Am 16.09.26 um 05:10 schrieb Vincent Lefevre:
On 2026-09-15 22:07:02 +0200, Marco Moock wrote:
Am 13.09.26 um 00:00 schrieb Vincent Lefevre:
On 2026-09-12 01:09:06 +0700, Max Nikulin wrote:
On 10/09/2026 11:46 pm, Vincent Lefevre wrote:
On 2026-09-10 10:00:16 +0700, Max Nikulin wrote:
On 10/09/2026 6:37 am, Vincent Lefevre wrote:
this is because getaddrinfo returns
only the IPv6 address. This is not a question of precedence.
Do you see any benefits in disabling IPv6 on your machine?
Disabling completely, apparently not. Disabling a part of it, such
as SLAAC, yes, because in the past, some machines on the network
sent fake RA advertising. My main personal machine on the network
just has SLAAC disabled for this reason.
BTW, on this point, disabling SLAAC is a bit complex. I thought that
accept_ra = 0 was sufficient (at least when I added it in 2015), but
it was actually ignored by NetworkManager, for which I had to add
ipv6.dns-priority=-100 in its configuration several months ago.
This doesn't disable SLAAC, but if that mitigates your problem, there is a
major problem - and it is not SLAAC neither IPv6.
I don't know whether this mitigates the problem on this machine.
Then what do you suggest?
Investigating the DNS server issue. As long as this DNS server gives you
errors in cases you expect an answer to a query, it is faulty. Maybe use
another DNS resolver or use your own (BIND can do it rather simple).
Thanks for clearly stating it. I asked, looking at the thread subject, since
host name resolution to IPv6 addresses and IPv6 link configuration are
orthogonal to some degree and it is not immediately obvious.
Note that I was not really complaining about the host name resolution
to IPv6 addresses; but from their error message, I thought that some
utilities (ping, wget...) tried an IPv6 connection without trying
IPv4.
As you refuse to show the output of "ip a", it is not possible to help here.
Perhaps you should read the whole thread. I gave it last week:
The content might changed as you said that router advertisements are
being received by your machine.
Date: Tue, 8 Sep 2026 18:48:17 +0200
From: Vincent Lefevre <[email protected]>
To: [email protected]
Subject: Re: How to prevent programs from using IPv6 by default on a machine
without IPv6 support?
Message-ID: <[email protected]>
nscd is not installed by default in Debian. Please show us the
configuration.
enable-cache hosts yes
positive-time-to-live hosts 3600
negative-time-to-live hosts 20
Ok, that looks fine.
But be aware that if the faulty DNS server gives you back an error, it
will be cached for 20 seconds.
However does libc really performs retry when it gets SERVFAIL, not timeout?
There doesn't seem to be any retry (this would be useless anyway
in my case).
Again, if you are saying that without AAAA query resolver reliably gets IPv4
addresses, it might be an approach. By the way, resolv.conf(5):
options
no-aaaa (since glibc 2.36)
Interesting to know. I'll suggest that to the admin.
Another shitty idea, as this doesn't address the real issue. Just my 2
cents.
So what do you suggest?
Fixing (or let someone else) the faulty DNS server or stop using it at all.
Enabling IPv6 again and check which addresses it assigns and why. If a
bogus machine is there that acts as a router, investigate where it is,
it might be an attacker.
--
Gruß
Marco
Spam bitte an [email protected]
