My device is constantly asking for _gateway in neighbor solicitation:
$ sudo tcpdump icmp6
14:53:04.736106 IP6 redacted > redacted: ICMP6, neighbor solicitation, who has _gateway, length 32
...
_gateway is a synthetic answer generated by systemd, I thought it shouldn’t go on the network?
How to find out who is asking for it?
IPv6 is quite chatty, and sending ICMPv6 Neighbor Solicitation messages periodically is normal.
It’s just tcpdump resolves the IP address using nss-myhostname:
getent -s myhostname hosts _gateway
It’s the kernel’s network stack since ICMPv6 is essential part of IPv6.
I think the problem was not me, but that the gateway didn’t answer, which caused the device to repeatedly ask.
Yes _gateway is just tcpdump resolving hostnames, $ sudo tcpdump -n icmp6 to not resolve names.
Normally it should be:
00:50:55.920255 IP6 fe80::4024 > fe80::6: ICMP6, neighbor solicitation, who has fe80::6, length 32
00:50:55.922774 IP6 fe80::6 > fe80::4024: ICMP6, neighbor advertisement, tgt is fe80::6, length 32
Lots of weird things happen at night, and gone by day…
EDIT:
It seems that the addresses in the flood were not mine, probably why gateway didn’t answer. Not sure why I’m seeing them…