Subject: [72attendees] Rogue 6to4 RA on wireless network

From: Tim Chown <[email-masked]>
Date: Wed, 30 Jul 2008 09:51:21 +0100

Hi,

We still have a rogue RA on the wireless network today, the same one as
yesterday.

The Ethernet source of the RA is an Intel adapter 00:19:d2:7f:a6:52.

The IPv6 source is fe80::6c4e:8ed1:3ad2:4cc4 which might be a Windows
Vista 'randomised' host address.

It's advertising prefix 2002:8281:1394:9:: so has IPv4 addr 130.129.19.148.

It's also offering an fec0:: prefix so is probably running Windows ICS
(perhaps because the system has IPv6 on but is filtering incoming IPv6 RAs
 in the host firewall?)

Anyone got any other clues?

Anything the local ops guys can do? :)

Tim
_______________________________________________
72attendees mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/72attendees

---

From: Marshall Eubanks <[email-masked]>
Date: Wed, 30 Jul 2008 04:53:58 -0400

> It's advertising prefix 2002:8281:1394:9:: so has IPv4 addr  

Figure out what room they are in and go there and try and find them.

Marshall

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 30 Jul 2008 02:04:27 -0700

> The Ethernet source of the RA is an Intel adapter 00:19:d2:7f:a6:52.

this client is now blacklisted.