Abstract: In IPv6 network environment, the scanning strategy of Internet worm was analyzed. A new type of worm,DNSWorm-V6 was built.The worm applies two different layers scanning strategy. It means that the worm applies subnet scanning strategy in local subnet and applies DNS scanning strategy in inter-subnet. Based on the two layers scanning strategy, a Two-Level worm propagation model, TLM was presented. I}he results of simulation experiment show that DNSWorm-V6 is a worm that can propagate fastly in the large-scale in IPv6 network, at the same time we can prediet the threat probably posed by the new worm in IPv6 network.

Key words: IPv6,Internet wom,DNS, Worm scanning strategy, Worm propagation model