OpenWrt Forum Archive

Topic: Many packets with HBH ICMP6 arrive at firewall

The content of this topic has been archived on 3 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi,

I've connected my TP-Link WR1043ND, latestet Openwrt release, guess 15.5, using one of the LAN ports. I assigned a VLAN ID to the port to separate the guests wifi from the private lan.

Works perfectly well, however I noticed that while nobody uses this appropriate interface, many packets arrive at the firewall like those for example:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on blue0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:36:19.191805 f8:d1:11:bc:72:10 > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: fe80::fad1:11ff:febc:7210 > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 10000 addr: ::, length 24
20:38:24.631845 f8:d1:11:bc:72:10 > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: fe80::fad1:11ff:febc:7210 > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 10000 addr: ::, length 24

This obviously happend every second minute, as seen above. I've already disable all available options regarding IPv6 on the guests wifi interface to no avail so far. Is there anything I could lookup to finally stop Openwrt from sending?

Thanks,
Michael

whatever has mac f8:d1:11:bc:72:10 is sending out multicast packets (yuch) its probably some kind of video streaming box or software.

WWTK wrote:

whatever has mac f8:d1:11:bc:72:10 is sending out multicast packets (yuch) its probably some kind of video streaming box or software.

Unfortunately no. f8:d1:11:bc:72:10 is the MAC address of the guest interface from my TP-Link.

Michael

unfortunately yes, some package on the router is sending it if that address belongs to the router.  try downloading wireshark or some gui based packet sniffer and see if you can trace it further maybe.

This is standard IPv6 traffic. Your router is announcing itself. Given that there are no more IPv4 addresses available, and IPv6 is the future growth of the internet, why would you want to disable IPv6?

The discussion might have continued from here.