Hello,
I've been experiencing a strange problem related to my probe for several
years.
My internet service is GPON, offering 940 Mbps up and down. The service is
provided via a Nokia G-240G-A ONT. My router is pfSense. My probe is
connected to the LAN side of my router.
For the past 3 years or so, there have been approximately 1000 log messages
per day which look like the following:
Aug 5 20:10:28 kernel cannot forward src fe80:5::2a0:a50f:fc7b:1051, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:24 kernel cannot forward src fe80:5::2a0:a50f:fc7b:1051, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:20 kernel cannot forward src fe80:5::2a0:a50f:fc7b:1051, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:16 kernel cannot forward src fe80:5::6c36:84ff:fedf:e9ee, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:12 kernel cannot forward src fe80:5::6c36:84ff:fedf:e9ee, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:08 kernel cannot forward src fe80:5::6c36:84ff:fedf:e9ee, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:04 kernel cannot forward src fe80:5::203d:3ff:fe5b:d589, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:10:00 kernel cannot forward src fe80:5::203d:3ff:fe5b:d589, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
Aug 5 20:09:56 kernel cannot forward src fe80:5::203d:3ff:fe5b:d589, dst
2001:569:5b86:b500:1:b3ff:fedd:9f24, nxt 58, rcvif hn0, outif hn1
The destination address belongs to my probe.
For a while I wondered what caused the "5" in the fe80:5::* link-local
address, but apparently, FreeBSD, on which pfSense is based, inserts it to
denote that the link-local address is associated with the WAN interface.
You can see that the messages are periodic, occurring every 4 seconds. The
addresses are not random. They repeat. I presume that the multiple
addresses indicate multiple measurements associated with my probe.
I connected Wireshark to the WAN interface and verified the packets are
present, but without the "5".
The problem is not that pfSense is logging these messages. It's behaving
properly.
I'm wondering why the messages have a link-local source address. The only
explanation is that the ISP router is converting routable GUA addresses to
non-routable link-local addresses, otherwise, the packets could not have
been routed to my probe. Since these packets are arriving at my router,
this conversion must be happening in the ISP router at the other end of the
fibre.
I'm wondering if there is any way to get a log of the measurements being
run against my probe. If I could see that the messages in my log correspond
to measurements against my probe, I could provide that information to my
ISP to diagnose the cause.
I'm interested to hear if anyone thinks this analysis is correct or if
there is another explanation.
Regards.
