Join Log in
Score:0
avatar Server

When using port monitoring for packet capture, capture machine gets messed up IPv6 addresses

in flag
Craig McQueen

I'm using the "port monitoring" aka "port mirroring" feature of a managed switch to do Wireshark packet captures of network traffic. The traffic I'm monitoring is on a separate sub-net (a separate VLAN configured on the switch).

I have discovered, in this configuration, the Wireshark machine picks up new IPv6 addresses that are on the monitored sub-net. It makes sense how it's happening—the Wireshark machine is seeing the Router Advertisements of the monitored sub-net. But, this breaks IPv6 comms on the Wireshark machine, because it tries to use these IPv6 addresses that aren't routed properly on its real sub-net, and so IPv6 comms stops working.

The mitigation I've done for now is to disable IPv6 in the router config for the monitored sub-net. That's okay at the moment, because I don't care about IPv6 traffic on the monitored sub-net for the moment. But later I might.

I'm wondering if anyone else has faced this issue, and what other mitigations might be possible.

28
0 + 0
A.B avatar
cl flag
A.B
Disable IPv6 on the receiving interface intended for capture (it might be a virtual interface like vlan, erspan etc.) of the wireshark machine instead? What's its OS?
2
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.