How to track down IPv6 DNS server configuration with Wireshark?

dunxd

12/18/23, 1:17 PM

What Wireshark filter should I use to track down IPv6 DNS server advertisements on the network? I don't see any DHCPv6 traffic on my network, so I assume that the config of clients is happening through Router Advertisements.

However, when I use the following filter ((icmpv6.type == 134 ) || dhcpv6)to look at all Router Advertisements and DHCPv6 messages in Wireshark, I can see my preferred DNS server advertising itself via Router advertisements.

ICMPv6 Option (Recursive DNS Server DNS:Server:Address)
    Type: Recursive DNS Server (25)
    Length: 3 (24 bytes)
    Reserved
    Lifetime: 118
    Recursive DNS Servers: DNS:Server:Address

My router sends Router Advertisments as well, but there isn't any RDNSS content in those messages. There are some DHCPv6 messages, but they are only requests sent by clients.

I see clients configured with a different DNS server (my routers address) in addition to my preferred DNS server and I am scratching my head as to where they are getting that setting.

Where else might I look for DNSv6 advertisements?

266

1 + 4

domain-name-system

ipv6

wireshark

TomTom

12/18/23, 3:33 PM

There is by logic no DHCP v6. DHCP is going PRE IP - so it can not use IP as carrier. All that, btw., is doumented - i.e. https://en.wikiversity.org/wiki/Wireshark/DHCP as an idea.

vidarlo

12/18/23, 3:52 PM

@TomTom to say that there's no [DHCPv6](https://en.wikipedia.org/wiki/DHCPv6) is *misleading*. It's a protocol *very* distinct from traditional DHCP as used for IPv4, including different port numbers. In addition, DHCPv6 uses IPv6 to communicate, as part of IPv6 is the unique link local addresses. Those are configured automatically and then used for DHCPv6 communication. In general: forget all you know about IPv4 when it comes to IPv6. It doesn't apply anymore.

dunxd

12/19/23, 7:32 PM

The folks who make wireshark included a filter for `dhcpv6` but I guess they don't know so much...

dunxd

12/19/23, 7:35 PM

Hmm, I noticed that the router sends a DHCPV6 packet very occasionally (like once an hour) advertising itself as the DNS server, despite this function being turned off. Clients that are powered on at the time will add it to their resolver. Bug in the router firmware. Time for a new router.

Score:2

Server

vidarlo

12/18/23, 3:49 PM

This is normally part of the RA messages:

This should be sent by the host sending Router Announcement messages, and you should probably configure the mechanism used for sending RA's with the appropriate DNS server.

If no such message is configured, your hosts probably either have statically defined IPv6 DNS servers, or are not using DNS on IPv6.

+ 2

dunxd

12/19/23, 7:37 PM

Thanks. My DNS server sends these, and clients are recieving them. Problem is defective router sending DHCPV6 announcements once an hour advertising itself as DNS server even though it is configured not to.

vidarlo

12/19/23, 8:06 PM

Then I guess you're out of luck. Fix your router is probably the only real option...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to track down IPv6 DNS server configuration with Wireshark?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.