IPv6 Address Conversion - How To Find Device On Router?

Dell / Inspiron one 2320
June 17, 2019 at 07:18:55
Specs: Windows 7, 3.3 GHz / 4001 MB
Hi!

I received a Google alert that an "Unrecognized device" tried to access one of my gmail accounts. The IP address given in the alert is in IPv6 format. e.g.:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

(That's not the address I was given, that's just an example of the format)

My router only shows IPv4 formats, so I don't know how to determine if the device is on my network or if it was external. The location is listed as my "town" and I recently installed a new security camera, so it may indeed be one of my devices, except that the timing doesn't line up. I installed the camera on Thursday and set up my account with the gmail address in question, but I didn't get the sign-in alert until Saturday morning.

I’ve tried a few online IP converters, but I can’t get any of them to produce an IPv4 address that I can compare to my connected devices. I know that not every IPv6 address has an IPv4 equivalent, so if that is the issue, how do I figure out if it’s one of my devices that caused the alert?

Thanks!

message edited by DerbyDad03


See More: IPv6 Address Conversion - How To Find Device On Router?

Reply ↓  Report •

#1
June 17, 2019 at 08:37:59
Did you try to check your gmail from an "other than usual" device or location? Such as using a PC at a hotel, PC at work, PC at a friend's house, etc?

Reply ↓  Report •

#2
June 17, 2019 at 08:51:53
You can't convert IPv6 to IPv4 at all. They're completely different forms of addressing and there is no IPv4 equivalent of an IPv6 address.

If it came from within your LAN, it would have appeared as an IPv4 address at the other end. Since the alert shows an IPv6 address it's a very safe bet it came from somewhere else.

It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.

***William Henley***


Reply ↓  Report •

#3
June 17, 2019 at 10:59:43
riider: Not that I recall

Curt R So this is incorrect? Note the word "all".

(From Stack Overflow)

While there are IPv6 equivalents for the IPv4 address range, you can't convert all IPv6 addresses to IPv4 - there are more IPv6 addresses than there are IPv4 addresses.


message edited by DerbyDad03


Reply ↓  Report •

Related Solutions

#4
June 17, 2019 at 11:41:23
Statement needs context, but I'd read it as the address space of IPv4 can fit in the address space of IPv6, but not the other way around. As in a space for 8 digits will comfortably fit any combination of 2 digits you want, but a space of 2 digits will not have enough room for 8.

Note that while you might connect to your ISP with IPv4, there's nothing stopping them from moving your traffic to an IPv6 network, complete with an IPv6 address. In which case, you need to take it up with your ISP.

How To Ask Questions The Smart Way

message edited by Razor2.3


Reply ↓  Report •

#5
June 17, 2019 at 13:02:33
I hear what you are saying, but I read this:

"you can't convert all IPv6 addresses to IPv4"

to mean that you can convert some, which is very different from riider's statement that:

"there is no IPv4 equivalent of an IPv6 address".

I'm not pushing back on either statement because I don't know which one is right. Just trying to learn...

This page, while listed as "experimental", appears to indicate an equivalency between the 2 addressing schemes, so I'm still confused:

"IPv6 / IPv4 Conversion and Analysis
This page will convert an IPv4 address into it's default 6-to-4 equivalent, or vice versa."

https://isc.sans.edu/tools/ipv6.html

message edited by DerbyDad03


Reply ↓  Report •

#6
June 17, 2019 at 18:13:34
As far as I understand from the link https://isc.sans.edu/tools/ipv6.html:

If translated with 6to4 the format starts with 2002:<IP4 addr in HEX>...
Do you have an IP6 internet connection from router to ISP?

If a TEREDO was used, the format starts with 2001:0000: or 2001::
Do you have a TEREDO active on one of your devices?


Reply ↓  Report •

#7
June 17, 2019 at 20:08:13
sluc:

re: "Do you have an IP6 internet connection from router to ISP?"

I have no idea. How would I determine that? I guess I could call them and ask.

re: "Do you have a TEREDO active on one of your devices?"

I have no idea. How would I determine that? My router only shows connections with IPv4 formatted addresses.

FWIW, the suspect IPv6 address reported by Google starts with 2604:6000

message edited by DerbyDad03


Reply ↓  Report •

#8
June 18, 2019 at 05:01:57
IPv4 = 32 bit address
IPv6 = 128 bit address

Neither one can be "converted" into the other, the math just doesn't work.

I don't know who wrote the article for 'stack overflow' and I have no idea of their level of knowledge with regard to IPv4 and 6 but even you can see the math doesn't work. How does one convert a 128 bit address into a 32 bit? It's like trying to fit a size 12 foot into a size 4 shoe.

If you break both types of addresses down to binary and have a look you'll get a better idea of why you can't convert 6 to 4 or vice versa.

I don't think you'll be able to find out the origin of that IPv6 address and as long as you're protected by a good, complex password, you don't really need to worry.

It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.

***William Henley***


Reply ↓  Report •

#9
June 18, 2019 at 11:44:21
re: I don't think you'll be able to find out the origin of that IPv6 address and as long as you're protected by a good, complex password, you don't really need to worry.

A good, complex password is certainly a great thing to have, unless someone else knows it. My passwords always show as Very Strong and I have never shared a password with anyone. However, the alert from Google states:

"Sign-in Attempt Was Blocked

Someone just used your password to try to sign-in from a non-Google app. Google blocked them, but you should check what happened. Review your account activity to make sure no one else has access"

When I check my activity via the button offered by Google, that's when I see the IPv6 address and my town listed as the location.

IOW, the strength of the password doesn't mean much if someone else knows it. According to Google, it appears that the "very strong" password for that particular email account may have been compromised - unless I can figure out what "non-Google app" attempted to log in. It could actually have been me. That's why I was wondering if the new security camera could be the culprit. I did need to create an account at the vendor's site and I used that email address and password, so the timing matches.

I just found this on the vendor's website. Could it be connected to this issue? How can I check for the same behavior from my new camera?

https://forums.wyzecam.com/t/strang...

message edited by DerbyDad03


Reply ↓  Report •

#10
June 18, 2019 at 12:29:53
That's just weird.

However, I can't see a camera attempting to login to email. That would require entering a username and password which obviously requires some form of human intervention so no, I don't believe it was your camera(s).

However, having said that, I did a bit of research on the domain names listed on your last link I found this:

https://krebsonsecurity.com/tag/iot...

If you're concerned about someone else knowing your password, and it looks like that may very well be the case, change it quickly!

It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.

***William Henley***


Reply ↓  Report •

#11
June 18, 2019 at 23:49:50
Curt R wrote:

> I can't see a camera attempting to login to email.

I can. Since it is a security camera, it might have software that reports
events to the user at a remote location, such as the user's phone. There
is an advertisement currently running on TV in which a character named
Jeff gets a video call on his smartphone showing him that Mayhem is at
his front door, and a moment later later Mayhem breaks into and steals
Jeff's car, because that's his job.

I like Mayhem.

Prolly won't buy insurance from him, though.

-- Jeff, in Minneapolis


Reply ↓  Report •

#12
June 19, 2019 at 18:50:23
Are you running Windows?

Go to a CMD prompt and type IPCONFIG /ALL

It'll show your IP addresses.


Reply ↓  Report •

#13
June 20, 2019 at 04:16:12
Jeff:

The camera does indeed report motion events to my cell phone, but it does it through the app's notification feature, not through email.

I have another camera that sends me email notifications, but it's sending an email, not logging into my email account.

The commercial you mention doesn't appear to have anything to do with logging into the owner's email account. The device placed a video call. Two very different things.

How To Post Data or Code ---> Click Here Before Posting Data or VBA Code


Reply ↓  Report •

#14
June 20, 2019 at 04:46:30
Curt:

re: I can't see a camera attempting to login to email.

Let's just make sure we're on the same page. The email from Google stated that a non-Google app attempted to log into my account, not that someone attempted to log into my email.

As I'm sure you know, a Google account sign-in gives the user access to more than just gmail.

How To Post Data or Code ---> Click Here Before Posting Data or VBA Code


Reply ↓  Report •

#15
June 20, 2019 at 06:29:33
DerbyDad03,

If one camera sends an email, then it must be sent via an email
account, which I expect you set up and is in your name. It might
even be the same Google account that receives the email.

If the other camera sends a message via its own app, it must send
it via some kind of account, which I expect you set up and is in your
name, and which could also be that same Google account. No?

-- Jeff, in Minneapolis


Reply ↓  Report •

#16
June 20, 2019 at 07:43:39
Jeff:

If one camera sends an email, then it must be sent via an email account, which I expect you set up and is in your name. It might even be the same Google account that receives the email.

That's not how I see it. Let's replace "camera" with "you". Let's say you are sitting at my house watching my driveway. When you first showed up I gave you my email address and told you to send me an email anytime something enters my driveway. You don't know anything about my Google account and you certainly don't know my Google account password. All you are doing is sending me an email from your email account, an account that I have nothing to do with.

Back to the camera: Yes, I set up an account at the vendor's website to set up cloud storage and to give them the email address to send the alerts to, but I didn't give them direct access to my email account or even enough information to access it.

In fact, with that camera, there is no relationship to Google because I used a non-gmail email account. However, that's not the point. Just because the "camera" (or a credit card or even you) can send me an email doesn't mean it has log in access to my email account.

re: "If the other camera sends a message via its own app, it must send it via some kind of account, which I expect you set up and is in your name, and which could also be that same Google account. No?"

No. In this case I was required set up an account with the vendor from within the app, but, again, it is not related to my Google account in any way. Different username, different password.

Bottom line, unless it's a Google device (which neither of these cameras are) there is no connection between it and my Google account. e.g. The Google Maps app on my phone knows about my Google account and is synched across multiple devices. On the other hand, the Hiking app I have required me to set up an "account" if I want them to email my stats, but that "account" is with them, and has nothing to do with Google. All that they have is an email address.

So, if it was the new camera that attempted to log into my Google account, it did it by obtaining the userid and password in some nefarious way.

message edited by DerbyDad03


Reply ↓  Report •

#17
June 20, 2019 at 18:36:38
Do you have any apps and sign-in(s) linked to your google account?
Google account > security > "Third-party apps with account access"

Reply ↓  Report •

Ask Question