Where is this IPv6 address coming from?

Question

TL;DR: Is there a command to display why each IPv6 address has been assigned to a given NIC? e.g. to show which router advertised that prefix.

Details

I have set up my network to use IPv6 addresses with the ULA prefix fdaa::/64. This works, and I have addresses like this:

$ ip addr show dev enp0s25
2: enp0s25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether b8:ae:ed:72:7d:5f brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.16/24 brd 192.168.0.255 scope global enp0s25
       valid_lft forever preferred_lft forever
    inet6 fdaa::6666:b3ff:0:d1a/128 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 2001:4479:7caa:9372:baae:edff:fe72:7d5f/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fdaa::baae:edff:fe72:7d5f/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::baae:edff:fe72:7d5f/64 scope link 
       valid_lft forever preferred_lft forever

Here I have a public 2001: address, a link-local fe80: address, but I have two addresses in my ULA fdaa: subnet.

I only want one address in this subnet, as I get errors by having two. For example I can't use this machine as a DNS server because it replies on the wrong IP:

host fdaa::ba27:ebff:feea:ad9d fdaa::baae:edff:fe72:7d5f
;; reply from unexpected source: fdaa::6666:b3ff:0:d1a#53, expected fdaa::baae:edff:fe72:7d5f#53
;; reply from unexpected source: fdaa::6666:b3ff:0:d1a#53, expected fdaa::baae:edff:fe72:7d5f#53
;; connection timed out; no servers could be reached

Deleting the IP and restarting the network interface restores it again, so something on my network appears to be advertising the prefix but I'm not sure how to figure out where it's coming from!

Is there some command that lists each IP address and explains how it was assigned, which router advertised it as an available prefix, and so on?

Answer 1

After some experimentation I found the following command can be used:

ip monitor

It will display a list of what's happening. Run it in one terminal, restart the network interface in another, and you'll see a line printed as each IP address is removed and then re-added.

It still doesn't explain exactly where the IP is coming from, but it did tell me it was an ra (Router Advertisement) which allowed me to go looking at my router config.

In my case I was advertising the same fdaa::/64 prefix as I had assigned as a static IP (assuming a static IP in this subnet would prevent a dynamic one from being assigned) but instead I ended up with both a static and a dynamic IP in the same subnet, which caused the problems. I'm still in two minds as to whether this is a bug.

After a lot of thought I changed the router to advertise a different prefix (actually a different subnet in the same ULA /48, so fdaa:0:0:1/64) because this way both subnets fit in the same ULA assignment but being different subnets they don't cause a machine to reply from the wrong IP when it has IPs belonging to both subnets.

Answer 2

No idea where the 2001 address is coming from. Something must be advertising it on your network. The easiest way to identify the rogue device is probably using Wireshark to look at the source MAC address.

Having multiple addresses is normal for IPv6. Your DNS server software should have replied from the same address as the one where it received the query on, but if it is behaving badly then you should be able to configure it to use the right address. When running servers I would recommend using static addresses for the server anyway. Relying on auto-configuration to give you the same address every time can be tricky. The algorithms change over time for privacy reasons, and I have seen cases where a NIC broke and people forgot that changing the NIC means that all your auto-configured addresses change as well. Fine for a client, not so nice for a server :)