I am using a Centos 5.5 box. Something on the network is advertising IPv6 prefixes, and I want to know who.

One solution would be to install tcpdump or tshark and just look at the network traffic. I would prefer not to have to rewire the network or play rpm sherpa with scp.

Is there a utility, like route or ip that will show me the addresses of the routers sending the advertisements?

  • out of curiosity why does it matter? – Jim B Apr 22 '11 at 20:06
  • @JimB - because an IPv6 RA is basically like having a rogue DHCP server on the network. Very bad. – Mark Henderson Apr 22 '11 at 21:14
  • 1
    Why are you avoiding tcpdump or TShark? If you don't know what's on your network then you don't really own it. – Gerald Combs Apr 23 '11 at 0:08

The easiest way I know to do this is to just accept the route it's advertising. Once it's your inet6 router, it's easy.

$ ip -f inet6 route
2001:db8:dead:beef::/64 dev eth1  proto kernel  metric 256  expires 3523sec mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
default via fe80::21b:63ff:fe12:3456 dev eth1  proto kernel  metric 1024  expires 1722sec mtu 1500 advmss 1440 hoplimit 64

'default via' is my router here. Let's see who it actually is, by querying my ARP neighbors.

$ ip -f inet6 neigh
fe80::21b:63ff:fe12:3456 dev eth1 lladdr 00:1b:63:12:34:56 router STALE

$ ip -f inet neigh dev eth1 lladdr 00:1b:63:12:34:56 STALE

So I've found an inet6 router with a MAC address 00:1b:63:12:34:56, and a v4 address Hopefully that'd be enough clues to send you back into familiar territory.

| improve this answer | |

radvdump (installed alongside radvd) will provide you what you want as well...

| improve this answer | |

The rdisc6 utility, included in most Linux distributions, does what you want.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.