https://codereview.chromium.org/1149303005
• Block IPv6 address range of Netflix / AWS
• ...

A bit more info on German site Golem: http://www.golem.de/news/geoblocking-netflix-sperrt-nutzer-von-ipv6-tunneln-1606-121376.html

IPv6 traffic is the majority of my Internet traffic

Interesting: IPv6 traffic is the majority of my Internet traffic at home: 54%. And IPv4 is the minority.

Calculation (thanks to the MRTG monitoring of my router):

• IPv6 traffic has an average of 366.0 kb/s
• Total IPv4+IPv6 traffic has an average of 676.4 kb/s

So divide those numbers IPv6 by total traffic: 366/676 = 54% IPv6 traffic.

The explanation is quite easy: the well-known high-traffic sites (youtube, google, facebook) are IPv6-enabled.

PS: If "an average 676.4 kb/s" sounds low: that's almost 7GB per day. Rule of thumb: 100 kbps average is 1GB per day.

MRTG overview of my traffic: Green is total traffic, Blue is IPv6. Note there are only two IPv4-spikes.

Youtube: IPv6-only:

Nice tool to find info about IPv6 addresses

The site http://ipinfo.io/ offers info about IPv6 addressess:

$ curl ipinfo.io/2001:888:0:18::80
{
  "ip": "2001:888:0:18::80",
  "hostname": "www.xs4all.nl",
  "city": null,
  "country": "NL",
  "loc": "52.5000,5.7500",
  "org": "AS3265 Xs4all Internet BV"
}

If you only want the country:

$ curl ipinfo.io/2001:888:0:18::80/country
NL

To find your own country ;-)

$ python -c "import urllib2; print urllib2.urlopen(urllib2.Request('http://ipinfo.io/country', headers={'User-Agent' : 'curl'})).read() "

NL

Let's try HTTPS:

$ curl https://ipinfo.io/2001:888:0:18::80
SSL access is restricted to paid plans. See http://ipinfo.io/pricing for more details

... ah ... pity.

Ziggo at 8% IPv6 ... but has turned it off again?

That looks impressive: according to worldipv6launch Ziggo is at 8% IPv6 traffic (from 1% one month earlier):

But does this tweet between @iljitsch and @ziggowebcare mean Ziggo has turnef off IPv6?

IPv6 in NL per 9th December 2015

The IPv6 percentages of the Netherlands ISPs as of December 9, 2015:

XS4ALL 58.10%
KPN 5.52%
ZeelandNet 4.51%
Solcon 4.22%
Ziggo 0.32%
UNET 0.22%

Xs4all has risen 5% in only 2 months (http://ipv6-or-no-ipv6.blogspot.nl/2015/11/kpn-is-now-above-5-ipv6-deployment.html) ... impressive! Oh, wait ... Xs4all's measurement is going up and down:

Source: http://www.worldipv6launch.org/measurements/

KPN is now above 5% IPv6 deployment

KPN is now (October 2015) above 5% IPv6 deployment. Not much IPv6 development on Ziggo's side.


$ lynx --dump "http://www.worldipv6launch.org/apps/ipv6week/measurement/timeline-nets.html" | egrep -i -e "kpn|ziggo|xs4all|solcon|telfort|upc|zeeland|caiw" | awk '{ print $2 " " $NF }' | sort -u -k2,2 -r

XS4ALL 53.91%
KPN 5.13%
Solcon 3.94%
ZeelandNet 3.77%
Ziggo 0.24%

XS4ALL	53.91%
KPN	5.13%
Solcon	3.94%
ZeelandNet	3.77%
Ziggo	0.24%