On 09.05.2023 16:01, Carlos E. R. wrote:
El 2023-05-09 a las 15:46 +0300, Andrei Borzenkov escribió:
On 09.05.2023 15:12, Per Jessen wrote:
You could try running a tcpdump :
tcpdump -s0 -wcapturefile -n -i interface icmp6
tshark -i wlp2s0 -Y icmpv6.type==134 -V icmp6
will dump full content of RA and RA only in readable form suitable for posting :)
Thanks.
Telcontar:~ # tshark -i eth0 -Y icmpv6.type==134 -V icmp6 > tshark_capture Running as user "root" and group "root". This could be dangerous. Capturing on 'eth0' ** (tshark:25609) 14:57:14.589158 [Main MESSAGE] -- Capture started. ** (tshark:25609) 14:57:14.589229 [Main MESSAGE] -- File: "/tmp/wireshark_eth07WWD41.pcapng" 3 ^C Telcontar:~ # l /tmp/wireshark_eth07WWD41.pcapng ls: cannot access '/tmp/wireshark_eth07WWD41.pcapng': No such file or directory Telcontar:~ # susepaste -n "Carlos E R" -t "capture tshark" -e 40320 tshark_capture Pasted as: https://susepaste.org/35e4671eb5dc https://paste.opensuse.org/35e4671eb5dc Link is also in your clipboard. Telcontar:~ #
RA are broadcast every 5 seconds. It is indeed too aggressive but it still is compliant with standard (which sets 3 seconds as minimal interval between unsolicited RA). So router still behaves correctly. Leasinfo timestamp matches RA. Indeed, wicked stores leasinfo every time it changes and it also calls netconfig every time lease changed. But - netconfig checks whether information was changed and only rewrites resolv.conf if there was any change. Three consecutive RA all have the same content. So it does not explain why resolv.conf is considered to be changed so often. You posted some log lines in one of the first messages and looking at them the list of DNS servers differs between each two consecutive logs from dnsmasq. To confirm it you may edit /etc/netconfig.d/dns-resolver to store each version of resolv.conf with timestamp and compare them. But RA frequency alone does not seem to be a root cause here.