[josteink]

> That would be really easy to block -- if we were on IPv6.

Make that: If the service being attacked was on IPv6-only, and the attacker had no way to fall back to IPv4.

As long as we are dual-stack and IPv6 is optional, no attacker is going to be stupid enough to select the stack which has the highest probability of being defeated. Don't be naive.

[div72]

It'd be far more acceptable to block the CG-NAT IPv4 addresses if you knew that the other non-compromised hosts could utilize their own IPv6 addresses to connect to your service.