search for: icmp6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08:09.icmp6 Security Advisory The FreeBSD Project Topic: Remote kernel panics on IPv6 connections Category: core Module: sys_netinet6 Announced: 2008-09-03 Credits: Tom Parker, Bj...

...libcom_err.a /usr/obj/usr/src/i386/usr/lib/libroken.a >> .depend ===> usr.bin/symorder rm -f .depend mkdep -f .depend -a /usr/src/usr.bin/symorder/symorder.c echo symorder: /usr/obj/usr/src/i386/usr/lib/libc.a >> .depend ===> usr.bin/systat make: don't know how to make icmp6.c. Stop *** Error code 2 Stop in /usr/src/usr.bin. *** Error code 1 Stop in /usr/src. *** Error code 1 Stop in /usr/src. *** Error code 1 Stop in /usr/src. root@jasmina> exit --- The last time I built was about 5 days ago, and it worked fine then. Now I wonder if what I'm seeing today...

...ridge card an now it works. But why is not both rules applied on outgoing traffic?  Thank you so much for your help to get this working :-) Best Regards, Håvard Rabbe root at JOTVPN:~# ip6tables --list-rules -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -o bridge -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP -A FORWARD -i bridge -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP On Feb 23, 2017, at 10:48 AM, Guus Sliepen <guus at tinc-vpn.org> wrote: On Wed, Feb 22, 2017 at 08:51:49PM +0000, Håvard Rabbe wrote: thank you for looking in to this. I haven't tried it bef...

...k you for looking in to this. I haven't tried it before now. I cant get it to work. after running the commands you suggest I get this when I run ip6tables --list-rules root at JOTVPN:~# ip6tables --list-rules -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -i vpn -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP -A FORWARD -o vpn -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP Do you have any other ideas? Thanks for your help! Best Regards, Håvard Rabbe On Aug 30, 2016, at 04:39 PM, Guus Sliepen <guus at tinc-vpn.org> wrote: On Sat, Aug 27, 2016 at 11:41:12PM +0000,...

https://bugzilla.mindrot.org/show_bug.cgi?id=1441 Summary: flow record for ICMP6 missing type and code values Classification: Unclassified Product: softflowd Version: -current Platform: amd64 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: softflowd AssignedTo: dj...

...t the server side): mauer:/usr/local/var/open3600-spool# tcpdump ip6 -i fvhglobalnet -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on fvhglobalnet, link-type EN10MB (Ethernet), capture size 96 bytes 18:55:07.318963 IP6 fe80::c446:8ff:fea2:724c > ff02::2: ICMP6, router solicitation, length 16 18:55:09.288642 IP6 fe80::c446:8ff:fea2:724c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 18:55:09.302624 IP6 2001:888:13b3::1.5353 > ff02::fb.5353: 0[|domain] 18:55:10.304354 IP6 2001:888:13b3::1.5353 > ff02::fb.5353: 0[...

...018 at 11:13:55PM +0100, Lars Kruse wrote: > I am a happy user of tinc in multiple environments. It is beautiful - thank you! > > Today I noticed that a network of around 20 nodes suffered from a flood of > packages like the following: > IP6 fe80::e4eb:74b6:57e0:c3e1 > ff02::2: ICMP6, router solicitation, length 8 [...] > Most of the tinc nodes use v1.0.31. Two use v1.0.24 and a single old one is > still at v1.0.19. > (Debian stable, oldstable and oldoldstable) The issue looks like a routing loop. In fact, there was a bug in versions before 1.0.24 that might cause rou...

...virbr0 using tcpdump. The saved packets are attached in file virbr0.pcap to this email. In my understanding this confirms DHCP request of guest / domain: ld4004:~ # tcpdump -r /tmp/virbr0.pcap reading from file /tmp/virbr0.pcap, link-type EN10MB (Ethernet) 17:10:31.433263 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 17:10:31.434772 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 52:54:00:31:dd:59 (oui Unknown), length 300 17:10:31.435007 IP 192.168.100.1.bootps > 192.168.100.52.bootpc: BOOTP/DHCP, Reply, length 313 17:10:31....

...saved packets are attached in file virbr0.pcap to this email. > > In my understanding this confirms DHCP request of guest / domain: > ld4004:~ # tcpdump -r /tmp/virbr0.pcap > reading from file /tmp/virbr0.pcap, link-type EN10MB (Ethernet) > 17:10:31.433263 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), > length 28 > 17:10:31.434772 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from > 52:54:00:31:dd:59 (oui Unknown), length 300 > 17:10:31.435007 IP 192.168.100.1.bootps > 192.168.100.52.bootpc: BOOTP/DHCP, Reply,...

...outer "gw", the following can be observed: # tcpdump -q -n -i eth2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes 20:01:04.001463 IP6 fe80::21b:21ff:fe2b:e398 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has fd73:d95d:a475:1000::1, length 32 20:01:04.001751 IP6 fe80::21b:21ff:fe2b:e398 > ff02::1:ff00:17: ICMP6, neighbor solicitation, who has fd73:d95d:a475:c80::17, length 32 20:01:05.000566 IP6 fe80::21b:21ff:fe2b:e398 > ff02::1:ff00:1: ICMP6, neighbor solicita...

18. Juli 2017 16:45, "Michal Privoznik" <mprivozn@redhat.com> schrieb: > On 07/18/2017 04:31 PM, c.monty@web.de wrote: > >> Hello! >> >> I have upgraded all libvirt packages to version 3.5.0-655.1 and restarted host. > > That wasn't necessary. It's not Windows ;-) > >> This is the current default network config: >> ld4004:~

...5d:a475:ffff::1-fd73:d95d:a475:ffff::a # tcpdump -n -i eth1 ip6 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 20:42:23.210428 IP6 fd73:d95d:a475:ffff::a > fd73:d95d:a475:1000::1: ICMP6, echo request, seq 1, length 64 20:42:23.210704 IP6 fd73:d95d:a475:1000::1 > fd73:d95d:a475:ffff::a: ICMP6, echo reply, seq 1, length 64 20:42:24.209394 IP6 fd73:d95d:a475:ffff::a > fd73:d95d:a475:1000::1: ICMP6, echo request, seq 2, length 64 20:42:24.209669 IP6 fd73:d95d:a475:10...

Hello, I am a happy user of tinc in multiple environments. It is beautiful - thank you! Today I noticed that a network of around 20 nodes suffered from a flood of packages like the following: IP6 fe80::e4eb:74b6:57e0:c3e1 > ff02::2: ICMP6, router solicitation, length 8 For the first ten hours these nodes (even the usually completely idle ones) have seen incoming traffic of around 1 MBit/s in the tinc interface (and approximately the double bandwidth on the interface that carries the tinc traffic). Then the traffic on the tinc inter...

...9;t tried it before now. I cant get it to work. > > after running the commands you suggest I get this when I run ip6tables --list-rules > > root at JOTVPN:~# ip6tables --list-rules > -P INPUT ACCEPT > -P FORWARD ACCEPT > -P OUTPUT ACCEPT > -A FORWARD -i vpn -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP > -A FORWARD -o vpn -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP > > Do you have any other ideas? It could be I have the direction of the ICMP messages wrong. Try adding: ip6tables -A FORWARD -o vpn -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP ip6tables -...

...anslation) I get bad checksum. The next hop does not see the packet at all. I looked at nf_nat_proto_icmpv6.c for a bit but so far haven't found much. Kernel 4.9.168. e.g. on ingress: IP6 (hlim 61, next-header ICMPv6 (58) payload length: 80) 2a01:4f9:0:c001::a015 > 2a01:???:????:????::1: [icmp6 sum ok] ICMP6, time exceeded in-transit for fra16s12-in-x04.1e100.net on egress: IP6 (hlim 60, next-header ICMPv6 (58) payload length: 80) 2a01:4f9:0:c001::a015 > fd01:???:????:????::2:1: [bad icmp6 cksum 0x735b -> 0x705b!] ICMP6, time exceeded in-transit for fra16s12-in-x04.1e100.net -- Y...

...pe"="v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=1|Profile=Domain|ICMP4=8:*|Name=@FirewallAPI.dll,-28544|Desc=@FirewallAPI.dll,-28547|EmbedCtxt @FirewallAPI.dll,-28502|" HKEY_LOCAL_MACHINE\System\ControlSet001\services\SharedAccess\Defaults\FirewallPolicy\FirewallRules "FPS-ICMP6-ERQ-In-NoScope"="v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=58|Profile=Domain|ICMP6=128:*|Name=@FirewallAPI.dll,-28545|Desc=@FirewallAPI.dll,-28547|EmbedCtxt @FirewallAPI.dll,-28502|" HKEY_LOCAL_MACHINE\System\ControlSet001\services\SharedAccess\Defaults\FirewallPolicy\FirewallR...

...> 2001:db8:1f1:f240::2.35241: Flags [P.], cksum 0x62d3 (incorrect -> 0x1c84), seq 15709:19993, ack 127, win 9, options [nop,nop,TS val 1771553020 ecr 1086205224], length 4284 23:59:00.672987 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 1240) 2001:db8:0:1f1::8 > 2a00:801:0:11::2: [icmp6 sum ok] ICMP6, packet too big, length 1240, mtu 1500 23:59:00.673161 IP6 (hlim 63, next-header TCP (6) payload length: 32) 2001:db8:1f1:f240::2.35241 > 2a00:801:0:11::2.80: Flags [.], cksum 0x24e4 (correct), ack 17137, win 716, options [nop,nop,TS val 1086205237 ecr 1771553020], length 0 23:59:0...

...> 2001:db8:1f1:f240::2.35241: Flags [P.], cksum 0x62d3 (incorrect -> 0x1c84), seq 15709:19993, ack 127, win 9, options [nop,nop,TS val 1771553020 ecr 1086205224], length 4284 23:59:00.672987 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 1240) 2001:db8:0:1f1::8 > 2a00:801:0:11::2: [icmp6 sum ok] ICMP6, packet too big, length 1240, mtu 1500 23:59:00.673161 IP6 (hlim 63, next-header TCP (6) payload length: 32) 2001:db8:1f1:f240::2.35241 > 2a00:801:0:11::2.80: Flags [.], cksum 0x24e4 (correct), ack 17137, win 716, options [nop,nop,TS val 1086205237 ecr 1771553020], length 0 23:59:0...

...ckets from host2 to host1 with ESP(encryption) header. It is shown in the following output: ########## tcpdump at host1 ################### mohan# tcpdump -i xl0 host fe80::2b0:d0ff:fe6f:dfa0 tcpdump: listening on xl0 10:08:43.844723 fe80::2b0:d0ff:fe6f:dfa0[host1] > ff02::1:ff48:7ce7[host2]: icmp6: neighbor sol: who has fe80::2b0:d0ff:fe48:7ce7 10:08:43.845127 fe80::2b0:d0ff:fe48:7ce7 > fe80::2b0:d0ff:fe6f:dfa0: ESP(spi=0x0000fead,seq=0xf) 10:08:44.844736 fe80::2b0:d0ff:fe6f:dfa0 > ff02::1:ff48:7ce7: icmp6: neighbor sol: who has fe80::2b0:d0ff:fe48:7ce7 10:08:44.845109 fe80::2b0:d0...

...ckets from host2 to host1 with ESP(encryption) header. It is shown in the following output: ########## tcpdump at host1 ################### mohan# tcpdump -i xl0 host fe80::2b0:d0ff:fe6f:dfa0 tcpdump: listening on xl0 10:08:43.844723 fe80::2b0:d0ff:fe6f:dfa0[host1] > ff02::1:ff48:7ce7[host2]: icmp6: neighbor sol: who has fe80::2b0:d0ff:fe48:7ce7 10:08:43.845127 fe80::2b0:d0ff:fe48:7ce7 > fe80::2b0:d0ff:fe6f:dfa0: ESP(spi=0x0000fead,seq=0xf) 10:08:44.844736 fe80::2b0:d0ff:fe6f:dfa0 > ff02::1:ff48:7ce7: icmp6: neighbor sol: who has fe80::2b0:d0ff:fe48:7ce7 10:08:44.845109 fe80::2b0:d0...