Educause Security Discussion mailing list archives

Re: Address allocation on the network - DHCP, IPv6 etc.


From: Andrew Daviel <advax () TRIUMF CA>
Date: Fri, 19 Mar 2010 16:42:39 -0700

On Fri, 19 Mar 2010, John Ladwig wrote:

If I might ask, what sort of v6 forum are you looking at?

On two tunnel sites that I've been playing with -
http://gogonet.gogo6.com and https://www.sixxs.net

Most of my questions on the SixXS user forum seem to have been answered
by one of the staff, who is also a code developer.

Robert Kerr writes:
The latest version of ISC DHCP will try to extract the MAC address from
the DUID.

I just had a reply on the ISC mailing list:
  In 4.1.1, we added a -D option, e.g. to send DUID-LL:
    dhclient -6 -DLL
For older clients, you can add this to dhclient6.conf:
    send dhcp6.client-id = concat(00:03:00, hardware);
There isn't a precise analog to the "hardware" keyword in v6, because
the DHCPv6 packet doesn't have a 'chaddr' field, so link-layer
information is lost when a packet passes through a relay.  However, if
you can get the client to send a DUID-LL through either of the above
methods, you can do something like the following in dhcpd6.conf:

host linksys1 {
        host-identifier option dhcp6.client-id
00:03:00:01:00:1d:7e:2d:31:55;
        fixed-address6 2001:0:0:1::400;
}


I also had some advice from sixxs to use arpwatch (IPv4) and ndpmon
(IPv6) to log MAC vs ip address. On each subnet/VLAN I believe.



--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376  (Pacific Time)
Network Security Manager

Current thread: