I have a network, which is not IPv6 routable and each device has self-assigned link-local addresses, but IPv6 connectivity does not operate and it is not configured (neither IP addresses, nor IPv6 DNS, nor routing). It is IPv4-only network. Recently I have noticed that at least one of Windows 7 hosts on a random basis obtains spontaneous IPv6 DNS server with link-local address (always the same), which does not answer nslookup queries. Moreover I have no idea where did it come from and I'm certain I didn't configure it by myself. Reconnecting gets rid of this DNS server for a while. Googling I found that it could be some device advertising itself or the like.

How come windows is setting IPv6 DNS on its own?

How do I identify the device, which is probably misconfigured, leading to this situation?

  • The first device I would look at is the one with that particular IPv6 link local address. – Michael Hampton Apr 28 '18 at 0:17
  • if you exhausted all your terminal tools, maybe a tool like Little Snitch but for windows might work to locate your issue. – fady Apr 28 '18 at 0:46
  • @MichaelHampton That's exactly the reason for my second question. That host does not reply to nslookup queries, and pinging it gives "destination unreachable". Also I capture no packets on my network from that host :( Otherwise I could find it's MAC, find its port on my switches and so on. Although it could be not a misbehaving equipment, but something else. Hmmm... could its MAC be a part of link-local address.. I'll check this. – PF4Public Apr 28 '18 at 20:30
  • Link local address is usually the MAC "inflated" with FFFE in the midle, prefixed with fe80. – Carlos Mendioroz Apr 28 '18 at 20:49
  • This is strange though, because RA (Route advertisements) do not carry DNS info, you would have to ask for it via DHCP. – Carlos Mendioroz Apr 28 '18 at 20:53

If you don't want IPv6, simply disable the IPv6 protocol on your interface (control panel, network, interface settings, interface properties, protocol IPv6, uncheck and save).

But to find which device is it, just look at the neighbor address with "netsh interface ipv6 show neigh" which is the counterpart to "arp -a" in IPv4.

You may try to generate some trafic before (link ping it) and see if ND (node discovery, the IPv6 ARP) finds it.

  • Sorry, but your answer does not explain, why could Windows at a random time set an unrelated IPv6 DNS on its own, which is the first part of my question. Moreover, the question is not about disabling IPv6 as it is a tedious work to do so on a number of hosts, but also what's the point of doing so, why do I fix something which is not broken? – PF4Public May 1 '18 at 10:02
  • When you have DHCP client enabled, as you have in IPv6, DHCP will continue to try to get info from a server if it can not at first, so "random time" seems like the availability of a server in your lan. IPv6 can be a stealth vector in that it comes up w/o being aware of, and plays by different rules. If not using it, from a security standpoint, I would disable it. – Carlos Mendioroz May 1 '18 at 13:40
  • Windows does normally ignore DNS settings in RA announcements and I do not have IPv6 DHCP on my network. So, still, your answer does not explain, why could Windows at a random time set an unrelated IPv6 DNS on its own. Moreover, this DNS is the only setting, which windows is setting, not an IP, not a gateway - only DNS! – PF4Public May 2 '18 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.