[ipv6hackers] flood_router6 oddity

Fernando Gont fernando at gont.com.ar
Sat Oct 13 16:18:27 CEST 2012

Hi, Karl,

On 10/13/2012 03:04 AM, Karl Auer wrote:
> I've been playing about with Marc Heuse's stuff today.
> When I use flood_router6, a Windows VM fills up with SLAAC addresses
> (about 3400 at last count - it didn't seem to go much over that, but it
> may have slowed too far to process more). That's temp, random and LL
> addresses together. A Linux box on the same link ignored the advertised
> prefixes altogether. Why? When I used fake_router6 to fake a single
> prefix, the Linux box picked it up fine.

Two questions:

1) How did you run fake_router6?
2) Could you share the packet trace (decoded (in the body of an email),
or either post the URL of a pcap file) -- This is to answer these questions:
 a) is the tool advertising many prefixes in the same RA? Just sending
multiple RAs? Something else?
 b) What's the difference between the packets accepted by Linux, and the
ones ignored by Linux?


Best regards,
Fernando Gont
e-mail: fernando at gont.com.ar || fgont at si6networks.com
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

More information about the Ipv6hackers mailing list