ntpd sending IPv6 packets with source link-local, destination global?

psycroptic · 02-08-2015, 01:36 AM

Noticed this in a packet dump recently on a Linux server on my LAN:

Code:

01:32:01.210795 IP6 fe80::20d:b9ff:fe33:198.123 > 2600:3c03::13:3123.123: UDP, length 48
01:32:01.211626 IP6 fe80::618:d6ff:fea1:dd3 > fe80::20d:b9ff:fe33:198: ICMP6, destination unreachable, beyond scope 2600:3c03::13:3123, source address fe80::20d:b9ff:fe33:198, length 104

It is ntpd attempting to contact the NTP server at 2600:3c03::13:3123, but using a source address of the interface's link-local. The router (at fe80::618:d6ff:fea1:dd3) then responds saying that it is (obviously) beyond the scope.

Why would this happen?

Ser Olmy · 02-08-2015, 05:58 PM

Does the system running ntpd have a public IPv6 address and a valid gateway entry in the routing table? If so, is ntpd actually bound to the "[Public_IPv6]/UDP/123" socket?

psycroptic · 02-08-2015, 07:39 PM

Quote:

Originally Posted by Ser Olmy

is ntpd actually bound to the "[Public_IPv6]/UDP/123" socket?

This was the problem; it was listening on the link-local (since i never intended for it to accept incoming requests on a global address), but i didn't realize that doing this would also restrict its outgoing traffic. Changed "interface listen fe80::/64" to "interface listen ::/64" and all is well.

Thanks