This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hi all,

Probably an easy question but I cannot figure it out so would appreciate some help.

As per RFC the source address of a RS message can be either the IP address assigned to the sending interface, or unspecified address if no address is assigned to the sending interface. The link-layer address of the sender, if known. MUST NOT be included if the Source Address is the unspecified address. Otherwise it SHOULD be included on link layers that have addresses.

In case the src address of the RS = unspecified address how can I (based on a Wireshark capture) know which Router Advertisement is the response to the RS above ?

RFC regarding RA messages states:

"Destination Address Typically the Source Address of an invoking Router Solicitation or the all-nodes multicast address."

So if the src was unspecified address, the RA will response to the all-nodes multicast address.

I think I have problems to understand it, because it is unclear for me what is the order of the messages ... I have some Wireshark captures where the src address of a RS = fe80: .. . ( so a link-local address). What would cause a host to send a RS message with src=unspecified ? Is it not the feature of IPv6 (plug and play) that each device will auto generate a link-local address for itself ?

I know this might be partially a Wireshark question but I hope this question will not be flaged as offtopic.

Any help is appreciated!

Best Regards

Adam

asked 31 Oct '15, 13:06

adasko's gravatar image

adasko
86343842
accept rate: 0%

Could you please add the rfc number it is easier to google.

(31 Oct '15, 16:36) Christian_R

Have you read the RFC3513 and RFC 3590 they are both talking about an unspecified address.

RFC 3590:

   5. Source Address Selection Implications

In RFC 2710, MLD Report and Done messages are required to have an IPv6 source address that is link-local. This memo augments that rule by allowing these messages to contain the unspecified address (::) as the source address.

The behavior of RFC 2710 implementations, when receiving a message with a source address of ::, is dependent upon how the implementation treats the unspecified address. That is, these messages will be dropped if the implementation does not consider the unspecified address to be link-local in scope.

As the unspecified address is only used when there is no link-local address, RFC 2710 implementations discarding these packets will have no affect on the packet's sender as the use should only be for joining the link-local solicited-node multicast group [RFC 2462].

There is an implication to senders with respect to joining other multicast groups prior to the activation of a link-local address. The dropping of Reports using the unspecified address as a source address could cause a lack of multicast traffic that is expected by the node. This black hole will be temporary until the node can send a Report with a valid link-local address.

permanent link

answered 31 Oct '15, 17:13

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×51

question asked: 31 Oct '15, 13:06

question was seen: 3,000 times

last updated: 31 Oct '15, 17:13

p​o​w​e​r​e​d by O​S​Q​A