ipv6 RS / RA messages

Question

hi all,

Probably an easy question but I cannot figure it out so would appreciate some help.

As per RFC the source address of a RS message can be either the IP address assigned to the sending interface, or unspecified address if no address is assigned to the sending interface. The link-layer address of the sender, if known. MUST NOT be included if the Source Address is the unspecified address. Otherwise it SHOULD be included on link layers that have addresses.

In case the src address of the RS = unspecified address how can I (based on a Wireshark capture) know which Router Advertisement is the response to the RS above ?

RFC regarding RA messages states:

"Destination Address Typically the Source Address of an invoking Router Solicitation or the all-nodes multicast address."

So if the src was unspecified address, the RA will response to the all-nodes multicast address.

I think I have problems to understand it, because it is unclear for me what is the order of the messages ... I have some Wireshark captures where the src address of a RS = fe80: .. . ( so a link-local address). What would cause a host to send a RS message with src=unspecified ? Is it not the feature of IPv6 (plug and play) that each device will auto generate a link-local address for itself ?

I know this might be partially a Wireshark question but I hope this question will not be flaged as offtopic.

Any help is appreciated!

Best Regards

Adam

Answer 1

Have you read the RFC3513 and RFC 3590 they are both talking about an unspecified address.

RFC 3590:

   5. Source Address Selection Implications
In RFC 2710, MLD Report and Done messages are required to have an
   IPv6 source address that is link-local.  This memo augments that rule
   by allowing these messages to contain the unspecified address (::) as
   the source address.
The behavior of RFC 2710 implementations, when receiving a message
   with a source address of ::, is dependent upon how the implementation
   treats the unspecified address.  That is, these messages will be
   dropped if the implementation does not consider the unspecified
   address to be link-local in scope.
As the unspecified address is only used when there is no link-local
   address, RFC 2710 implementations discarding these packets will have
   no affect on the packet's sender as the use should only be for
   joining the link-local solicited-node multicast group [RFC 2462].
There is an implication to senders with respect to joining other
   multicast groups prior to the activation of a link-local address.
   The dropping of Reports using the unspecified address as a source
   address could cause a lack of multicast traffic that is expected by
   the node.  This black hole will be temporary until the node can send
   a Report with a valid link-local address.