ICMPv6 ‘Multicast Listener Report’ flooding the network

Today I had a very big network problem! Since 4 o’clock a customer told us, that the network printers aren’t available and a wireless link to another location can’t be used anymore. I watched at the PRTG monitoring software and the network-ports from the HP switches were at high load/traffic:

prtg-switch-graph

 

and this was on every network port! So I started wireshark for sniffing. I got about 30,000 ICMPv6 Multicast packets (so also on every network port). Unfortunately it was VLAN1, the main-vlan for all computers, printers and servers -.- the calculated packets per second combined on all network ports results in 8,640,000 packets per second processed by the switches…

With the wirshark protocoll I could see that the multicast-pakets (“Multicast Listener Report”) were send from HP devices:

ipv6multicast

You can also check the vendor on this site (thanks to Jason). This three devices are HP Z-Workstations. There are same problems also reported with HP EliteOne 800 and Lenovo computers. So what is causing this big problem? It’s the Intel AMT (Active Management Technology), this interface is giving you (for example; one of some features) the possibility to administrate this device remotely with VNC. Anyway, there is a bug in a specific driver/firmware. You have even the problems with PCs that are in the sleep-mode. What is the solution of this?

  • Deactivate Intel AMT in the BIOS
  • Deactivate IPv6 in the Windows OS
  • Install the latest drivers for the Intel network card

After doing this respectively unlink this devices, everything was working again! No multicasts, network printers are working and the wireless link was working immediately. I hope I can help some people with this.

 

Have a great weak! 🙂

4 thoughts on “ICMPv6 ‘Multicast Listener Report’ flooding the network”

  1. Thank you very much .
    My customer was also caused the same symptoms .
    PC of the problem is the HP DeskPro 600 G1.
    I was very hard to determine the cause .
    This problem is I think there is a need to more public.
    In the Japanese of my native language , it was not able to obtain this information .

  2. HI
    thanks for your article, I had the exact same problem and I solved. It was a PC with IPV6 active and standby gave freak
    Thanks for share !!!!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.