On 2023-05-09 08:30, Per Jessen wrote:
Carlos E. R. wrote:
On 2023-05-08 23:28, Per Jessen wrote:
Carlos E. R. wrote:
I have started Ethereal, and run it for a minute or two, till I noticed the file /run/wicked/leaseinfo.eth0.auto.ipv6 changing.
There are no dhcpv6 packets.
Then I did a filter on IPv6 packets. There aren't many. Most are ICMP. I'll mail that direct to you if you want to have a look.
Here goes.
Did you read it yourself? I don't really read Ethereal, but even then I can still see an RA being sent every minute.
Problem identified.
Yes, I did read it myself.
I grep for the word "RA" and don't find it. You are assuming I know how to read ethereal output.
As you were using the tool, yes, I did think you had some familiarity with it. (I don't use it).
I have some familiarity with it, none with tcpdump. I understand some of the conversations, but not these. You instantly noticed these RA. If you'd like me to repeat the capture with tcpdump, I need to know the exact concoction.
No Time source dest proto length Info 19 21:23:30.009606005 fe80::ceed:dcff:fe05:80d4 ff02::1 ICMPv6 206 Router Advertisement from cc:ed:dc:05:80:d4 20 21:23:30.112980336 fe80::5a5f:fa3f:829f:ced2 ff02::16 ICMPv6 190 Multicast Listener Report Message v2
I assume that "destination ff02::1" is the router.
ff02::1 is a multicast address meaning "All Nodes". Fyi, ff00::/8 are all multicast addresses. The Ethereal output even explains it in plain text "Router Advertisement from cc:ed:dc:05:80:d4". I think I remember cc:ed:dc:05:80:d4 being your router. (cc:ed:dc = Mitrastar).
Ok, so the address is not an address, but it signals what it is.
So, it is your router informing everyone on the network about the router address. iow, a Router Advertisement.
I can not read what that packet capture means.
Nor can I :-) I see your router sending very frequent RAs. I have no idea what those "Multicast Listener Report" are for, but ff02::16 is for "all MLDv2 capable routers".
Ok, but then those two packages are not dhcp informing that the DNS has changed? Or are they?
Ok, can I tell the ISP / Beta people anything? This moment I don't know what to tell them. Or why bother.
Given how responsive they are, it might not be worth it, but you could ask why your router is sending an RA every 10seconds.
Normally, an RA is sent in response to a router solicitation (ff02::2) or at regular intervals. The default for radvd is every 200seconds, for instance.
However - I don't think an RA should cause your /etc/resolv.conf to be updated, unless the DNS also changes.
No, the address doesn't change. So, it is normal for a router to send RA every 200 seconds? Then it is not the router fault (yet), there is something else. Maybe Linux overreacting. Shouldn't Linux see that the address is the same, and do nothing? My ISP people are weird. They did something to my router, so that the firewall is now working. No idea if firmware update or configuration change, but they did something. And they never said a word. Wait, I just looked and there was a post yesterday: "we have reiterated this case." Dunno what it means, don't ask the translator. My guess, there is someone tending to the forum and sending information to the technicians, but getting no answer from them; nevertheless, the technicians do things. So the forum guy can't say anything because he knows nothing, only that he forwarded the information. -- Cheers / Saludos, Carlos E. R. (from 15.4 x86_64 at Telcontar)