Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a Centos 5.5 box. Something on the network is advertising IPv6 prefixes, and I want to know who.

One solution would be to install tcpdump or tshark and just look at the network traffic. I would prefer not to have to rewire the network or play rpm sherpa with scp.

Is there a utility, like route or ip that will show me the addresses of the routers sending the advertisements?

share|improve this question
    
out of curiosity why does it matter? –  Jim B Apr 22 '11 at 20:06
    
@JimB - because an IPv6 RA is basically like having a rogue DHCP server on the network. Very bad. –  Mark Henderson Apr 22 '11 at 21:14
    
Why are you avoiding tcpdump or TShark? If you don't know what's on your network then you don't really own it. –  Gerald Combs Apr 23 '11 at 0:08
add comment

2 Answers

The easiest way I know to do this is to just accept the route it's advertising. Once it's your inet6 router, it's easy.

$ ip -f inet6 route
2001:db8:dead:beef::/64 dev eth1  proto kernel  metric 256  expires 3523sec mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
default via fe80::21b:63ff:fe12:3456 dev eth1  proto kernel  metric 1024  expires 1722sec mtu 1500 advmss 1440 hoplimit 64

'default via' is my router here. Let's see who it actually is, by querying my ARP neighbors.

$ ip -f inet6 neigh
fe80::21b:63ff:fe12:3456 dev eth1 lladdr 00:1b:63:12:34:56 router STALE

$ ip -f inet neigh
10.0.0.1 dev eth1 lladdr 00:1b:63:12:34:56 STALE

So I've found an inet6 router with a MAC address 00:1b:63:12:34:56, and a v4 address 10.0.0.1. Hopefully that'd be enough clues to send you back into familiar territory.

share|improve this answer
add comment

radvdump (installed alongside radvd) will provide you what you want as well...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.