IPv6 Tools on RouterOS

What it is

RouterOS includes tools that test reachability, trace paths and show live traffic, and most of them accept IPv6 addresses.

You use the same tool names as for IPv4. You give an IPv6 address as the target, or an IPv6 filter in the tool settings. A few tools need extra care for link local addresses.

The tools help you answer three questions: is the address reachable, which path does the packet take, and what is actually on the wire?

How it works

Start with the simplest tool, and move to deeper tools only when needed.

Ping

Ping sends ICMPv6 Echo Requests, which are type 128, and waits for Echo Replies, which are type 129.

/ping 2001:db8:2::1 count=4
/ping address=fe80::1 interface=ether1 count=4

The first command pings a global address. The second pings a link local address. A link local address exists on every link, so you must also say which interface to use with the interface parameter.

If ping to a global address works but ping to a name fails, the fault is in DNS. If both fail, look at routes and the firewall.

Traceroute

Traceroute shows each router on the path. It sends packets with a rising hop limit, and each router that drops one replies with an ICMPv6 Time Exceeded message.

/tool traceroute 2001:db8:2::1

A line with no reply can mean that a router does not send Time Exceeded, or that a firewall blocks it. The trace shows where traffic stops, so that you know which router to inspect.

Torch

Torch shows live traffic on an interface, grouped by flow. It is useful to see who is using a link at the moment. Torch has separate address filters for IPv6.

/tool torch interface=ether1 src-address6=::/0 dst-address6=::/0

The value ::/0 matches every address. Narrow it to a prefix to see traffic from one network. Torch shows traffic seen by the router on that interface, so it also reveals Neighbor Discovery and other ICMPv6 flows when you do not filter them out.

Packet sniffer

The sniffer captures packets so you can read them in detail. You can filter by IPv6 address and by protocol, and save the capture to a file to open in another analyser.

/tool sniffer set filter-interface=ether1 filter-ip6-address=2001:db8:1::10/128
/tool sniffer start
/tool sniffer packet print
/tool sniffer stop

The packet list shows addresses, protocols and sizes. Save the capture to a file and open it in a packet analyser to read the full headers, such as the next header value, Neighbor Discovery messages, Router Advertisement flags and DHCPv6 exchanges.

Traffic generator

/tool traffic-generator builds test traffic. You define a packet template with an IPv6 source and destination and UDP or ICMPv6 as the payload, then start a stream.

The statistics show the packets sent and received, the loss and the throughput. The tool exists only in newer releases, so check yours.

Netwatch

Netwatch probes a host at an interval and runs a script when the state changes.

/tool netwatch add host=2001:db8::1 interval=10s up-script=":log info up" down-script=":log warning down"

Recent releases accept an IPv6 address as the host. Older releases may take IPv4 only, so check your version.

Email

The email tool sends mail from the router, for example for alerts. The SMTP server can be an IPv6 address, or a name with an AAAA record.

/tool e-mail set server=2001:db8:25::25 from=router@example.com
/tool e-mail send to=admin@example.com subject=test body=hello

Recent releases use server, and older ones use address. The second command is the test.

Traffic flow

Traffic flow exports flow records to a collector. IPv6 flows need version 9 or IPFIX, because version 5 has no IPv6 fields.

/ip traffic-flow set enabled=yes interfaces=all
/ip traffic-flow target add dst-address=192.0.2.10 port=2055 version=9

The menu is under /ip, but it also covers IPv6 traffic. The collector shown here uses an IPv4 address.

Tables that show IPv6 state

These menus show the current state without sending any traffic:

• /ipv6 address print lists addresses and flags.
• /ipv6 neighbor print lists the neighbour cache and the state of each entry.
• /ipv6 route print lists routes.
• /ipv6 nd print and /ipv6 nd prefix print list advertisement settings.
• /ipv6 dhcp-client print and /ipv6 pool print show prefix delegation.
• /ipv6 firewall filter print stats shows counters for each rule.

A troubleshooting order

Work from the bottom of the stack to the top:

1. Check the address with /ipv6 address print. It should be valid and not flagged invalid.
2. Check the neighbour cache. A neighbour in the failed state points to a link problem or to blocked ICMPv6.
3. Ping the gateway with its link local address and interface.
4. Check the route table for a default route.
5. Ping a remote global address, then a name.
6. Read the firewall counters if only some traffic fails.

The firewall and the tools

Ping and traceroute need ICMPv6 to pass. If the firewall blocks Echo and Time Exceeded messages, the tools fail even when the path works. A router can also log rule matches with log=yes on a rule, to see what the firewall is doing.