On Tue, Feb 24, 2026 at 06:48:56PM +0100, Renaud Allard wrote: > > > On 24/02/2026 17:18, Matthieu Herrb wrote: > > Thanks for the reactivity. with 0.3.3, I still have some 'moved' alerts > > from > > an IPv6 routable address to a Link Local one, and some 'moved' alerts > > from an IPv4 routable address to a IPv6 Link Local one. > > > > Also for one misconfigured machine which uses temporary IPv6 addresses > > I got 'new station' messages for each new temporary address. I don't > > know if this is by design or not. Our policy is to forbid this > > kind of obfuscation on that network segment, so I'd rather get a > > 'moved' notification in this case. > > > > Try out 0.3.5. > Here are the scenarii I thought for it. > > Scenario 1: SLAAC address appears first > > - MAC M seen at 2001:db8::a8bb:ccff:fedd:eeff (EUI-64 derived) > > - temp_rotate: is_eui64() returns true -> temp_rotate = 0 > > - Result: "new station" + email. Correct. > > > Scenario 2: First temporary address in same /64 > > - MAC M already has SLAAC 2001:db8::eui64 in DB > > - MAC M seen at 2001:db8::rand1 (not EUI-64) > > - temp_rotate: not link-local, not EUI-64, calls db_has_temp_in_prefix(M, > 2001:db8::rand1) > > - DB scan: finds 2001:db8::eui64 -> same /64, not same IP, not link-local, > IS EUI-64 -> skipped > > - No non-EUI-64 match -> returns 0 -> temp_rotate = 0 > > - Result: "new station" + email. Correct (first temporary). > > > Scenario 3: Second temporary address (rotation) > > - MAC M has SLAAC 2001:db8::eui64 and temp 2001:db8::rand1 in DB > > - MAC M seen at 2001:db8::rand2 (not EUI-64) > > - db_has_temp_in_prefix: finds 2001:db8::eui64 -> EUI-64 -> skipped. Finds > 2001:db8::rand1 -> same /64, not same IP, not link-local, not EUI-64 -> > returns 1 > - temp_rotate = 1 > > - Result: "new temporary" (log only, no email). Probes scheduled for old > IPs -> old temp times out -> "moved" email. Correct. > > > Scenario 4: Regular IPv4 new station > > - af == AF_INET -> temp_rotate = 0 > > - Result: normal "new station". No regression. > > > Scenario 5: Regular IPv6 new station (different /64) > > - MAC M has 2001:db8:1::rand1 in DB > > - MAC M seen at 2001:db8:2::rand2 (different /64) > > - db_has_temp_in_prefix: prefix 2001:db8:2 doesn't match 2001:db8:1 -> > returns 0 > > - Result: "new station" + email. Correct. > > > Scenario 6: Link-local IPv6 > > - ip[0] == 0xfe && (ip[1] & 0xc0) == 0x80 -> temp_rotate = 0 > > - Result: normal "new station" (link-local probing already suppressed > separately). No regression.
Thanks. I've upgraded to version 0.3.5 and restarted it with an empty database. I'll let you know tomorrow how it goes. -- Matthieu Herrb
