Bad news first, it's still going on.
--On Tuesday, August 28, 2001 03:58:45 PM +0200 Jeroen Massar
<[EMAIL PROTECTED]> wrote:
> Peter Bieringer <[EMAIL PROTECTED]>:
>
>> I got a ICMPv6 ping "echo reply" flood from that host to my tunnel:
>>
>> Who the hell is using an IPv6 address out of my space as source
> address?
>> Looks like IPv6 gateways need anti spoofing filters!
> Ofcourse it needs it
>> 15:10:17.567312 128.176.191.66 > 195.226.187.50:
>> 2001:230:201:1:203:31ff:fe4b:4000 > 3ffe:400:100:f101::40: icmp6:
>> echo reply (encap)
> from inet -> you
Yes, but was not requested...
>> 15:10:17.567669 195.226.187.50 > 128.176.191.66:
>> 2001:230:201:1:203:31ff:fe4b:4000 > 3ffe:400:100:f101::40: icmp6:
>> echo reply (encap)
> from you -> inet.... which would mean that the ::40 is on the
> outside of your tunnel I presume... :)
Yes, subnet routing was down at this moment. Currently I've added
3ffe:400:100:f101::40/128 on my tunnel interface, so the packets not
further routed.
> And where are the echo requests? :)
That's my question! Someone is using an address of my range as source
address and run a ping6 to 2001:230:201:1:203:31ff:fe4b:4000
Due the lack of anti spoofing filters, this echo-request is routed to
given destination, which sends an echo-reply back to the sender's
address. Unfortunately mine...
> traceroute6 to 2001:230:201:1:203:31ff:fe4b:4000
> (2001:230:201:1:203:31ff:fe4b:4000) from
> 2001:6e0::250:4ff:fe4a:7708, 30 hops max, 16 byte packets
> 1 Amsterdam.core.ipv6.intouch.net (2001:6e0::2) 1.157 ms 1.237
> ms 0.875 ms
> 2 2001:200:0:4402::2 (2001:200:0:4402::2) 79.461 ms 78.731 ms
> 79.332 ms
> 3 3ffe:2e00:e:fffa::1 (3ffe:2e00:e:fffa::1) 529.963 ms 931.205
> ms 858.571 ms
> 4 2001:230:e:a::2 (2001:230:e:a::2) 663.898 ms * 511.524 ms
>
> hmmm
> changed: [EMAIL PROTECTED] 19980723
Contacted, but perhaps already sleeping.
Ping6 starts on early afternoon MEST...
Looks like I should replace all addresses in my sample config files
to "::1" :-(((
Peter
---------------------------------------------------------------------
The IPv6 Users Mailing List
Unsubscribe by sending "unsubscribe users" to [EMAIL PROTECTED]
