I am using a Centos 5.5 box. Something on the network is advertising IPv6 prefixes, and I want to know who.

One solution would be to install tcpdump or tshark and just look at the network traffic. I would prefer not to have to rewire the network or play rpm sherpa with scp.

Is there a utility, like route or ip that will show me the addresses of the routers sending the advertisements?

  • out of curiosity why does it matter?
    – Jim B
    Commented Apr 22, 2011 at 20:06
  • @JimB - because an IPv6 RA is basically like having a rogue DHCP server on the network. Very bad. Commented Apr 22, 2011 at 21:14
  • 1
    Why are you avoiding tcpdump or TShark? If you don't know what's on your network then you don't really own it. Commented Apr 23, 2011 at 0:08

3 Answers 3


The easiest way I know to do this is to just accept the route it's advertising. Once it's your inet6 router, it's easy.

$ ip -f inet6 route
2001:db8:dead:beef::/64 dev eth1  proto kernel  metric 256  expires 3523sec mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
default via fe80::21b:63ff:fe12:3456 dev eth1  proto kernel  metric 1024  expires 1722sec mtu 1500 advmss 1440 hoplimit 64

'default via' is my router here. Let's see who it actually is, by querying my ARP neighbors.

$ ip -f inet6 neigh
fe80::21b:63ff:fe12:3456 dev eth1 lladdr 00:1b:63:12:34:56 router STALE

$ ip -f inet neigh dev eth1 lladdr 00:1b:63:12:34:56 STALE

So I've found an inet6 router with a MAC address 00:1b:63:12:34:56, and a v4 address Hopefully that'd be enough clues to send you back into familiar territory.


radvdump (installed alongside radvd) will provide you what you want as well...


The rdisc6 utility, included in most Linux distributions, does what you want.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .