<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
On 14 Aug 2023, at 09:14, Sebastian Johansson <steamruler@gmail.com> wrote:<br>
<div>
<blockquote type="cite"><br class="Apple-interchange-newline">
<div>
<div>[You don't often get email from steamruler@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]<br>
<br>
Is hn0 the LAN or WAN side? AFAIK it's correct that it shouldn't<br>
forward packets from link local addresses, so I'd honestly just<br>
suppress the log message and leave it at that.<br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Maybe it’s to an internal system. </div>
<div><br>
</div>
But it would be good to find out why those messages happen. That format of link local address is very unusual to see and contravenes RFC 4291 (see
<a href="https://www.rfc-editor.org/rfc/rfc4291#page-11">https://www.rfc-editor.org/rfc/rfc4291#page-11</a>). </div>
<div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">If the node really wants to talk to the </span><a href="http://ipv6.telus.net">ipv6.telus.net</a><font color="#000000"> system on 2001:569:585f:b00:1:b3ff:fedd:9f24, it needs to have and use
a global scope address. RFC 6724 prefers matched scope of addresses, because the destination can’t reply unless it happens to be on the same link as the sender.</font></div>
<div><br>
</div>
<div>The standards now say the host past of the address should not be a MAC address, see RFC 7217 and other RFCs recommending its use. </div>
<div><br>
</div>
<div>Tim</div>
<div><br>
<blockquote type="cite">
<div>
<div>On Mon, Aug 14, 2023 at 4:37 AM Daryl Morse <daryl_morse@telus.net> wrote:<br>
<blockquote type="cite"><br>
I've been hosting an Atlas probe since February 2019. I have native dual-stack gigabit fibre internet service and my router is pfSense. Recently, I noticed that there are hundreds of messages in the log of the router like the following:<br>
<br>
Aug 12 22:38:54 kernel cannot forward src fe80:5::1cce:5fff:fe02:61b6, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 22:36:06 kernel cannot forward src fe80:5::e65d:370f:fc45:b5ba, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 22:11:31 kernel cannot forward src fe80:5::3c01:20ff:fee5:f601, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 17:45:08 kernel cannot forward src fe80:5::2a0:a50f:fcdb:db7c, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 15:47:09 kernel cannot forward src fe80:5::2a0:a50f:fcb9:c28e, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 08:13:04 kernel cannot forward src fe80:5::2a0:a50f:fc8a:8134, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 06:55:33 kernel cannot forward src fe80:5::bac2:530f:fc39:164a, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 03:39:05 kernel cannot forward src fe80:5::2a0:a50f:fc8a:85c0, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 01:17:54 kernel cannot forward src fe80:5::e6fc:820f:fcea:2016, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 12 00:55:09 kernel cannot forward src fe80:5::ee9e:cd0f:fc0d:79d4, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 11 15:47:11 kernel cannot forward src fe80:5::4271:830f:fce5:7fa, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 11 15:25:42 kernel cannot forward src fe80:5::bac2:530f:fcd4:fdd2, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 11 07:33:53 kernel cannot forward src fe80:5::cd08:c204:cc63:2d32, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 11 06:17:19 kernel cannot forward src fe80:5::fe33:420f:fcdc:5932, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 11 04:49:00 kernel cannot forward src fe80:5::7e25:860f:fc44:6742, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 22:41:25 kernel cannot forward src fe80:5::9ca0:15ff:fe87:842e, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 14:38:59 kernel cannot forward src fe80:5::c80a:daff:fe92:b8b7, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 10:55:07 kernel cannot forward src fe80:5::2a0:a50f:fc8a:6ea0, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 08:57:19 kernel cannot forward src fe80:5::46aa:500f:fceb:ad66, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 05:47:09 kernel cannot forward src fe80:5::b68a:5f0f:fcb2:1040, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 03:24:58 kernel cannot forward src fe80:5::2a0:a50f:fcb6:5ea2, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 03:08:55 kernel cannot forward src fe80:5::2a0:a50f:fc90:9d4, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 00:17:07 kernel cannot forward src fe80:5::e65d:370f:fc44:15ba, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
Aug 10 00:07:07 kernel cannot forward src fe80:5::2a0:a50f:fcb7:7c, dst 2001:569:585f:b00:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1<br>
<br>
The messages occur in groups of three, spaced a few seconds apart.<br>
<br>
All of the messages start with fe80:5. Even if I strip off the "5", none of them seem to convert into MAC addresses, so I can't use that to figure out what type of device is pinging the probe.<br>
<br>
There are no entries in the NDP table corresponding to these messages.<br>
<br>
I have no idea how long this has been happening. I only noticed it when I was setting up a new server to host pfsense.<br>
<br>
My probe is RIPE-Atlas-Probe-52209.<br>
<br>
I'm interested to know if anyone else has experienced this.<br>
--<br>
ripe-atlas mailing list<br>
ripe-atlas@ripe.net<br>
https://mailman.ripe.net/<br>
</blockquote>
<br>
--<br>
ripe-atlas mailing list<br>
ripe-atlas@ripe.net<br>
https://mailman.ripe.net/<br>
</div>
</div>
</blockquote>
</div>
<br>
</body>
</html>