If someone is detecting which IPv6 addresses are in use in your range from NTP requests, that implies they are all talking to the external NTP servers directly.<p>Surely if all your internal hosts are talking directly to the external NTP servers you are doing it wrong? My gateway box sets itself by pool.ntp.org and the internal ones set themselves by it. I thought that was how you <i>should</i> do things (even if it isn&#x27;t a rule, it is only polite to try not overuse a public resource).<p><i>&gt; These addresses are 128 bits in length</i><p>Only 64 are relevant here: once you make outgoing connections from any address a scanner knows there is at least one active host in that &#x2F;64 and there may be more. Though of course a 64 bit address space is still impractical to scan.