Am 17.09.26 um 18:30 schrieb Vincent Lefevre:
On 2026-09-16 11:43:35 +0200, Marco Moock wrote:
Am 16.09.26 um 05:00 schrieb Vincent Lefevre:
I just know that misconfigured devices are found on the network.
They need to be removed, as they disturb any other device.
They can also be used for MITM attacks.
You definitely do not want such machines in your productive network.
This is a network where everyone can plug their own machine.
Certain manages switches offer an option to implement an ACL for
machines allowed to do DHCP and RA. Implement such a ruleset whenever
possible.
Even though it is not allowed to disturb the network, this
happens, most often due to Apple crap.
Please explain which apple devices send RA without explicitly
configuring that.
There is a serious problem with nscd, as already said.
I have doubt. If nscd caches a negative response (from the faulty DNS), it
will not try again until the cache expired. Works as intended.
No, this is *not* a negative response, but a *temporary* failure.
FYI, without nscd, the gai_strerror error message from getaddrinfo
is "Temporary failure in name resolution".
^^^^^^^^^^^^^^^^^
This is not expected to be cached for a long time (due to nscd,
I got errors for hours, even though temporary failure actually
lasted for 1 second or so).
Disabling IPv6 is a dead-end street.
I don't see why. IPv6 is not supported on the network, so there
are no drawbacks in disabling it for hostname resolution. And if
it were supported, then there wouldn't have been any major issue
with nscd.
You do not try to solve the real issue,
This is a workaround mainly due to a nscd bug.
which will affect other machines too. That is your big problem.
I don't see how this could affect other machines. What do you mean?
The faulty DNS and the rogue RAs.
--
Gruß
Marco
Spam bitte an [email protected]
