All,
In the last week or so, we've started to see a problem on newer PCs with
the Intel AMT/vPro (a kind of inline out-of-band management controller,
for those unfamiliar with it) which now "supports" IPv6... after a fashion.
The specific issues is that under certain as-yet unidentified
conditions, two such machines which are asleep will start to emit MLD
packets at a high rate - >1kpps. This eats a lot of CPU on the attached
router (and can't be great for everything else, either).
The MLD packets must of course be coming from the AMT/vPro stack which
shares the system MAC address (an unwise design decision IMO) and sort
of shares it's IP stack. We've confirmed this by looking at the port
speed, which is 10meg when the machine is asleep (versus 1gig when awake).
It seems that the AMT controllers "goad" each other into emitting the
packets - if you take one offline, the other stops.
The MLD packets are of the form:
2c:44:fd:xx:xx:xx > 33:33:00:01:00:03, ethertype IPv6 (0x86dd), length
86: fe80::2e44:fdff:fexx:xxxx > ff02::1:3: HBH ICMP6, multicast listener
reportmax resp delay: 0 addr: ff02::1:3, length 24
...and alternate from each machine; as above, as if each machine is
induced to emit an MLD packet by seeing the other do it.
Note the v6 LL IP is a mutated form of EUI-64 (locally-assigned bit
toggled?)
Has anyone seen anything like this?
Cheers,
Phil
In the last week or so, we've started to see a problem on newer PCs with
the Intel AMT/vPro (a kind of inline out-of-band management controller,
for those unfamiliar with it) which now "supports" IPv6... after a fashion.
The specific issues is that under certain as-yet unidentified
conditions, two such machines which are asleep will start to emit MLD
packets at a high rate - >1kpps. This eats a lot of CPU on the attached
router (and can't be great for everything else, either).
The MLD packets must of course be coming from the AMT/vPro stack which
shares the system MAC address (an unwise design decision IMO) and sort
of shares it's IP stack. We've confirmed this by looking at the port
speed, which is 10meg when the machine is asleep (versus 1gig when awake).
It seems that the AMT controllers "goad" each other into emitting the
packets - if you take one offline, the other stops.
The MLD packets are of the form:
2c:44:fd:xx:xx:xx > 33:33:00:01:00:03, ethertype IPv6 (0x86dd), length
86: fe80::2e44:fdff:fexx:xxxx > ff02::1:3: HBH ICMP6, multicast listener
reportmax resp delay: 0 addr: ff02::1:3, length 24
...and alternate from each machine; as above, as if each machine is
induced to emit an MLD packet by seeing the other do it.
Note the v6 LL IP is a mutated form of EUI-64 (locally-assigned bit
toggled?)
Has anyone seen anything like this?
Cheers,
Phil