ipv6 find all hosts in a prefix

Using the ping6 command you can find the link-local address of ipv6 hosts out of an interface using:

 ping6 -I eth0 ff02::1

This will ping everything in the subnet and so you can see what is out there. This can be viewed in ndp.

Is it possible to ping everything in a prefix so you can determine the global-scope unicast addresses of hosts? Note that this assumes that the ipv6 addresses are statically assigned rather than auto-configured from a rad - so we can't just work it out from a mac address.

In ipv4 terms, this would be functionally equivalent to ping -b 192.168.1.0/24

Lets say our prefix is 2001:470:1f09:131::/64, am looking for a way of doing something like:

ping6 -b 2001:470:1f09:131::/64

(I know that -b is buffer size, this for illustration only)

Note that this is OpenBSD which doesn't support an IP address in -I:

 -I interface
         Source packets with the given interface address.  This flag ap-
         plies if the ping destination is a multicast address, or link-lo-
         cal/site-local unicast address.

Putting together the bits from Celada's answer and Bort's comment gives the wanted result: You need both the -I and the -S option.

So assuming the network interface vr0 with IPv6 address 2001:1418:153:0:2e0:c5ff:fe3f:caef you'd need this command to do your broadcast ping:

ping6 -I vr0 -S 2001:1418:153:0:2e0:c5ff:fe3f:caef ff02::1

(Removing the -S results in echo replies from the link-local addresses only; removing the -I results in getting no answers at all anymore.)

The -I argument can be an IP address as well as an interface name. It looks like if you specify an interface name then it uses the link-local address on that interface as the source address. The trick to getting replies from hosts coming from their global scope addresses is to send the ping from your own global scope address:

ping6 -I 2001:db8:xxxx::your:own:ip:address ff02::1

Try:

ping6 ff02::1%yournic0

Where yournic0 is whatever the interface name facing the link in question.