Ok, actually the ISP router is also trying the multicast after failing
the unicast:
Here are two packets, the first one works, the router responds (openbsd
box), but the second one is ignored.
first one (works is responded to):
[+] Frame 12012: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) on
interface vport0, id 0
[+] Ethernet II, Src: ASUSTekC_42:5c:dc (7c:10:c9:42:5c:dc), Dst:
IPv6mcast_ff:01:00:01 (33:33:ff:01:00:01)
[-] Internet Protocol Version 6, Src: fe80::7e10:c9ff:fe42:5cdc, Dst:
ff02::1:ff01:1
0110 .... = Version: 6
[+] .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0,
ECN: Not-ECT)
.... 1110 0100 0001 1111 0010 = Flow Label: 0xe41f2
Payload Length: 32
Next Header: ICMPv6 (58)
Hop Limit: 255
Source Address: fe80::7e10:c9ff:fe42:5cdc
Destination Address: ff02::1:ff01:1
Source SLAAC MAC: ASUSTekC_42:5c:dc (7c:10:c9:42:5c:dc)
[-] Internet Control Message Protocol v6
Type: Neighbor Solicitation (135)
Code: 0
Checksum: 0xd6ae [correct]
Checksum Status: Good
Reserved: 00000000
Target Address: 2a02:aa08:xxxx:xxxx::1:1 # redacted
[-] ICMPv6 Option (Source link-layer address : 7c:10:c9:42:5c:dc)
Type: Source link-layer address (1)
Length: 1 (8 bytes)
Link-layer address: ASUSTekC_42:5c:dc (7c:10:c9:42:5c:dc) [=]
second one (doesn't work, is ignored):
[+] Frame 10611: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) on
interface vport0, id 0
[+] Ethernet II, Src: Cisco_4e:41:74 (00:df:1d:4e:41:74), Dst:
IPv6mcast_ff:01:00:01 (33:33:ff:01:00:01)
[-] Internet Protocol Version 6, Src: fe80:b2b:11fe:161::2, Dst: ff02::1:ff01:1
0110 .... = Version: 6
[+] .... 1110 0000 .... .... .... .... .... = Traffic Class: 0xe0 (DSCP: CS7,
ECN: Not-ECT)
.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 32
Next Header: ICMPv6 (58)
Hop Limit: 255
Source Address: fe80:b2b:11fe:161::2
Destination Address: ff02::1:ff01:1
[-] Internet Control Message Protocol v6
Type: Neighbor Solicitation (135)
Code: 0
Checksum: 0x9de0 [correct]
Checksum Status: Good
Reserved: 00000000
Target Address: 2a02:aa08:xxxx:xxxx::1:1 # redacted
[-] ICMPv6 Option (Source link-layer address : 00:df:1d:4e:41:74)
Type: Source link-layer address (1)
Length: 1 (8 bytes)
Link-layer address: Cisco_4e:41:74 (00:df:1d:4e:41:74) [=]
--
Nicolas Goy
Engineer & Developer
https://www.kuon.ch
https://www.goyman.com
