Seeing rogue RAs on the IETF network (ietf-portal)

[(none)]

en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether 00:26:bb:1a:77:2e 
	inet6 fe80::226:bbff:fe1a:772e%en1 prefixlen 64 scopeid 0x6 
	inet6 fec0::5:226:bbff:fe1a:772e prefixlen 64 autoconf 
	inet6 2002:8281:763a:5:226:bbff:fe1a:772e prefixlen 64 autoconf 
	inet6 2001:df8::112:226:bbff:fe1a:772e prefixlen 64 autoconf 
	inet 130.129.116.38 netmask 0xfffff800 broadcast 130.129.119.255
	media: <unknown subtype>
	status: active

[liuwu@…]

?

[ot@…]

To clarify: someone is advertising themselves as a default router on the IETF network. Who presumably isn't the real IPv6 router.
Typically this happens with Windows machines with Internet sharing and 6to4 enabled.

As these RAs are advertised with low preference it doesn't disturb the network too much. Apart from the fact that all traffic to other 6to4 sites are routes through someone else's laptop...

[xzhao@…]

Replying to xzhao@…:

we also have acl configured on switch to block RA broadcasting to whole network. yes, it may cause problems but impacts are limited to a certain level, that is probably the best we can do.

thanks,
Leon

[xzhao@…]

thanks for suggesting NDPmon, we will give it a try, hopefully soon.

thanks,
Leon