Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Today I was using tcpdump and I noticed my computer was having IPv6 traffic with a particular MAC address that I could not match with an IP using nmap or arping. After looking at the tcpdump logs a little more closely, I figured out it was another MAC address my router was using but exclusively for IPv6 traffic.

22:49:01.936830 90:0d:cb:ff:31:91 (oui Unknown) > 33:33:00:00:00:01 (oui Unknown), ethertype IPv6 (0x86dd), length 158: fe80::920d:cbff:feff:3191 > ip6-allnodes: ICMP6, router advertisement, length 104

Why would a router offer a different MAC address for IPv6?

share|improve this question
    
Is this a laptop? –  MariusMatutiae Jun 4 at 5:15
    
I am using a laptop –  user329161 Jun 4 at 22:33
    
Which of the two MAC addresses here is the "particular" one you are asking for? 90:0d:cb:ff:31:91 is a MAC from a device manufactured by ARRIS Group Inc.; 33:33:00:00:00:01 is a link layer multicast address. –  Dubu Jun 5 at 11:36
add comment

1 Answer 1

up vote 9 down vote accepted

It is the consequence of a privacy/security concern. In IPv6, under Stateless Address Autoconfiguration ADDRCONF, a node generates its own public address without any need of a DHCP server. The lower 64 bits of that address are generated from an IEEE identifier, when available, which is the equivalent of the layer-2 MAC address. If this were the whole story, then it would be possible to follow the location and communication of any mobile device by means of the lower 64 bits of an IPv6 address, by employing conventional data mining techniques.

This is why I asked you whether you are seeing this on a laptop.

This privacy/security concern is addressed by RFC 3041 and RFC4941, which describe two strategies to generate a randomized interface identifier (in the presence or absence of permanent storage).

You can control this feature in Linux and Mac with the following controls: in Linux,

sysctl net.ipv6.conf.all.use_tempaddr=2
sysctl net.ipv6.conf.default.use_tempaddr=2
sysctl net.ipv6.conf.all.eth0_tempaddr=2

and so on, in Mac

sysctl -w net.inet6.ip6.use_tempaddr=1

The advantage of this scheme is that it not only hides your hardware identification, it also changes the (random) identification quite often and automatically.

For more info about Privacy Addressing in most OSes, one may read this excellent PSU page.

EDIT:

some systems, like Arch Linux, have already moved on to a new configuration for sysctl. In that case, you may perform the configuration above by changing, in the file /etc/sysctl.d/40-ipv6.conf, the following entries to these values:

 net.ipv6.conf.all.use_tempaddr = 2
 net.ipv6.conf.default.use_tempaddr = 2
 net.ipv6.conf.eth0.use_tempaddr = 2

EDIT 2:

@slubman correctly points out that in Linuxes, the correct option to use is 2, not 1 (which is what I have on my Debian), because 1 does allow the generation of privacy addresses but keeps Autoconf as prefered.

share|improve this answer
1  
Luckily for you I am bi-lingual in both Linux an Windows. From an administrative command prompt: netsh interface ipv6 set privacy enabled. See this link for more details on other settings in set privacy other than just enabling and disabling it. (BTW, the machine I checked this on had it enabled by default) –  Scott Chamberlain Jun 4 at 6:18
    
@ScottChamberlain Thank you! –  MariusMatutiae Jun 4 at 6:21
    
AFAIK, on Linux to actually use the privacy addresses by default, you must set the use_tempaddr values to 2. You can find more information by searching for use_tempaddr there: kernel.org/doc/Documentation/networking/ip-sysctl.txt –  slubman Jun 4 at 7:28
    
@slubman You are right,I was confused by the fact that the laptop from which I am writing this has no IEEE identifier, lol. –  MariusMatutiae Jun 4 at 7:57
    
Maybe I'm missing something here, but where does a privacy address appear in the question? I only see one IPv6 address (fe80::920d:cbff:feff:3191) that is a normal, EUI-64 derived link-local address that perfectly matches the MAC address (90:0d:cb:ff:31:91). The only other MAC address is the link layer multicast 33:33:00:00:00:01 for the ip6-allnodes address. What should that have to do with privacy extensions? –  Dubu Jun 5 at 11:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.