ICMPv6 ‘Multicast Listener Report’ flooding the network

Today I had a very big network problem! Since 4 o’clock a customer told us, that the network printers aren’t available and a wireless link to another location can’t be used anymore. I watched at the PRTG monitoring software and the network-ports from the HP switches were at high load/traffic:

and this was on every network port! So I started wireshark for sniffing. I got about 30,000 ICMPv6 Multicast packets (so also on every network port). Unfortunately it was VLAN1, the main-vlan for all computers, printers and servers -.- the calculated packets per second combined on all network ports results in 8,640,000 packets per second processed by the switches…

With the wirshark protocoll I could see that the multicast-pakets (“Multicast Listener Report”) were send from HP devices:

You can also check the vendor on this site (thanks to Jason). This three devices are HP Z-Workstations. There are same problems also reported with HP EliteOne 800 and Lenovo computers. So what is causing this big problem? It’s the Intel AMT (Active Management Technology), this interface is giving you (for example; one of some features) the possibility to administrate this device remotely with VNC. Anyway, there is a bug in a specific driver/firmware. You have even the problems with PCs that are in the sleep-mode. What is the solution of this?

• Deactivate Intel AMT in the BIOS
• Deactivate IPv6 in the Windows OS
• Install the latest drivers for the Intel network card

After doing this respectively unlink this devices, everything was working again! No multicasts, network printers are working and the wireless link was working immediately. I hope I can help some people with this.

Have a great weak! :)