Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm configuring a DHCP scope for IPv6, however all my clients are getting 2 or more IPv6 addresses assigned to the interface.

I'm using fda8:6c3:ce53:a890:/64 as the prefix. The scope is on a machine running Windows Server 2008 R2 however I'm looking to roll it out on Server 2012 as well.

My clients are getting the following:

IPv6 Address. . . . . . . . . . . : 1024::1492:9288:7357:7d30(Preferred)
IPv6 Address. . . . . . . . . . . : fda8:6c3:ce53:a890::1(Preferred)
IPv6 Address. . . . . . . . . . . : fda8:6c3:ce53:a890:1492:9288:7357:7d30(Pr rred)
Link-local IPv6 Address . . . . . : fe80::1492:9288:7357:7d30%10(Preferred)

In this example there's no DHCP scope and the machine has a static IP of fda8:6c3:ce53:a890::1. With this in mind where are the 1024 address and the fda8:6c3:ce53:a890:1492:9288:7357:7d30 address coming from?

share|improve this question
    
I think this may have something to do with router advertisements as running the following command gets rid of the addresses: netsh int ipv6 set int (InterfaceID) routerdiscovery=disabled If anyone could provide technical reasoning for this that would be great. –  Steven Copestake Sep 28 '12 at 13:45
add comment

3 Answers 3

DHCPv6 does not need to be configured to issue IPv6 addresses for a network to function. Rather, each machine assigns itself a link local address (within [FE80::]/16), optionally based on its MAC, but possibly random. It then listens for router advertisements, and based on the advertised prefixes, it will assign itself one or more addresses using the same logic. Typically, a host will assign itself one or more random addresses which it will use to initiate connections, thus protecting its privacy (eg. not disclosing its MAC to all hosts on the internet, and not keeping a consistent network address); it will keep a consistent one as well, for other hosts to initiate connections to. Hosts, having discovered a prefix, will then query DHCPv6 to figure out stuff like their DNS servers.

That would be where the extra addresses are coming from (your use of disabling router discovery confirms this). For it to assign itself an address within [1024::]/64, some router on the network (running a router advertisement daemon) would have to be broadcasting that subnet; a network capture could tell you which. The packets will show up as ICMPv6 NDP router advertisements.

share|improve this answer
add comment

The extra addresses look to me like privacy addresses, which really should be disabled in any sort of business environment. Try disabling IPv6 privacy addresses:

netsh interface ipv6 set privacy state=disabled store=active
netsh interface ipv6 set privacy state=disabled store=persistent
netsh interface ipv6 set global randomizeidentifiers=disabled store=active
netsh interface ipv6 set global randomizeidentifiers=disabled store=persistent

This configuration change requires a restart.

Unfortunately, there are no Group Policy objects that I'm aware of to make this change, which is a serious oversight on Microsoft's part.

share|improve this answer
    
I'm not sure I agree privacy addresses ought to be disabled in a business environment. The moving target aspect of them still holds. On the LAN, you can simply use ARP if you need to know the MAC address of a host for some reason. –  Falcon Momot Oct 7 '12 at 4:11
    
It's not about finding the MAC address of a computer. It's about finding the computer given the IPv6 address. Privacy addresses make this sort of auditing and accountability pretty much impossible. –  Michael Hampton Oct 7 '12 at 13:04
add comment

1000::/4 is unassigned. I would imagine that it is discovering that address via ND. Fire up wireshark, set a capture filter of icmp6 and see if a local host is transmitting prefix advertisements.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.