After my blog post yesterday regarding ndisc_get_neigh() I have made a little discovery that suddenly makes everything make sense.

I was not previously aware that Ethernet supported Multicast by default. When I think about it now it makes a lot of sense but I had previously ignored the possibility up until now.

Anyway the 33:33:00:00:00:01 MAC address that I was seeing reported and was thinking was garbage is actually a multicast address. IPv6 uses 33:33:xx:yy:zz:kk when sending multicast packets, where xx:yy:zz:kk are the lowest 32 bits of the IPv6 address.

This means that the MAC addresses I was getting were obviously correct all the time and now I understand what is going on I can filter out the Multicast packets and act on them separately. This also has the huge advantage of a kernel patch not now being required as I don’t need to use ndisc_get_neigh() any more. I can simply use skb->dst->neighbour->ha from the sk_buff passed to my code from the NETFILTER hook.

A fairly good set of slides explaining the main points of IPv6 multicast can be found here.