Subject: [76attendees] Rogue IPv6 RA

From: Yuji Sekiya <[email-masked]>
Date: Mon, 09 Nov 2009 13:43:54 +0900

Dear IET76 Attendees,
This is Yuji Sekiya, IETF NOC.

Someone's laptop announces Rogue IPv6 RA on
SSID:ietf network.

We send fake RAs with routerlifetime=0, so your computer
may not be affected, however, the Rogue RAs are still announced.

MAC addresses of laptop which announces Rogue RA are

   00:1b:77:bc:a4:e6
   00:21:6b:3c:8c:e2

Please STOP announcement of Rogue RA !!!

-- Yuji Sekiya

---

From: Masafumi OE <[email-masked]>
Date: Mon, 9 Nov 2009 13:52:40 +0900

Dear IET76 Attendees,

On Mon, Nov 09, 2009 at 01:43:54PM +0900,

> MAC addresses of laptop which announces Rogue RA are
	is located in CATTLEA-East.

>    00:21:6b:3c:8c:e2
	is located in CATTLEA-East.

-- 
Masafumi OE, Astronomy Data Center, NAOJ.

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 9 Nov 2009 13:56:47 +0900

As seen from Acacia West the broken machine is:

bogus RA's from Dell_cd:e2:4d (00:11:43:cd:e2:4d)

Prefix 2002:855d:13c9:9::
Prefix fec0:0:0:9::

> -----Original Message-----
> From: [email-masked] [mailto:76attendees-
> [email-masked]] On Behalf Of Masafumi OE
> Sent: Monday, November 09, 2009 1:53 PM
> To: Yuji Sekiya
> Cc: [email-masked]
> Subject: Re: [76attendees] Rogue IPv6 RA
> 
> 
> Dear IET76 Attendees,
> 
> _______________________________________________
> 76attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/76attendees

---

From: evyncke <[email-masked]>
Date: Mon, 09 Nov 2009 14:01:20 +0900

Interesting to see ULA on WiFi indeed ;-)

---

From: Rob Evans <[email-masked]>
Date: Mon, 09 Nov 2009 05:01:49 +0000

> Please STOP announcement of Rogue RA !!!

As I've just gone through this with someone that was sending RAs 
earlier, it seems as though if you've enabled internet connection 
sharing on Windows XP in the past, it may still be sending RAs even if 
ICS is disabled.

 From a command prompt:
netsh
interface ipv6
show interface level=verbose

Look through the output for "Sends Router Advertisements : Yes", and for 
those interfaces do:

set interface "Wireless Network Connection" advertise=disabled

Replace "Wireless Network Connection" with the name of the relevant 
interface.

I doubt this is persistent.

Rob

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 9 Nov 2009 14:32:28 +0900

That is not ula, it is site-local. Both of those prefixes are in the same RA

> From: evyncke [mailto:[email-masked]]
> Sent: Monday, November 09, 2009 2:01 PM
> To: [email-masked]; 'Masafumi OE'; 'Yuji Sekiya'
> Cc: [email-masked]

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Mon, 09 Nov 2009 15:38:44 +0900

Using netsh you typically have the option to add:

store=persistent

(persistent across reboots)

or

store=active

(valid only until you reboot)

Other tips when you configured 6to4 in your laptop and want to "undo" it,
available for several operating systems at:
http://www.ipv6tf.org/index.php?page=using/connectivity/6to4

Regards,
Jordi

> De: Rob Evans <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Mon, 09 Nov 2009 05:01:49 +0000
> Para: <[email-masked]>
> Asunto: Re: [76attendees] Rogue IPv6 RA
> 

**********************************************
The IPv6 Portal: http://www.ipv6tf.org

Bye 6Bone. Hi, IPv6 !
http://www.ipv6day.org

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: Yuji Sekiya <[email-masked]>
Date: Mon, 09 Nov 2009 19:20:27 +0900

At Mon, 09 Nov 2009 13:43:54 +0900,
Yuji Sekiya wrote:

Nowcomer...

   00:16:cb:b5:c8:fe

on SSID:ietf network.

-- Yuji Sekiya

---

From: Masafumi OE <[email-masked]>
Date: Mon, 9 Nov 2009 19:27:06 +0900

The client location is front-right side in ORCHID EAST.

--
Masafumi OE

On Mon, Nov 09, 2009 at 07:20:27PM +0900,

---

From: Arifumi Matsumoto <[email-masked]>
Date: Mon, 9 Nov 2009 19:52:48 +0900

Hi,

> may not be affected, however, the Rogue RAs are still announced.

Is that true ?

IIRC, routerlifetime and address lifetime is not correlated.

So, that address can be used for the source address for
outgoing sessions, right ?

You also have to deprecate the address by announcing PIO
with preferred lifetime 0.

Regards,

---

From: Yuji Sekiya <[email-masked]>
Date: Mon, 09 Nov 2009 19:55:13 +0900

At Mon, 9 Nov 2009 19:52:48 +0900,

> outgoing sessions, right ?

I think some of implementation bind prefix and its default
router, so default router is expired, the prefix is not
selected as source address.

-- Yuji Sekiya

---

From: Harold Huggins <[email-masked]>
Date: Mon, 09 Nov 2009 04:10:16 -0800

Did someone download and install a netstumbler program to see if the Rogue
is passing traffic?

http://www.netstumbler.com/downloads/

---

From: Arifumi Matsumoto <[email-masked]>
Date: Mon, 9 Nov 2009 23:33:16 +0900

Hi,
let me CC to 6man ML,

Per RFC4861,

6.3.4.  Processing Received Router Advertisements
...
       - If the address is already present in the host's Default Router
         List and the received Router Lifetime value is zero,  
immediately
         time-out the entry as specified in Section 6.3.5.
...
6.3.5.  Timing out Prefixes and Default Routers

    Whenever the invalidation timer expires for a Prefix List entry,  
that
    entry is discarded.  No existing Destination Cache entries need be
    updated, however.  Should a reachability problem arise with an
    existing Neighbor Cache entry, Neighbor Unreachability Detection  
will
    perform any needed recovery.

    Whenever the Lifetime of an entry in the Default Router List  
expires,
    that entry is discarded.  When removing a router from the Default
    Router list, the node MUST update the Destination Cache in such a  
way
    that all entries using the router perform next-hop determination
    again rather than continue sending traffic to the (deleted) router.

I'm not sure what does "immediately time-out the entry as specified
in Section 6.3.5." mean.
Does it mean both paragraphs in 6.3.5. or just the latter paragraph ?

If the latter paragraph only should be executed, the address given
by rogue RA remains, right ?

---

From: Arifumi Matsumoto <[email-masked]>
Date: Tue, 10 Nov 2009 10:51:04 +0900

Erik,

On 2009/11/10, at 10:43, Erik Kline wrote:

> My reading would be that on receipt of a 0-lifetime RA that only the
> second paragraph would be executed (lifetime timeout).

Second to that.

>  However, all
> hosts receiving the 0-lifetime RA would then have to recompute the
> next-hop, which in /some/ cases may require sending a RS (which the
> rogue RA node would presumably hear and re-answer).  (Of course I
> haven't verified this against any implementation :)

I fail to get your point.
Requiring sending a RS leads to ... ?

Even if that RS fails, it does not have any effect on the given
addressby rogue RA, right ?

---

From: Yuji Sekiya <[email-masked]>
Date: Tue, 10 Nov 2009 13:15:01 +0900

Dear IETF76 participants,

In Cattleya West Root room the below client is still
sending Rogue RA. The client also sent it yesterday.

00:21:6b:3c:8c:e2

The machine name is "T400" by DHCP log.

We will kick out the client from wireless network
at 2:00pm.

Please check MAC address of your PC.

Regards,

-- Yuji Sekiya

---

From: Masafumi OE <[email-masked]>
Date: Tue, 10 Nov 2009 14:36:24 +0900

Dear All,

"00:21:6b:3c:8c:e2" has been blocked from IETF76 WiFi at 2:00pm.

Please, people who owns this client contact to the Helpdesk in 
the terminal room or NOC in the UME(4th Floor).
(See the IETF message board)

Also, we are hunting another Rouge RA client on the venue.
MAC address is "00:1b:77:bc:a4:e6" in the ORCHID West.
If RA sending from this client will be continued, we will block 
the client.

Regards,

--
Masafumi OE/ NAOJ

On Tue, Nov 10, 2009 at 01:15:01PM +0900,

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Mon, 9 Nov 2009 23:39:02 -0600

Looks like another Thinkpad machine because the OUI for this new
mac-addr matches the OUI of the previous machine sending Rogue RA.

00-1B-77   (hex)		Intel Corporate
001B77     (base 16)    Intel Corporate
				Lot 8, Jalan Hi-Tech 2/3
				Kulim Hi-Tech Park
				Kulim Kedah 09000
				MALAYSIA

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Masafumi OE
Sent: Tuesday, November 10, 2009 2:36 PM
To: [email-masked]
Subject: Re: [76attendees] Rogue IPv6 RA

Dear All,

Regards,

--
Masafumi OE/ NAOJ

---

From: Yuji Sekiya <[email-masked]>
Date: Thu, 12 Nov 2009 15:27:25 +0900

The below client advertise Rogue RA again today,
so we will block the MAC address soon.

00:1b:77:bc:a4:e6
Hostname is PC-de-pascal by DHCP log.

Please check your PC.

Regards,

-- Yuji Sekiya