0

How can I filter the Output from a multicast ping to all nodes so that in the output file every IP appears only once?

  1. If a new device joins the network its written to a file with a joining Timestamp.
  2. If a device leaves the Network its gets removed from that file.
  3. At the end the Output file show me the current reachable Devices in the Network with the joining Timestamp
     ping6 -I eth1 ip6-allnodes 
        PING ip6-allnodes(ip6-allnodes) from fe80::aaaa:aaaa:aaaa:aaaa eth1: 56 data bytes
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=1 ttl=64 time=0.018 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=1 ttl=64 time=0.490 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=1 ttl=64 time=0.739 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=2 ttl=64 time=0.037 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=2 ttl=64 time=0.513 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=2 ttl=64 time=0.674 ms (DUP!)
        64 bytes from fe80::dddd:dddd:dddd:dddd: icmp_seq=2 ttl=64 time=228 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=3 ttl=64 time=0.033 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=3 ttl=64 time=0.460 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=3 ttl=64 time=0.611 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=4 ttl=64 time=0.045 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=4 ttl=64 time=0.485 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=4 ttl=64 time=0.609 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=5 ttl=64 time=0.035 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=5 ttl=64 time=0.518 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=5 ttl=64 time=0.580 ms (DUP!)
        64 bytes from fe80::eeee:eeee:eeee:eeee: icmp_seq=5 ttl=255 time=201 ms (DUP!)
        64 bytes from fe80::dddd:dddd:dddd:dddd: icmp_seq=5 ttl=64 time=237 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=6 ttl=64 time=0.032 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=6 ttl=64 time=0.508 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=6 ttl=64 time=0.540 ms (DUP!)
        64 bytes from fe80::aaaa:aaaa:aaaa:aaaa: icmp_seq=7 ttl=64 time=0.038 ms
        64 bytes from fe80::bbbb:bbbb:bbbb:bbbb: icmp_seq=7 ttl=64 time=0.550 ms (DUP!)
        64 bytes from fe80::cccc:cccc:cccc:cccc: icmp_seq=7 ttl=64 time=0.640 ms (DUP!)
        64 bytes from fe80::dddd:dddd:dddd:dddd: icmp_seq=7 ttl=64 time=76.6 ms (DUP!)
        ip6-allnodes ping statistics ---
        7 packets transmitted, 7 received, +18 duplicates, 0% packet loss, time 6020ms
        rtt min/avg/max/mdev = 0.018/30.086/237.386/72.776 ms

1

2 Answers 2

1

Ping is not the right tool for this. Each device only answers once, even if it has multiple addresses. And having multiple addresses is normal in IPv6.

Try NDPMon. Its purpose is to keep track of neighbour discovery events. It can log when an IPv6 address first appears, when its MAC address changes etc.

4
  • For my particular application its overblown. Because I want it run on a small ARM BusyBox Linux. For a extra Ubuntu Computer in the same Ipv6 Network it would be useful especially if you need the web output.
    – Oliver G.
    Jan 27, 2014 at 19:19
  • NDPmon is certainly not overblown. It is the minimum you need to keep track of the hosts on the LAN. Ok, the RA stuff you might not need, but the rest of the NDP stuff you need if you want to have a good solution. The web interface is just a plugin. You wouldn't need that. Jan 27, 2014 at 20:34
  • I have to deal with NDPmon more in detail. Can provide some example usage of ndpmon?
    – Oliver G.
    Jan 27, 2014 at 20:51
  • If you run it with the default example config (XML unfortunately) it logs lines like: 'new IP 0:10:db:ff:10:1 2001:9e0:803:0:0:0:0:1#012' Jan 27, 2014 at 21:34
1

Same idea as Sander, different tool ([iproute2][1]'s monitor command)

$ ip -6 monitor all
[ROUTE][NEIGH]fdcc:216f:1d2c::24 dev eth0 lladdr 00:1a:92:7f:ea:3e REACHABLE
...

How to get all reachable routers and nodes at any one time is a bit of a pickle though. The neighbour and route tables go stale quite quickly for a reason, that doesn't mean the hops have disappeared. It's just a convenient way to allow for nodes to appear and disappear at any time without further join/leave messages.

Saying that, you should look into how multicast in general works, at least on some cisco switches (the ones with multicast listener discovery, MLD) you can access the multicast tables directly, so your question rephrases as: who joined the ff0x::1 group.

Theoretically, the linux kernel holds this information too, as can be seen in:

$ ip -6 maddr
inet6 ff02::1:ffeb:ea92
inet6 ff02::1:ff00:16 users 3
inet6 ff02::1

unfortunately I know of no way to list the joiners explicitly.

2
  • I would prefer that approach because on my little M2M Linux boxes the basic ip tool is naturally present. It seems to be possible to process the Output in some further Scripts.
    – Oliver G.
    Jan 27, 2014 at 19:07
  • Not a bad suggestion :) Jan 27, 2014 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .