Hi,

-----Mensaje original----- De: Peter Bieringer [mailto:pb@bieringer.de] Enviado el: sábado, 11 de agosto de 2007 9:15 Para: miguelangel.diaz@consulintel.es; Pekka Savola CC: Maillist ipv6calc Asunto: Re: [IPv6 Users] Teredo client brokenness: link-local destination ?

Hi,

At 09.08.2007 00:07, Miguel A. Diaz wrote:

...

I've also saw similar packets but the link local address used is different. It's always fe80::8000:5445:5245:444F. As curiosity,

the

...

corresponding ASCII characters of the last part of the

link-local ID

...

field is:

54 45 52 45 44 4F ==> TEREDO

Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo"

@Miguel: do you know which client uses such addresses?

I'm not really sure but I guess it's Microsoft's Teredo client because the big number of packets captured. I assume that Microsoft's client is the predominant implementation because the number of PC with Windows as OS. Furthermore, the new Vista has been released with both IPv6 and Teredo enabled by default (Teredo works if no native IPv6 connectivity is detected). This assumption seems to be confirmed because I've googled and I can see a lot of references with link-local address as fe80::8000:5445:5245:444F for the Teredo interface on Windows.

I've also detected that the link-local address fe80::ffff:ffff:fffd is also used by Microsoft's Teredo client. I don't really know why Microsoft's Teredo implementation uses both link-local addresses. Maybe it depends on the SP or OS version.

Regards Miguel

********************************************** The IPv6 Portal: http://www.ipv6tf.org

Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

On Sat, 11 Aug 2007, Peter Bieringer wrote:

...

54 45 52 45 44 4F ==> TEREDO

Just for your information, current cvs version of ipv6calc now detects such adddress as "link-local-teredo"

@Miguel: do you know which client uses such addresses?

@Pekka: can you check whether your examples with masked IIDs have some correlation which can be used also for detection or are this original link-local addresses? At least, the IIDs are from type "local".

None of the addresses seen are like that.

However, I'm using Miredo relay, and according to the developer, these packets shouldn't be seen in the first place, so it might be that some of those more well-known packets are being blocked.