Craig McQueen's questions

I'm using the "port monitoring" aka "port mirroring" feature of a managed switch to do Wireshark packet captures of network traffic. The traffic I'm monitoring is on a separate sub-net (a separate VLAN configured on the switch).

I have discovered, in this configuration, the Wireshark machine picks up new IPv6 addresses that are on the monitored sub-net. It makes sense how it's happening—the Wireshark machine is seeing the Router Advertisements of the monitored sub-net. But, this breaks IPv6 comms on the Wireshark machine, because it tries to use these IPv6 addresses that aren't routed properly on its real sub-net, and so IPv6 comms stops working.

The mitigation I've done for now is to disable IPv6 in the router config for the monitored sub-net. That's okay at the moment, because I don't care about IPv6 traffic on the monitored sub-net for the moment. But later I might.

I'm wondering if anyone else has faced this issue, and what other mitigations might be possible.

I have set up some firewall rules using nftables. They include some data counters for some types of traffic that I'm interested to monitor.

Now, I'd like to be able to have an application read those counters, ideally using libnftnl, running as a non-root user. But, initial testing with nft indicates that I can't read nftables counters as a non-root user.

As root:

$ nft list counter my_table my_counter
table ip my_table {
    counter my_counter {
        packets 123 bytes 12345
    }
}

As non-root:

$ nft list counter my_table my_counter
Error: No such file or directory
list counter my_table my_counter
             ^^^^^^^^

Is there some way to read nftables counters as a non-root user? Perhaps if some Linux capabilities is set?

For IPv6, I understand clients may get an address either statelessly using SLAAC, or statefully using DHCPv6 (although I hear Android doesn't support address assignment via DHCPv6).

My question is, for clients that configure their IPv6 address via SLAAC, what is the way for a network to push other network configuration to them? Can they get such configuration through Router Advertisements, or must the network also deploy DHCPv6 for clients to get this extra information (but not get their IPv6 address)? Eg:

• DNS server
  • I hear RFC 6106 - IPv6 Router Advertisement Options for DNS Configuration is intended to provide a way for communicating DNS servers. In practice, do Windows, Linux, Android, iOS clients use RA or DHCPv6 to find IPv6 DNS servers?
• NTP server
  • I have found a draft for NTP advertising through Router Advertisements. But this draft was not accepted, I guess. So do clients need to find an NTP server via DHCPv6?
• SIP server
  • Do clients need to use DHCPv6 option 21 or 22? Is there any Router Advertisement equivalent?
• Vendor-specific protocols
  • DHCPv6 has option 16 and option 17 for vendor-specific information, which could be used by a client to find a vendor-specific server on a network, if the DHCPv6 administrator has configured it. Is there any Router Advertising equivalent?

If DHCPv6 is the only way to get this sort of server info, is it reasonably straight-forward to configure a client to get its address via SLAAC, and then get this extra configuration via DHCPv6?

DHCPv4 allows for custom information to be provided to network devices, using "private-use" options. The IANA registry of DHCP parameters reserves option numbers 224 to 254 for private use.

Does DHCPv6 have an equivalent of DHCPv4's private-use options? I can't see any in the IANA registry of DHCPv6 parameters.

I found a draft Site Specific Options for DHCP for IPv6 which proposes site-specific options, but says they must not be used for vendor-specific options.

One possible usage scenario is, I'm interested in making a network device which can automatically get a server address for a custom IP protocol. So the DHCPv4 private-use option seemed like a possible avenue for the device to request the server address, and the DHCP server to provide it.

IPv4 allocates a whole block of IPv4 loopback addresses, 127.0.0.0/8. IPv6, in contrast, only allocates a single loopback address, ::1.

This seems surprising that IPv6 would be so stingy in its allocation of loopback address(es), since overall it provides a huge increase in address space.

In IPv4 I've found it useful to be able to use multiple loopback addresses. E.g. for certain complex DNS set-ups, I can install two local DNS servers, one on 127.0.0.1:53, and another on 127.0.1.1:53. (It's a bit easier to refer to the different servers using different IP addresses, rather than using non-standard port numbers on a single IP address.) I can't use this strategy on IPv6 with only one loopback address.

What good rationales might there have been for only allocating a single loopback address for IPv6, unlike for IPv4?

I'd like to do an iptables REDIRECT rule in the NAT PREROUTING chain, to redirect connections to port 80 to go to 8080. But I'd like to only do it for input packets (destined for this machine), not forwarded packets (destined for e.g. the Internet).

Is there a way, in rules in the PREROUTING chain, to distinguish packets that are destined for this machine, versus packets that are being forwarded, and handle them differently?

It would be ideal to do this in a way that doesn't require specific interfaces or IP addresses to be enumerated in the rules, because this is less flexible (e.g. if interfaces or IP addresses change, it's more complicated to then need to update iptables rules).