Why would my router have different MAC addresses for IP and IPv6 transactions?

Question

Today I was using tcpdump and I noticed my computer was having IPv6 traffic with a particular MAC address that I could not match with an IP using nmap or arping. After looking at the tcpdump logs a little more closely, I figured out it was another MAC address my router was using but exclusively for IPv6 traffic.

22:49:01.936830 90:0d:cb:ff:31:91 (oui Unknown) > 33:33:00:00:00:01 (oui Unknown), ethertype IPv6 (0x86dd), length 158: fe80::920d:cbff:feff:3191 > ip6-allnodes: ICMP6, router advertisement, length 104

Why would a router offer a different MAC address for IPv6?

Answer 1

It is the consequence of a privacy/security concern. In IPv6, under Stateless Address Autoconfiguration ADDRCONF, a node generates its own public address without any need of a DHCP server. The lower 64 bits of that address are generated from an IEEE identifier, when available, which is the equivalent of the layer-2 MAC address. If this were the whole story, then it would be possible to follow the location and communication of any mobile device by means of the lower 64 bits of an IPv6 address, by employing conventional data mining techniques.

This is why I asked you whether you are seeing this on a laptop.

This privacy/security concern is addressed by RFC 3041 and RFC4941, which describe two strategies to generate a randomized interface identifier (in the presence or absence of permanent storage).

You can control this feature in Linux and Mac with the following controls: in Linux,

sysctl net.ipv6.conf.all.use_tempaddr=2
sysctl net.ipv6.conf.default.use_tempaddr=2
sysctl net.ipv6.conf.eth0.use_tempaddr=2

and so on, in Mac

sysctl -w net.inet6.ip6.use_tempaddr=1

The advantage of this scheme is that it not only hides your hardware identification, it also changes the (random) identification quite often and automatically.

For more info about Privacy Addressing in most OSes, one may read this excellent PSU page.

EDIT:

some systems, like Arch Linux, have already moved on to a new configuration for sysctl. In that case, you may perform the configuration above by changing, in the file /etc/sysctl.d/40-ipv6.conf, the following entries to these values:

 net.ipv6.conf.all.use_tempaddr = 2
 net.ipv6.conf.default.use_tempaddr = 2
 net.ipv6.conf.eth0.use_tempaddr = 2

EDIT 2:

@slubman correctly points out that in Linuxes, the correct option to use is 2, not 1 (which is what I have on my Debian), because 1 does allow the generation of privacy addresses but keeps Autoconf as prefered.