• Node soliciting neighbour twice, results in duplicate IPv6 address

    From Philipp Kern@21:1/5 to martin f krafft on Sun Jan 3 11:20:02 2016
    Hi,

    On Sun, Jan 03, 2016 at 10:48:13AM +1300, martin f krafft wrote:
    Attached are the two packet dumps, and here's a diff between them,
    with timestamps and identical stuff stripped:

    -Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    +Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    […]
    -Ethernet II, Src: 28:d2:44:8c:05:bd, Dst: 33:33:ff:8c:05:bd
    - Destination: 33:33:ff:8c:05:bd
    - Address: 33:33:ff:8c:05:bd
    - .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
    - .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    +Ethernet II, Src: 28:d2:44:8c:05:bd, Dst: 28:d2:44:8c:05:bd
    + Destination: 28:d2:44:8c:05:bd
    + Address: 28:d2:44:8c:05:bd
    + .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    + .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    Correct me if I am wrong, but that second frame should not be sent,
    right? Why would the node send a solicitation to itself?

    wacky guess: This laptop does not have Intel AMT (sort of aka vPro)
    enabled, right? If so, try turning it off.

    What was actually solicited? 2001:4428:29c:0:2ad2:44ff:fe8c:5bd?
    Link-local?

    Kind regards
    Philipp Kern

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQEcBAEBCAAGBQJWiPOhAAoJEERuJUU10FbsNLkH/R+2RVVl00WhsrYHCfunpHV2 weUmzCqfpTwcDRKITQ5wgB3WE8iAWHxlt+sUtps/f8fvv+GXxWrOFXIJ6wJKdppd Vnot0eaJfmHth1b7kIyW+EETNUl10JVecX9BVlTaSLXZF6NzkzmS0WMut0iaHwNx cvxLDeHwa9+GSTwhSdgK8x2jRJA4s9J3AwfVfvXqGdjlOTcGHNAzrWWx5pPDtNh2 21vEHGoUT5jT7RywzCQehZvLcT52eMChr9pLGoZszK2OueJ5NoIQN2Ble5eqRva0 S6XqWpfL5Qlz2Wu4rMRyvr5fTMm9LmF7nzHQKc+i5OK28SBOqyrjYEEMW/bJJSM=
    =FM+l
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From martin f krafft@21:1/5 to All on Sat Jan 2 22:50:01 2016
    --d6Gm4EdcadzBjdND
    Content-Type: text/plain; charset=utf-8
    Content-Disposition: inline
    Content-Transfer-Encoding: quoted-printable

    Hi folks,

    Happy New Year to start with.

    My laptop is hooking up to a no-frills WLAN behind a Debian router
    advertising a prefix using radvd. I've used this laptop for years in
    similar situations, but this time I am seeing the kernel warn about
    duplicate IPv6 addresses being detected:

    IPv6: wifi: IPv6 duplicate address 2001:4428:29c:0:2ad2:44ff:fe8c:5bd detected!

    I've unplugged/disconnected all other devices and yet the problem
    persists. Hence I fired up tcpdump and captured the ICMPv6 packages.
    And curiously, the laptop is sending two solicitations, one to the
    multicast MAC address 33:33:ff:* and the other *to itself*!

    Attached are the two packet dumps, and here's a diff between them,
    with timestamps and identical stuff stripped:

    -Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    +Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    […]
    -Ethernet II, Src: 28:d2:44:8c:05:bd, Dst: 33:33:ff:8c:05:bd
    - Destination: 33:33:ff:8c:05:bd
    - Address: 33:33:ff:8c:05:bd
    - .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
    - .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    +Ethernet II, Src: 28:d2:44:8c:05:bd, Dst: 28:d2:44:8c:05:bd
    + Destination: 28:d2:44:8c:05:bd
    + Address: 28:d2:44:8c:05:bd
    + .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    + .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    Correct me if I am wrong, but that second frame should not be sent,
    right? Why would the node send a solicitation to itself?

    Unfortunately, I have no idea where this is coming from. I've
    disabled all bridges. This is Debian's 4.3.0-1-amd64 kernel
    (4.3.3-1).

    Do you have any clue what might be going on?

    --
    .''`. martin f. krafft <madduck@d.o> @martinkrafft
    : :' : proud Debian developer
    `. `'` http://people.debian.org/~madduck
    `- Debian - when you have better things to do than fixing systems

    "most people become bankrupt through having invested too heavily in
    the prose of life. to have ruined one's self over poetry is an
    honour."
    -- oscar wilde

    --d6Gm4EdcadzBjdND
    Content-Type: text/plain; charset=us-ascii
    Content-Disposition: attachment; filename="frame1.txt"

    Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    Interface id: 0 (wifi)
    Encapsulation type: Ethernet (1)
    Arrival Time: Jan 3, 2016 10:25:50.168744045 NZDT
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1451769950.168744045 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or fir