6

TL;DR: Is there a command to display why each IPv6 address has been assigned to a given NIC? e.g. to show which router advertised that prefix.

Details

I have set up my network to use IPv6 addresses with the ULA prefix fdaa::/64. This works, and I have addresses like this:

$ ip addr show dev enp0s25
2: enp0s25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether b8:ae:ed:72:7d:5f brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.16/24 brd 192.168.0.255 scope global enp0s25
       valid_lft forever preferred_lft forever
    inet6 fdaa::6666:b3ff:0:d1a/128 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 2001:4479:7caa:9372:baae:edff:fe72:7d5f/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fdaa::baae:edff:fe72:7d5f/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::baae:edff:fe72:7d5f/64 scope link 
       valid_lft forever preferred_lft forever

Here I have a public 2001: address, a link-local fe80: address, but I have two addresses in my ULA fdaa: subnet.

I only want one address in this subnet, as I get errors by having two. For example I can't use this machine as a DNS server because it replies on the wrong IP:

host fdaa::ba27:ebff:feea:ad9d fdaa::baae:edff:fe72:7d5f
;; reply from unexpected source: fdaa::6666:b3ff:0:d1a#53, expected fdaa::baae:edff:fe72:7d5f#53
;; reply from unexpected source: fdaa::6666:b3ff:0:d1a#53, expected fdaa::baae:edff:fe72:7d5f#53
;; connection timed out; no servers could be reached

Deleting the IP and restarting the network interface restores it again, so something on my network appears to be advertising the prefix but I'm not sure how to figure out where it's coming from!

Is there some command that lists each IP address and explains how it was assigned, which router advertised it as an available prefix, and so on?

3
  • And let's remember that your ULA prefix needs to be randomly generated, not manually chosen. Mar 20, 2017 at 8:28
  • On a real network yes, but when testing things across a handful of machines a short made up one saves a lot of typing :-)
    – Malvineous
    Mar 20, 2017 at 10:58
  • For those wondering: ULA = Unique Local Address. May 17, 2019 at 11:46

2 Answers 2

6

After some experimentation I found the following command can be used:

ip monitor

It will display a list of what's happening. Run it in one terminal, restart the network interface in another, and you'll see a line printed as each IP address is removed and then re-added.

It still doesn't explain exactly where the IP is coming from, but it did tell me it was an ra (Router Advertisement) which allowed me to go looking at my router config.

In my case I was advertising the same fdaa::/64 prefix as I had assigned as a static IP (assuming a static IP in this subnet would prevent a dynamic one from being assigned) but instead I ended up with both a static and a dynamic IP in the same subnet, which caused the problems. I'm still in two minds as to whether this is a bug.

After a lot of thought I changed the router to advertise a different prefix (actually a different subnet in the same ULA /48, so fdaa:0:0:1/64) because this way both subnets fit in the same ULA assignment but being different subnets they don't cause a machine to reply from the wrong IP when it has IPs belonging to both subnets.

1

No idea where the 2001 address is coming from. Something must be advertising it on your network. The easiest way to identify the rogue device is probably using Wireshark to look at the source MAC address.

Having multiple addresses is normal for IPv6. Your DNS server software should have replied from the same address as the one where it received the query on, but if it is behaving badly then you should be able to configure it to use the right address. When running servers I would recommend using static addresses for the server anyway. Relying on auto-configuration to give you the same address every time can be tricky. The algorithms change over time for privacy reasons, and I have seen cases where a NIC broke and people forgot that changing the NIC means that all your auto-configured addresses change as well. Fine for a client, not so nice for a server :)

3
  • The 2001 is coming from my router so that's not the problem, it's the two fdaa:: ones that are the issue. I did assign one of these as a static IP for precisely the reason you mention, but the issue is the second fdaa:: IP in the same subnet causing the DNS server to reply on the wrong IP. There's no config option to fix it because both IPs are in the same subnet, which is why it's picking the wrong address - technically either one can be used!
    – Malvineous
    Mar 20, 2017 at 11:01
  • Your DNS server software should have a configuration option to set the address used Mar 20, 2017 at 14:48
  • It might do, but what about the other software? With IPv4 I didn't have to tell any daemons which IP to use, so it seems wrong to me that I have to specifically list individual IPs in the config files for DNS, SMTP, IMAP, SSH, and all the other daemons in use. What happens with outgoing connections also? If I make an outgoing connection (from a non-server PC), what if the packets suddenly switch to originate from one of the competing IPs? Seems like a recipe for disaster!
    – Malvineous
    Mar 20, 2017 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.