locked
ICMPv6 'Multicast Listener Report' messages are flooding the local network RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    2
    Sign in to vote

    Hi,

    [[I am posting again in English (last was in french), because we do not find any resolution of the problem.]]

    We are deploying many HP EliteOne 800 computers in our company, running Windows 7 SP1 (updated).
    These machines are flooding regularly (one a day) the network with ICMPv6 'Multicast Listener Report' messages (10.000 frames per second, observed from Wireshark), especially when user is leaving sleeping state. Flooding occurs exactly at the same time on machines, but not at a precise given time of day.

    On traces, there is no MLD query request before flooding occurs.

    We spent time to look around documentation and contributions but do not find yet any resolution. We checked running services, firewall rules, logs, but can't yet tell what is the root cause of this behavior.

    We were thinking about CyberLink suite products, installed by default by HP, so removed these, but same behavior.

    Content of message is:

    Internet Control Message Protocol v6
        Type: Multicast Listener Report (131)
        Code: 0
        Checksum: 0x6bb7 [correct]
        Maximum Response Delay [ms]: 0
        Reserved: 0000
        Multicast Address: ff02::fb (ff02::fb)

    Have someone seen the same problem ?
    Regards
    Antoine

    Saturday, February 15, 2014 4:19 PM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    We have no more flooding (none yesterday, none today). Yes Deanjazac, it was a nightmare !

    What we did (probably only one is really necessary but we don't have more time to test):
    - install new driver from HP web site for EliteOne 800, dated 14/01/2014, version 12.10.30.X
    - setup all Wake up options (including Wake On LAN) of Ethernet interface to disabled
    - change Windows Control Panel Power savings options from Optimal HP to Maximum Performance (so machine never goes into hibernate)

    We cross our fingers...

    • Marked as answer by Antoine Davous Friday, February 28, 2014 5:41 PM
    Friday, February 28, 2014 5:32 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Thanks for posting in Microsoft TechNet forums.

    I will try to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

    Thank you for your understanding and support.

    Kate Li
    TechNet Community Support

    Monday, February 17, 2014 8:28 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I would like to know if the issue only occur on one client or more clients. based on our experience, a windows client won't send icmp packts by default, unless some third party application send them.

    please download the netmon for further analysis

    http://www.microsoft.com/en-in/download/details.aspx?id=4865

    Regards,

    Mike

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Tuesday, February 18, 2014 9:02 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    We are having same issue. Brings Gig network to its knees.  I have disable ipv6 by using Microsoft fixit and through GPO. NO HELP SAME ISSUE.  Does not happen everyday but almost everyday and not at same  time.

    Using Wireshark we can id the machines and then reboot them and the storm stops.  SO far only seeing this happen on the HP elitedesk 800 g1 With Intel I217 LM nic adapter.  We are going open another case with HP now that I see some one else is experiencing same issue.

    • Proposed as answer by DEANZAJAC Wednesday, February 26, 2014 11:19 PM
    • Unproposed as answer by DEANZAJAC Wednesday, February 26, 2014 11:20 PM
    Wednesday, February 19, 2014 3:57 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Same hardware running Win8.1, exactly the same symptoms here.  Currently investigating.

    Thursday, February 20, 2014 3:57 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Further info can be found here: http://community.spiceworks.com/topic/422869-dell-optiplex-9020-blasting-icmpv6-multicast-listener-discovery-during-s1-sleep

    I am testing this with the HP hardware.

    Thursday, February 20, 2014 7:59 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks for all answers.

    What I noticed in previous contributions and links is that, the common issue is the NIC adapter model: Intel I217 LM. Could it be a firmware problem ?

    So we are trying following suggestions about power saving options of Ethernet - from the link of previous Peter._.I post.

    Thursday, February 20, 2014 11:23 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    No progress except that, after looking into Intel Communities forum, I found this - which tells that it could be an Intel Ethernet chip problem :

    https://communities.intel.com/message/220048#220048

    I added a contribution on this forum to alert again, and I believe that the more we will do it, it will help Intel to tell what is going on ?

    Maybe Microsoft can help also by alterting or working with Intel about this issue ?

    We need desesperatly to know if there is a fix and what is it - instead of playing around with Windows 7 or driver configuration (disabling IPv6, sleeping state or whatever...).

    Monday, February 24, 2014 2:08 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I believe we have the same issue. We have deployed aprox 40 hp elitedesk 800 g1's fitted with intel I217-LM NICs on to our LAN. We see the same ICMPv6 message in wireshark.

    HP 3rd line desktop support have emailed me today saying they are already working on this with Intel and have made some beta NIC drivers available to us ahead of an official driver release.

    If you don't already have an open support ticket with HP, I would suggest you get one and get it escalated to 3rd line. 

    • Proposed as answer by Tom Schenking Tuesday, June 23, 2015 6:58 PM
    • Unproposed as answer by Tom Schenking Tuesday, June 23, 2015 6:58 PM
    Tuesday, February 25, 2014 9:36 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Finally got updated nic drivers from HP and our problems went away.... what I night mare.
    • Proposed as answer by DEANZAJAC Wednesday, February 26, 2014 11:20 PM
    Wednesday, February 26, 2014 11:18 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    It is what we did yesterday with update from HP released 14/01/2014 (the one on their site for EliteOne 800 dated 14/02/2014 is actually very old probably because of error).

    Deanzajac, can you tell which version of driver ?

    We were 12.6.X and now we are 12.10.30.X.

    Thursday, February 27, 2014 7:18 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    We did use the drivers dated 2/14/2014 but to get them to work we uninstall all intel nic support and then reinstalled. We were running version 12.4.x..  We now are running the older version 12.5.x and have no more imcpv6 chatter.

    Thursday, February 27, 2014 3:49 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Guys,

    Anyone have a link for the Intel Beta driver?  I've gotten CDW involved because they might get a tsunami soon with all the hardware the runs this.  We are using Lenovo M93p's and same issue....I have Lenovo reps on standy for Intel driver so they can rapid release, etc.

    Thanks,

    Friday, February 28, 2014 5:17 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    We have no more flooding (none yesterday, none today). Yes Deanjazac, it was a nightmare !

    What we did (probably only one is really necessary but we don't have more time to test):
    - install new driver from HP web site for EliteOne 800, dated 14/01/2014, version 12.10.30.X
    - setup all Wake up options (including Wake On LAN) of Ethernet interface to disabled
    - change Windows Control Panel Power savings options from Optimal HP to Maximum Performance (so machine never goes into hibernate)

    We cross our fingers...

    • Marked as answer by Antoine Davous Friday, February 28, 2014 5:41 PM
    Friday, February 28, 2014 5:32 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hey Antoine,

    I'm seeing the exact same issue, the one difference is I'm seeing it on the HP z230 SFF Workstation. From looking at other forums on the internet I believe the common factor is the Intel I217-LM network controller. The z230 workstations I'm working with all have the 12.8.33.0 driver which is the latest driver published on the HP website for the z230 workstation. I saw that Intel has a newer version of the driver 12.10.30.0, but I'm hesitant to upgrade to the next version because I want to know what is causing the workstations to begin the multicast storm, I can't reproduce the issue.

    Do you think upgrading to the 12.10.30.0 driver fixed the issue or was it modifying the WoL or Power Settings?

    I do have a case open with HP Elite Support and will update the community if they provide a fix.

    Tuesday, March 11, 2014 1:06 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi dletsinger,

    Thanks for your intervention, your feedback will for sure be useful and we are wainting for it. Good luck.

    Regards,

    Dan

    Dan BAJENARU, MSFT Votez! Appel à la contribution
    TechNet Community Support.LE CONTENU EST FOURNI "TEL QUEL" SANS GARANTIE D'AUCUNE SORTE, EXPLICITE OU IMPLICITE.
    S'il vous plaît n'oubliez pas de "Marquer comme réponse" les réponses qui ont résolu votre problème. C'est une voie commune pour reconnaître ceux qui vous ont aidé, et rend plus facile pour les autres visiteurs de trouver plus tard la résolution.

    Tuesday, March 11, 2014 9:49 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Well, I don't really know in fact ! As you said this is very difficult to reproduce - the best way is to force station to hibernate but we noticed that there should be many stations of identical types in the network for flooding to start...

    Since we have not so much time to experiment, and problem effects are critical, I can't tell anymore what is the precise cause. However, since we did the three actions I mentionned, we do not have anymore flood.

    I would recommend to first disable hibernate. And then, if there is still flooding, install and configure new drivers release as described... (who knows even if it is not a corrupted installation of driver that requires just a reinstall ?)

    Tuesday, March 11, 2014 10:24 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Please try using LAN driver 19.0 release avalable from the Intel support web site. Thanks!


    • Edited by DeepakSahay Wednesday, March 12, 2014 12:30 AM
    Wednesday, March 12, 2014 12:29 AM
  • Question
    Sign in to vote
    3
    Sign in to vote

    Hey all, an update to the investigation.

    HP Elite Support Suggested the following configuration changes to be made to mitigate against the issue.

    1. Turn of IPv6 if is not necessary
    2. Turn of AMT in the BIOS if it is not necessary

    HP has acknowledge that other customers have had the same issue and have attributed it to a bug in the driver for the I217-LM. HP informed me that they are working on qualifying the next version of the Intel NIC driver for the I217 LM and could have it ready by the end of the week. HP support did provide me with a pre-release version of that driver, version 12.11.77.0 (which is newer than the latest one on the version 19.0 driver package Intel site, Intel's driver is version 12.10.30.0).

    As far as root cause goes; it seems to be some sort of contention between the AMT IPv6 Stack and the Windows  IPv6 stack when attempting to respond to IPv6 Network Solicitation requests while the computer is asleep is causing the flood of network solicitation packets on the network. One curios thing I've seen is once this starts happening on one of the computers with the I217-LM network controller it starts happening on all others on the same VLAN.

    More info on IPv6 Neighbor Solicitation can be found here http://technet.microsoft.com/en-us/library/cc781672(v=WS.10).aspx

    Special thanks to HP Elite Support for getting me right though to a high level engineer to discuss the issue.


    • Edited by dletsinger Wednesday, March 12, 2014 1:33 PM
    • Proposed as answer by Kyle Kartan Tuesday, May 13, 2014 7:05 PM
    Wednesday, March 12, 2014 1:32 PM
  • Question
    Sign in to vote
    2
    Sign in to vote

    I also had this same issue with a Lenovo M73 Tiny that has the Intel i217-V network adapter. The drivers on the Lenovo site (v12.10.88 IIRC) did not work and the problem continued.

    However, there is an updated version on the Intel website v12.11.96 (or 19.1) that appears to have fixed the issue.

    Tuesday, May 13, 2014 7:08 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Likewise, we encountered the exact same issue with the exact same hardware. The updated driver from Intel's website (version 19.1) solved the problem.

    -Jon

    Tuesday, June 3, 2014 6:33 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I had exactly the same issues with 180 Lenovo M73 Tiny's, they seem to all send packets that caused 2 of our DELL Md3000i to restart themselves. They sent these packets whilst in sleep mode which was strange in itself, to resolve this we used the drivers from the intel site v12.11.96 (or 19.1) as stated above and not from the lenovo site.

    The issue is now resolved for me but why aren't Lenovo at the very least informing their customers/suppliers.

    Sunday, July 13, 2014 9:35 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I found on another forum: right click NIC, Properties, Power Management, Uncheck all power features, I also disables ipv6. This fixed my problem. I also updated the driver first.
    Monday, August 11, 2014 2:55 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I also had this same issue with a Lenovo M73 Tiny that has the Intel i217-V network adapter. The drivers on the Lenovo site (v12.10.88 IIRC) did not work and the problem continued.

    However, there is an updated version on the Intel website v12.11.96 (or 19.1) that appears to have fixed the issue.

    Thank you for this information.  Exactly what we needed to confirm for our new batch of M73 Tiny causing the multicast flooding issue on our network.

    Also it seems Intel has updated to 19.3.  Lenovo's site is still at v12.11.96 (19.1) version.


    Tuesday, August 26, 2014 8:37 PM
  • Question
    Sign in to vote
    0
    Sign in to vote


    Hi,

    As per your reply,disabling IPv6 did not fix this issue.Can you confirm if we need to give it a try or updating the drivers is the only option that is left to us ?

    We have a location of 17000 computers wherein some new machines moved in causing this issue.After segregating we came to know that we have around 800 such systems in our location.

    I am just trying to figure out a step which is proper and up to mark rather than trying out various suggestions as we have very limited time to resolve this.
    Thursday, October 9, 2014 10:50 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Dear All,

    could you please check if disabling the IPv6 through the micosoft fixit following the link: http://support.microsoft.com/kb/929852

    can fix the problem

    we're trying to push the "disable IPV 6 fixit" to all PCs, since updating the network card cannot be done through SMS and SCCM tools since the last step of installing the network card upate is to disable and renable the NIC, so we cannot know from server side if the update was done successfully.

    Mohamad Ghandour Team Leader IT Support

    Tuesday, October 14, 2014 7:55 AM