Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 19 Jan 2011 03:44:31 +0100
From:      Bernd Walter <ticso@cicely7.cicely.de>
To:        freebsd-net@freebsd.org
Cc:        Bernd Walter <ticso@cicely7.cicely.de>
Subject:   strange netstat -ian output
Message-ID:  <20110119024431.GC39356@cicely7.cicely.de>

next in thread | raw e-mail | index | archive | help
A given interface is configured:
re0: flags=8a43<UP,BROADCAST,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=399b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
        ether 00:01:08:00:79:92
        inet 10.1.1.15 netmask 0xffffff00 broadcast 10.1.1.255
        inet6 fe80::201:8ff:fe00:7992%re0 prefixlen 64 scopeid 0x1 
        inet6 2a02:21e0:16e0:2000::103 prefixlen 64 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active

This is one of the blocks for this interface:
re0    1500 2a02:21e0:16e 2a02:21e0:16e0:20        0     -     -        1     -     -
                          ff02:1::2          (refs: 1)
                          ff02:1::d          (refs: 1)
                          ff02:1::202        (refs: 1)
                          ff02:1::1:ff00:103 (refs: 1)
                          ff01:1::1          (refs: 1)
                          ff02:1::2:6214:d648(refs: 1)
                          ff02:1::1          (refs: 1)
                          ff02:1::1:ff00:7992(refs: 1)

2a02:21e0:16e seems to be the truncated IP.
The first line has 2a02:21e0:16e0:20 - I assume this should say 2a02:21e0:16e0:2000::103,
but it is truncated as well...
Adding -W won't help on truncation.
- ff02:1::2
  is not just truncated - this obviously should be ff02::2.
  This '1' is part of every multicst address listed, although they
  don't belong there.
  By looking at systems with a large number of interfaces I came to the
  conclusion that this is the scope ID, but why is it listed as part
  of the IP?
- ff02:1::d
  beside '1' it's Ok, since I've started pim6dd.
- ff02:1::202
  beside '1' it's Ok - according to IANA it's RPC.
- ff02:1::1:ff00:103
  also beside '1' it is the solicitated address for
  2a02:21e0:16e0:2000::103 so it's otherwise Ok
- ff01:1::1
  again '1' - otherwise Ok
- ff02:1::2:6214:d648
  What's this?
  From watching at the MLD packets I know that it is ff02::2:6214:d648
  and that every host has such a beast on each interface, but each
  host has different 32bit at the end.
  Although the IP says that this would be an IANA assigned address it
  is not listed in:
  http://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xml
- ff02:1::1
  again '1' - otherwise Ok
- ff02:1::1:ff00:7992
  again '1', and it seems to be the solicitated address for a stateless
  configured address - likely fe80::201:8ff:fe00:7992.
  Why is this part of the 2a02:21e0:16e block?

A bit stranger is the part for the link-local address:
re0      1500 fe80:1::201:8 fe80:1::201:8ff:f        0     -     -      759     -     -
                            ff02:1::2          (refs: 1)
                            ff02:1::d          (refs: 1)
                            ff02:1::202        (refs: 1)
                            ff02:1::1:ff00:103 (refs: 1)
                            ff01:1::1          (refs: 1)
                            ff02:1::2:6214:d648(refs: 1)
                            ff02:1::1          (refs: 1)
                            ff02:1::1:ff00:7992(refs: 1)
In this case even the IP is not only truncated, it also has the excessive '1'.
Well - it's a scoped address, but it doesn't belong inside the IP.
And similar to the unicast address it has all solicitated addresses
listed.

-- 
B.Walter <bernd@bwct.de> http://www.bwct.de
Modbus/TCP Ethernet I/O Baugruppen, ARM basierte FreeBSD Rechner uvm.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110119024431.GC39356>