IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV)
-
Hello pfSense Community,
Thought I would check if anyone else has seen this before... my scenario/setup is as follows.
IPv4/IPv6 running both stacks, using DHCP and DHCPv6 on pfSense, with a separate pihole docker on my unRAID server running DNS serving both IPv4/IPv6.
I also run standard DNS on my pfsense for localhost and as a backup, but prefer the pihole management interface over DNSBL... not discounting all of the AMAZING work that has been put in to pfblockerNG, I run that for IPv4/IPv6 block lists, just not DNSBL anymore.
Anyway - everything works just fine and there are zero issues currently, I've had an amazing overall experience with pfsense and the many features.
The question: my NDP Table (IPv6 entries) is insane. I have hundreds and hundreds of entries for just one host... my Apple TV, but 1-2 entries (normal) for everything else. The Apple TV is performing DNS queries and such from each of the addresses (as I'm showing 300+ hosts in pihole... when I've got about 30 devices on my home network).
Apple TV's are a known pain in the butt when they go to sleep... they wreak havoc on my Meraki switches by transitioning to 100Mbps from 1Gbps and show CRC errors like there is a bad cable (this is a known issue and will likely never be fixed by Apple).
Thought I would check if anyone else has experienced this... I believe it's using SLAAC to get it's tons and tons of addresses as my DHCPv6 leases are minimal (I have both DHCPv6 and RA running).
Other than this (likely an Apple issue and mostly cosmetic) - everything is great.
Thanks for the support!
Best Regards,
dg6464
-
This is perfect example of when you just disable IPv6 for this network..
What resource is your appleTV accessing that would require IPv6? None - so if you don't like nonsense what its doing, just disable it..
Unless you want to dig into their code, and figure out why it's doing what its doing, you say its working and this is just cosmetic - so you either live with it... Or just turn it off, its not a required protocol to do anything.. Many ISPs don't even support IPv6..
If you want to play with it, sure - just put your appletv on a different network where IPv6 is not enabled so you don't have to deal with its nonsense..
I don't have IPv6 enabled on any of my iot networks. I have it specifically enabled on the networks that I want to play with it on.. My iot devices or roku's, etc.. have zero use or need for IPv6 - so it just not enabled on those networks. Most of these iot devices can barely do ipv4 correctly, you think they are going to get ipv6 right ;) heheh
-
@johnpoz you are correct - it’s largely cosmetic and not cause for alarm... just seemed like a weird behaviour that I thought I would share with the pfSense community as a potentially interested party and investigate if warranted (even if it’s just a verification the issue is with Apple and me going to them to open up a TVOS bug).
I’m not sure recommending IPv6 be turned off because of a client device bug is the way to go about this though (my traffic is about 50% IPv6 now), or swapping to its own network necessarily...
I believe we should probably all do our part to help move the internet towards IPv6 as the amount of people interested in putting in effort to use it is still somewhat minimal (ie: more people trying to use it and ISP’s natively enabling it... the more developers get feedback to help solve bugs and weird scenarios like this, even if it’s not a bug with pfSense and ends up being a bug request with Apple).
If we believe it’s 100% the Apple TV Device causing the issue and not some odd SLAAC response from pfSense causing it to give a brand new IPv6 due to an IPv6 extension that only Apple uses or something... I’m cool opening up a bug with Apple.
But I am open to verify the above... I’m just not experienced in where to look as to why the Apple TV is asking for so many brand new IP’s and not happy with the first one it gets.
But yeah, I get it... it may not be worth the time of the pfSense team replying and investigating... especially when IoT devices can barely get IPv4 right :). So I appreciate the feedback.
Thanks for your reply!
Best Regards,
dg6464
-
For what it’s worth... I was surprised in the amount of IPv6 traffic I had once I started running dual stack and started tracking DNS requests, without really trying to use IPv6, lol.
50% of my DNS requests AND traffic is now IPv6 and all major services seem to have opened the floodgates (Netflix, Facebook, Instagram, Xbox Live, iCloud... most popular websites).
I started noticing honestly when I realized my DNS blocklists weren’t properly implemented for on the IPv6 side... I was able to hit websites no problem for machines using a dual stack.
Anyway, let me know if we should just close the thread and I’ll open a case with Apple to let them know. Not really sure how to investigate what it’s actually doing by myself.
Best Regards,
dg6464
-
@johnpoz said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
This is perfect example of when you just disable IPv6 for this network..
My choice would be to get rid of the Apple crap. I'm allergic to the stuff. Disabling IPv6 is short sighted, as the world has to move to IPv6, to get rid of that NAT nonsense.
Take the complaint to Apple and let them fix it. They're the ones who caused the problem.
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
I’m not sure recommending IPv6 be turned off because of a client device bug is the way to go about this though (my traffic is about 50% IPv6 now), or swapping to its own network necessarily...
Is it possible to turn off IPv6 on that one device. As you say, it shouldn't be necessary to disable IPv6 on your network, due to Apple's incompetence.
-
Here's a possible work around. Put a cheap IPv4 only router between that Apple TV and your network or put the TV on it's own subnet, that has only IPv4 enabled.
-
@JKnott said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
Disabling IPv6 is short sighted,
Sort sighted for something that is not going to be mainstream for 20 years is not what I would call short sighted.. We all know your the IPv6 fanboy.. But dude - its NOT mainstream yet, and has ZERO actual anything that requires it.. ZERO!!! No matter how much you want it to be..
Name one mainstream anything that requires I have an IPv6 address.. Just 1...
JFC not even amazon supports it yet ;) Like the largest shopping site on the planet, and you can not not even get to it via IPv6..
Telling users to get different hardware because it doesn't play nice with something that has zero mainstream use, make no sense at all..
If it works for them and they have no issues with it, then sure leave it on... But when they have problems with it, or it generates any sort of headache or pita whatever... Then the "simple" solution is to just turn it OFF!! Be it there is something that they actually need it for - then they can turn it back on.. But that is years!!! down the road..
Put a cheap IPv4 only router between that Apple TV
So your suggestion is for him to complicate his setup, vs just click turn it off at pfsense? WTF dude - really!!
-
Short sighted in ignoring something that's essentially for moving the Internet forward. There are many people who cannot get public IPs, because their ISP forces them to use carrier grade NAT. For example, I have a VPN. How would I manage that behind NAT? As for usage, Google shows around 30% and the rate climbing. As it is, there are not enough IPv4 addresses to go around just for mobile devices, let alone everything else.
As for that other router, I suggested it only because of the problem caused by Apple crap. It is Apple and Apple alone that should be fixing this.
It is head in the sand types, who think using NAT and other hacks to get around the IPv4 address shortage is a good idea, that are holding back IPv6. The first problem I recall with NAT was active mode FTP wouldn't work and this was at a time when most FTP clients didn't support passive mode. So, this was over 20 years ago, when NAT was already breaking things. (Back then, I could use FTP between my home computer and work computer, at IBM, as there was no NAT at either end.) Now, with VoIP and some games, we need STUN servers. It also breaks IPSec AH and even causes problems with ESP, such that it is necessary to encapsulate it in UDP, just to get through NAT. Continuing to use IPv4 means hacks on hacks, when the proper solution is to move to IPv6. Then not only will the address problem go away, there will be performance and security benefits too.
Incidentally, I have been running IPv6 for about 10 years. I have yet to see a problem caused by it. On the other hand I have seen some caused by trying to get around the IPv4 address shortage.
-
@JKnott Unfortunately there is no way to specifically turn off IPv6 on an Apple TV... same with an iPhone, they just natively support it as part of their stack.
Which, as much as people don't like Apple... I completely agree that the transition to IPv6 should be seamless and the approach should be exactly that, just hide and obfuscate any complexities and it should "just work". Leave complexities to us geeks in the background to work out.
For the purposes of the thread here, I don't necessarily want to get into the IPv6 debate - I agree a full migration is definitely a long way out... but also agree that we should definitely be part of the driving force to move as many folks as possible towards it (at least that are capable to move there), as NAT and such is really just a workaround for improper connectivity and lack of addresses to give out.
But at the same time, we need to let client OS developers (iOS, Android, Windows, Linux, etc) know when they do something that might not necessarily be wrong according to standards... but could and will be a complete PITA to manage and administer from an IT standpoint in the long-term.
Thanks for the banter folks - I'll see what the process is to open up a bug/ticket with Apple. As I don't think their intention for an Apple TV is for a single one to show up as a hot mess of hundreds of IPv6 addresses utilized for no real purpose.
Best Regards,
dg6464
-
Odd I have 2 Apple TVs and don't have hundreds of entries for a single MAC address.
I have DHCPv6 static mapings for the devices.
-
Take the complaint to Apple and let them fix it. They're the ones who caused the problem.
I'd suggest the issue lies elsewhere see my previous post.
-
Perhaps @dg6464's TV is defective. I have never heard of any device doing that on IPv4 or IPv6. According to his description, each of the NDP entries is for a different IP address, but same MAC. There should only be a few but certainly not hundreds.
Perhaps he could run Packet Capture, foltering on the TV's MAC address and ICMP6, to see what's happening.
-
Apple TV's are a known pain in the butt when they go to sleep... they wreak havoc on my Meraki switches by transitioning to 100Mbps from 1Gbps and show CRC errors like there is a bad cable (this is a known issue and will likely never be fixed by Apple).
No CRC errors on the LAN port it's connected to here either, sure you don't have a cable issue ?
-
What speed does yours come up at? Autonegotiation should cause it do come up at the best possible.
Certainly a different cable should be tried. A flaky (pardon the tech jargon ) cable can cause the devices to think they can run at Gb, but the cable only permits 100 Mb.
-
1 Gig, I think the previous versions ran 10/100 ports.
-
@NogBadTheBad this is an Apple TV issue only when it goes to sleep... this is an Apple TV 4K, but I believe it's the same for all Apple TV's.
On my Meraki switch, it re-negotiates to 10/100 down from it'a usual 1Gbps... then shows CRC errors for the time it's asleep.
Otherwise - I do a speedtest and get 1Gbps down.. have tested cables and such. I've got 3 Cat6 drops in that room to my basement switch... definitely not a cable.
I'll try and find the article where someone else stated this is a common Apple TV "sleep" problem and is the same with multiple vendors switches.
Best Regards,
dg6464
-
@JKnott so I just did a packet capture (albeit too big, it's like 107MB for just 30 seconds or so as I turned it on, booted up Netflix and Plex).
However... before doing so I cleared the NDP entires for the Apple TV.
They haven't come back.
So maybe while I was doing some IPv6 Testing or implementing IPv6 DNS on my pihole, it somehow generated a ton of these entries and they just stayed?
Not sure - but I will monitor moving forward.
-
@NogBadTheBad this might be a way of getting around it... if I just assign a static DHCPv6 for the MAC address. I'll give it a try if the NDP table issue keeps happening.
This will also be a simple way for me to keep the hostnames in check and make it easier to know what is what.
Did you find that the Apple TV's actually received a DHCPv6 address when you configured it?
Where did you configure those static DHCPv6 addresses? When I go to configure one it asks for a DUID and has no specific spot for the MAC Address?
Thanks!
Best Regards,
dg6464
-
What makes you think my ATV doesn’t go to sleep?
Have you got a spare lan port on your router to try and connect it to directly dos a test.
I originally let my ATV get a random IPv6 address then fixed it using the DUID address in the status - dhcpv6 leases page.
-
@NogBadTheBad I'm not saying it doesn't go to sleep... I'm saying your switch modem may not detect CRC align errors for some reason. It was more commercial gear that seemed to detect the issue.
I've tried multiple switching ports, multiple cables... and everything works perfectly when it's awake. Only when it goes to sleep does it have the issue.
As for the DHCPv6 lease... for some reason the DUID that it assigns won't allow me to assign a reservation:
Either way... the NDP Table only has 1 entry now... the most I have seen yet is 4 entries for it now. Only time will tell.
Not that it helps at all, but the Meraki switch GUI with the CRC errors... you can see the "red" gaps.. that's where it goes to sleep:
It's asleep right now, so it negotiates at 10/100:
Meraki thread about it:
[https://community.meraki.com/t5/Switching/AppleTV-4K-Ethernet-Madness/td-p/41254](link url)
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
if I just assign a static DHCPv6 for the MAC address.
I don't know that would do it. You'd still have the neighbour announcements. With SLAAC, you will have a link local address and at least 1 global address. With DHCPv6, you will have a link local address and 1 global address. I don't see much difference in that.
As for that huge packet capture, what happens if you wait for the dust to settle, before starting it? You should still see neighbour advertisements periodically.
-
@JKnott do you think it's worth running RA in "Managed" mode then, to force DHCPv6? Not sure if I am in a world of hurt for all of the IP's that have been assigned using SLAAC / RA already though (likely my pihole DNS servers IP, unRAID's IPv6 IP and such). Not sure if I turn off Assisted mode and move to Managed if the existing used IP's will show up as leases.
Honestly if most things are compatible with DHCPv6 now and don't require SLAAC / RA's and autoconfigure... i'd almost rather manage the DHCPv6 leases just like I manage the DHCP IPv4 leases today... one by one from the pool as a round-robin and configuring reservations when it makes sense.
I can try another packet capture as well if you'd like and just not boot up Netflix and such.
You think just a cycle from sleep to wake up to sleep again will do the trick?
I can tinker with the options if it makes sense... just thought I'd ask just in case I'm in for a world of hurt by changing from Assisted. Doesn't that basically disable auto-configure / SLAAC?
Existing Configuration for DHCPv6 and RA:
Thanks!
Best Regards,
dg6464
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
do you think it's worth running RA in "Managed" mode then, to force DHCPv6?
I doubt it would make any difference. RAs are required, whether SLAAC, DHCPv6 or manual config. RAs are the IPv6 equivalent of ARP and without them, it won't work.
-
@johnpoz said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
Name one mainstream anything that requires I have an IPv6 address.. Just 1...
Here's one example. IIRC, the Xbox requires IPv6. It had used Teredo, but I believe that's been turned down or will be shortly.
-
I have 2 older 1080p AppleTvs On a dual stack network and haven’t seen what you are seeing. I am using them currently on WiFi but I have used them wired in the past with no issue
They work fine with my ipv6 network. I use SLAAC only (unmanaged) but they also work as “assisted”.
About the only thing I have ever had to do to them is restart them if I reconfigure my network.
I have noticed that they don’t update their network configuration unless you restart them and that includes ipv4 too. Pulling the plug doesn’t work.
I have seen multiple ipv6 addresses (>600) once on a Windows machine but that was due to a router problem.
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
@JKnott do you think it's worth running RA in "Managed" mode then, to force DHCPv6? Not sure if I am in a world of hurt for all of the IP's that have been assigned using SLAAC / RA already though (likely my pihole DNS servers IP, unRAID's IPv6 IP and such). Not sure if I turn off Assisted mode and move to Managed if the existing used IP's will show up as leases.
Honestly if most things are compatible with DHCPv6 now and don't require SLAAC / RA's and autoconfigure... i'd almost rather manage the DHCPv6 leases just like I manage the DHCP IPv4 leases today... one by one from the pool as a round-robin and configuring reservations when it makes sense.
I find that "unmanaged" SLAAC mode works the best with most devices like these media devices and IOT type devices. DHCPv6 implementation on some of these types of devices are hit or miss, but SLAAC always seems to work.
The support for SLAAC in the RFCs are mandatory for hosts, whereas DHCPv6 host support is "optional".
-
@JKnott said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
@johnpoz said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
This is perfect example of when you just disable IPv6 for this network..
My choice would be to get rid of the Apple crap. I'm allergic to the stuff. Disabling IPv6 is short sighted, as the world has to move to IPv6, to get rid of that NAT nonsense.
Take the complaint to Apple and let them fix it. They're the ones who caused the problem.
Apple works perfectly fine with ipv6, actually, one of the best. I think the issue here is the network itself is misconfigured..
-
Personally I think the issue lies with the Meraki switch, I can't understand why the speed changes to 100 Mbps when the ATV sleeps, my screenshots occured what the ATV was asleep.
I have 1 ATV connected to ethernet & 1 connected via Wi-Fi both don't have the issue you're seeing.
I'm using switches from the Linksys Business range.
Do you have a spare port on the router that you could set up as a new test lan and connect the ATV directly to it?
-
@NogBadTheBad Thanks for the insight - I've also got the same setup... my one Apple-TV 4K, connected via LAN and the other Apple TV connected via WiFi.
The issue (as per the Meraki thread) seems to persist beyond just Meraki switches when the Apple TV sleeps... and is only an issue for wired clients.
You may be correct, however in that the Apple TV could be giving the issue because it's wired specifically, so likely it would fix the issue to just move totally to wireless, but what is the fun in that? :).
I've attached some screenshots of the NDP table as of this morning... the ATV4 is gradually grabbing more IPv6 IP's via RA / SLAAC it seems.
I can run some experiments and see if the other ATV does the same on wireless, as well as wired if need be, I can capture packets from both the pfSense box, as well as all packets on the switch ports (there's a make .pcap function on the switch... so I assume I'd also see the L2 switch negotiation messages if I get the .pcap from the switch.
There IS a DHCP lease that contains the ATV4's MAC address in it (as part of the DUID), but doesn't actually specifically show that as the MAC Address as an entry in the DHCPv6 lease table (screenshot attached). When I try to create a reservation for that DUID it gives me an error as well, not sure why... seems my DUID formatting is wrong (but it came directly from clicking the "+" and trying to add via the pfSense formatting and reserve function itself).
-
Are you trying to allocate a fixed IP that's been handed out via DHCPv6 and is in the available range, you need to hand out an IP from outside the range.
I set my range to 2a02:xxxx:xxxx:4::64 - 2a02:xxxx:xxxx:4::fe and allocate 2a02:xxxx:xxxx:4::ABCD where ABCD = the last octet of my IPv4 address converted to hex.
andy@mac-pro ~ % host livingroom-atv
livingroom-atv has address 172.16.4.12
livingroom-atv has IPv6 address 2a02:xxxx:xxxx:4:c
andy@mac-pro ~ %FYI the last few digits of the DUID contain the device MAC address.
BTW Those are different IPv6 addresses from your DHCPv6 scope that are being handed out to the same MAC address.
Think you need to do an extended packet capture on the router itself and try and figure out why the router is handing out multiple IPv6 addresses to the same MAC when it should reuse the same address thats being handed out.
https://docs.netgate.com/pfsense/en/latest/book/services/ipv6-dhcp-server-and-router-advertisements.html
Here is how my IOT subnet is setup for DHCPv6
-
@NogBadTheBad said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
Are you trying to allocate a fixed IP that's been handed out via DHCPv6 and is in the available range
Does pfSense allow that with IPv6? It certainly doesn't with IPv4.
-
@JKnott said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
@NogBadTheBad said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
Are you trying to allocate a fixed IP that's been handed out via DHCPv6 and is in the available range
Does pfSense allow that with IPv6? It certainly doesn't with IPv4.
That's why I mentioned it,
I don't think it does.it doesn't.Also the setting on his DHCPv6 server doesn't look correct.
-
@NogBadTheBad Thanks for the quick response... it may be worth diving into my overall IPv6 configuration, then... as I think it might require some tweaking.
My ISP gives me a /64 to use for my LAN from what I can tell... so that means (since I believe /64 is the minimum recommended LAN segment to use) that I only get one segment to use for IPv6?
That segment is automatically used for SLAAC since I believe clients use the local address of the RA router in addition to their DUID to make their own addresses (the IPv6 address assigned to the LAN interface by default).
That segment is ALSO used as my range for my DHCPv6 server.
I assume what you have is a /60 or something and you are able to use separate non-overlapping /64's for the different spots... one /64 on you main LAN, one for your IOT (which is used for SLAAC on both)... one /64 for your DHCPv6 subnets on each LAN as well?
Screenshots of my configuration and IP's provided.
It's likely I've got something mixed up... as my ranges are much simpler (since I only have the one block to use, I omitted the beginning of the addresses since it's assumed by the LAN interfaces leased info, I thought.
-
@NogBadTheBad You are correct, this is a misconfiguration... as for some reason I thought it was supported on IPv4 and that's what I was doing. I was incorrect.
I use 192.168.1.0 /24 as my LAN subnet and thought I had set the DHCP Pool for the whole thing, but I did not it's only 192.168.1.130 - 254.
But I am not sure there is a way to do this in IPv6 anyway with a /64 is there?
Best Regards,
dg6464
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
@NogBadTheBad Thanks for the quick response... it may be worth diving into my overall IPv6 configuration, then... as I think it might require some tweaking.
My ISP gives me a /64 to use for my LAN from what I can tell... so that means (since I believe /64 is the minimum recommended LAN segment to use) that I only get one segment to use for IPv6?
That segment is automatically used for SLAAC since I believe clients use the local address of the RA router in addition to their DUID to make their own addresses (the IPv6 address assigned to the LAN interface by default).
That segment is ALSO used as my range for my DHCPv6 server.
I assume what you have is a /60 or something and you are able to use separate non-overlapping /64's for the different spots... one /64 on you main LAN, one for your IOT (which is used for SLAAC on both)... one /64 for your DHCPv6 subnets on each LAN as well?
Yes /64 is really the minimum for an IPv6 LAN segment.
RIPE recommend everyone gets a /48:-
https://www.ripe.net/publications/docs/ripe-690I've been allocated a /48 that I split on a /64 boundary, my ISP routes the /48 to my WAN interface.
I'd be tempted to change your settings so they look like mine, I don't have track interface set on my interfaces I have 2a02:xxxx:xxxx:1::1, 2a02:xxxx:xxxx:2::1, etc ... set as a static.
-
@NogBadTheBad I was just using the suggested pfSense settings from my ISP, Rogers:
https://communityforums.rogers.com/t5/Internet/Rogers-IPv6-Status/td-p/146117/page/33
Rogers IPv6 Settings for pFSense firewall
In WAN Interface menu:
Use IPv4 connectivity as parent interface: yes
Request only a IPv6 prefix: no
DHCPv6 Prefix Delegation Size: 64
Send IPv6 prefix hint: yesIn LAN Interface menu:
IPv6 Configuration Type: track interface
IPv6 Interface: WAN
IPv6 Prefix ID: 0
In Advanced Settings / Network menu:Allow IPv6: enabled
Thoughts? Is this Rogers just issuing a /64? Does that mean I just have to stick with SLAAC on the only /64 subnet given (I assume the IP information based on the address my LAN interface gets) and no DHCPv6?
Thanks!
Best Regards,
dg6464
-
-
@dg6464 said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
DHCPv6 Prefix Delegation Size: 64
If you're on Rogers, then you can use /56. That info in the link was posted when Rogers only offered a /64. The info was updated in a later post.
Also, select Do not allow PD/Address release. Otherwise, it won't take much for your prefix to change. I found all it took was to disconnect/reconnect the WAN cable.
-
@NogBadTheBad said in IPv6 NDP Table - Hundreds of Entries for Single Mac Address (Apple TV):
RIPE recommend everyone gets a /48
Many people are still stuck in the IPv4 address shortage mindset and can't comprehend how many IPv6 addresses there are. There are enough /48s to give every single person on earth over 4000 of them and that's with only 1/8th of the IPv6 addresss space allocated to global unique addresses. I have a /56, which seems adequate for now.