How to Identify Traffic
-
Can someone who knows networking tell me what this is?
Jul 20 21:38:28 WAN [fe80::2fc:8dff:fe24:8b32] [ff02::1] ICMPv6
I've switched off IPv6 as much as possible in pfSense, but before I turn hide this from my logs, I'd like to understand what it is.
Background:
I'm double NAT'd at this point (Hope to eventually remove, but later). My best guess is that fe80::2fc:8dff:fe24:8b32 is the IP address being assigned by the provider's router to the LAN port that pfSense connects to and uses as a gateway.ff02::1 is some sort of special address… I know :::1 is localhost, but the ff02 has got me stumped.
How can I positively ID these IPs?
Thanks
-
Those addresses are known as link local (fe80:: ) and multicast (ff02:: ) addresses, they are used for multicasting ICMP message for neighbour discovery, router solicitation and few other services that IPv6 can not work without. They are basically the IPv6 equivalent of IPv4 ARP but with quite a bit of additional functionality.
The ::1 addresses is localhost if it's unqualified ::1, the ff02::1 is not localhost.
-
where exactly are you seeing these in the logs? If on your lan side and you don't want to use ipv6, then I would disable your stuff on your lan doing ipv6 stuff - windows machines are going to be chatty kathys for ipv6 if you don't fix their nonsense out of the box with 3 different kinds of transition methods, etc. teredo, 6to4 and isatap plus the dual stack setup, etc.
-
Hi johnpoz… It's coming from the WAN side... likely from the cable company supplied equipment.
Currently I have two separate networks connected to the switch on the cable modem/NAT router.
Once I get pfSense box figured out and I can take it live, I'm going to see if I can turn the NAT off.
However that may make things even worse. I do have an IPv6 address and the line supports IPv6,
I'm just not ready to cope with it!Unchecked the boxes that allow passing IPv6, and blocked port 3544, and according to the leak
tests I am not passing any IPv6.Created an EasyRule in the web interface, but for some reason I still see it in the log.
WAN Firewall Rules
X 0/86 KiB * Reserved Not assigned by IANA * * * * * Block bogon networks
X 0/0 B IPv6 * EasyRuleBlockHostsWAN * * * * none Easy Rule: Blocked from Firewall Log ViewI turned on Rule Descriptions and I get Block all IPv6 (1000000003) - Does that provide information that is useful in this context.
For now I'd like to cut the log clutter… any ideas?
