I recently noticed that 3 out of 4 Unifi APs kept reaching 100% CPU usage. When I jumped onto the networks and took a Wireshark capture I noticed 1000s of these packets being sent in just a matter of a few seconds.
11.013029000 fe80::ca5b:76ff:fe64:143a ff02::1:ff76:6414 ICMPv6 86 Multicast Listener Report Internet Protocol Version 6, Src: fe80::ca5b:76ff:fe64:143a (fe80::ca5b:76ff:fe64:143a), Dst: ff02::1:ff76:6414 (ff02::1:ff76:6414) Payload length: 32 Next header: IPv6 hop-by-hop option (0) Hop limit: 1 Source: fe80::ca5b:76ff:fe64:143a (fe80::ca5b:76ff:fe64:143a) Source SA MAC: c8:5b:76:64:14:3a (c8:5b:76:64:14:3a) Destination: ff02::1:ff76:6414 (ff02::1:ff76:6414) Source GeoIP: Unknown Destination GeoIP: Unknown Hop-by-Hop Option Next header: ICMPv6 (58) Length: 0 (8 bytes) IPv6 Option (Router Alert) Type: Router Alert (5) Length: 2 Router Alert: MLD (0) IPv6 Option (PadN) Type: PadN (1) Length: 0 PadN: <MISSING> Internet Control Message Protocol v6 Type: Multicast Listener Report (131) Code: 0 Checksum: 0x6513 [correct] Maximum Response Delay [ms]: 0 Reserved: 0000 Multicast Address: ff02::1:ff76:6414 (ff02::1:ff76:6414)
I can't ping or resolve either the source or the destination IPv6. I've tried running:
arp -a | findstr <MAC>
To see if I even have the MACs in my arp cache but I get nothing. I've wandered all around the office connecting to each of the APs specifically running the same commands.
I've read that these messages could be the result of a dying NIC. But I'm not sure how to verify/validate that or where to even start now.
Has anyone ever seen this behaviour before and resolved it? What are these messages, and how do I mitigate them? I'm very fascinated by this but also I'd like my APs to stop crashing! :P