Re: [IPv6 Users] Teredo client brokenness: link-local destination ?
Hi, At 09.08.2007 00:07, Miguel A. Diaz wrote:
I've also saw similar packets but the link local address used is different. It's always fe80::8000:5445:5245:444F. As curiosity, the corresponding ASCII characters of the last part of the link-local ID field is:
54 45 52 45 44 4F ==> TEREDO
Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo" @Miguel: do you know which client uses such addresses? @Pekka: can you check whether your examples with masked IIDs have some correlation which can be used also for detection or are this original link-local addresses? At least, the IIDs are from type "local". Regards, Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto:pb@bieringer.de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/ Xing/OpenBC http://www.xing.com/hp/Peter_Bieringer/
-----Mensaje original----- De: Peter Bieringer [mailto:pb@bieringer.de] Enviado el: sábado, 11 de agosto de 2007 9:15 Para: miguelangel.diaz@consulintel.es; Pekka Savola CC: Maillist ipv6calc Asunto: Re: [IPv6 Users] Teredo client brokenness: link-local destination ?
Hi,
At 09.08.2007 00:07, Miguel A. Diaz wrote:
I've also saw similar packets but the link local address used is different. It's always fe80::8000:5445:5245:444F. As curiosity,
Hi, the
corresponding ASCII characters of the last part of the link-local ID field is:
54 45 52 45 44 4F ==> TEREDO
Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo"
@Miguel: do you know which client uses such addresses?
I'm not really sure but I guess it's Microsoft's Teredo client because the big number of packets captured. I assume that Microsoft's client is the predominant implementation because the number of PC with Windows as OS. Furthermore, the new Vista has been released with both IPv6 and Teredo enabled by default (Teredo works if no native IPv6 connectivity is detected). This assumption seems to be confirmed because I've googled and I can see a lot of references with link-local address as fe80::8000:5445:5245:444F for the Teredo interface on Windows. I've also detected that the link-local address fe80::ffff:ffff:fffd is also used by Microsoft's Teredo client. I don't really know why Microsoft's Teredo implementation uses both link-local addresses. Maybe it depends on the SP or OS version. Regards Miguel ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.
Hi Miguel, At 11.08.2007 13:46, Miguel A. Diaz wrote:
Hi,
-----Mensaje original----- De: Peter Bieringer [mailto:pb@bieringer.de] Enviado el: sábado, 11 de agosto de 2007 9:15 Para: miguelangel.diaz@consulintel.es; Pekka Savola CC: Maillist ipv6calc Asunto: Re: [IPv6 Users] Teredo client brokenness: link-local destination ?
Hi,
At 09.08.2007 00:07, Miguel A. Diaz wrote:
I've also saw similar packets but the link local address used is different. It's always fe80::8000:5445:5245:444F. As curiosity, the corresponding ASCII characters of the last part of the link-local ID field is:
54 45 52 45 44 4F ==> TEREDO Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo"
@Miguel: do you know which client uses such addresses?
I'm not really sure but I guess it's Microsoft's Teredo client because the big number of packets captured. I assume that Microsoft's client is the predominant implementation because the number of PC with Windows as OS. Furthermore, the new Vista has been released with both IPv6 and Teredo enabled by default (Teredo works if no native IPv6 connectivity is detected). This assumption seems to be confirmed because I've googled and I can see a lot of references with link-local address as fe80::8000:5445:5245:444F for the Teredo interface on Windows.
I've also detected that the link-local address fe80::ffff:ffff:fffd is also used by Microsoft's Teredo client. I don't really know why Microsoft's Teredo implementation uses both link-local addresses. Maybe it depends on the SP or OS version.
It would be interest, whether there is a difference between IPv6-enabled W2K and Vista. BTW: I've added this IID now also to ipv6calc's ll-teredo detection. Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto:pb@bieringer.de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/ Xing/OpenBC http://www.xing.com/hp/Peter_Bieringer/
On Sat, 11 Aug 2007, Peter Bieringer wrote:
54 45 52 45 44 4F ==> TEREDO
Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo"
@Miguel: do you know which client uses such addresses?
@Pekka: can you check whether your examples with masked IIDs have some correlation which can be used also for detection or are this original link-local addresses? At least, the IIDs are from type "local".
None of the addresses seen are like that. However, I'm using Miredo relay, and according to the developer, these packets shouldn't be seen in the first place, so it might be that some of those more well-known packets are being blocked. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
participants (3)
-
Miguel A. Diaz
-
Pekka Savola
-
Peter Bieringer