How to prevent kernel to reply neighbor solicitation

Sunil Pradhan · 04-05-2012, 09:00 AM

Hi,

Need to know if is there any flag in "/proc/sys/net/ipv6/conf/<if-name>" which will prevent kernel to respond to the incoming "neighbor solicitation" message.
Or is there any other method to do so?

For IPv4: I set "/proc/sys/net/ipv4/<if-name>/arp_ignore" value to 8. This makes kernel not to reply incoming ARP requests.

I'm in desparate need of this answer.

Cheers,
Sunil

malekmustaq · 04-06-2012, 03:44 AM

Quote:

Or is there any other method to do so?

What about dropping all UDP packets silently?

Sunil Pradhan · 04-06-2012, 05:53 AM

Thank you, malekmustaq.

Ignoring UDP packet might not work for my scenario.
Actually, I want to dynamically (depending on some condition which I shall pass to kernel using ioctl) block the neighbor advertisement from kernel and want it to be sent from my application program. This has to be on "per network port" basis. So, this shouldn't affect Neighbor Solicitation/Advertisement on other network ports of the machine.

Cheers,
Sunil

credzba · 12-15-2012, 11:19 AM

Quote:

Originally Posted by Sunil Pradhan

Thank you, malekmustaq.

Ignoring UDP packet might not work for my scenario.
Actually, I want to dynamically (depending on some condition which I shall pass to kernel using ioctl) block the neighbor advertisement from kernel and want it to be sent from my application program. This has to be on "per network port" basis. So, this shouldn't affect Neighbor Solicitation/Advertisement on other network ports of the machine.

Cheers,
Sunil

Sunil,
Did you find an acceptable answer?

I found I could do what your asking with netfilter, I created an ip6tables entry that routed the network solicitation to a userspace queue, then I wrote a program to control which packets I allowed through.
You could also write a rule to just drop all the NS packets if you wanted to.

I would still like to find a better way to tell an interface to just ignore all neighbor solicitations, but ip6tables is one way you could solve your problem.