apt-get not happy eyeball-ed ... ugly workaround

The tool 'apt-get' has no "happy eyeball" (RFC 6555) features. That means that a bad IPv6 connection can cause long delays: a plain "sudo apt-get update" took 18 minutes on my already uptodate machine. :-(

Cause: apt-get tries each server and it takes a long time to time-out:

0% [Connecting to security.ubuntu.com (2001:67c:1562::13)]    
0% [Connecting to security.ubuntu.com (2001:67c:1360:8c01::18)]
0% [Connecting to security.ubuntu.com (2001:67c:1562::15)]    

As long as apt-get has no happy eyeball built in, there is a ugly work around:

Create a file /etc/apt/apt.conf.d/99timeout with these contents

Acquire::http::Timeout "2";

Acquire::ftp::Timeout "2";

Now the time-out on non-reachable (IPv6) servers only takes two seconds.

Thanks to http://askubuntu.com/questions/141513/how-to-lower-wait-time-for-repository-updates

Install Git version of arp-scan on Ubuntu and Raspbian

If you need the newest arp-scan (for example because of it's uptodate MAC address list), here is how to install the Git version of arp-scan on Ubuntu and Raspberry's Raspbian (and probably Debian).

Disclaimer: no IPv6 involved.

Here's the set of commands:

sudo apt-get update && sudo apt-get upgrade
sudo apt-get install automake libpcap-dev

git clone https://github.com/royhills/arp-scan.git
cd arp-scan/

aclocal
autoheader
autoreconf -i
automake
autoconf
./configure 
make
sudo ./arp-scan --localnet --interface=wlan0

That should work: it should give the MAC addresses visible via interface wlan0. Change to eth0 if you're system is connected via eth0.

To install the new arp-scan unto your system:

sudo make install
sudo arp-scan --localnet --interface=wlan0

Check the version:

sander@flappie:~/git/arp-scan$ sudo ./arp-scan --version
arp-scan 1.9.2

Copyright (C) 2005-2013 Roy Hills, NTA Monitor Ltd.
arp-scan comes with NO WARRANTY to the extent permitted by law.
You may redistribute copies of arp-scan under the terms of the GNU
General Public License.
For more information about these matters, see the file named COPYING.

libpcap version 1.3.0
sander@flappie:~/git/arp-scan$

That's it. Happy arp-scanning!

Scan ARP MAC addresses of other devices on the LAN

(Disclaimer: this is not IPv6 related. Just plain IPv4)

It can be useful to see which other devices are connected to a LAN, and then check the MAC address to get some kind identification. This way you can see - for example - if a smartphone is there, so thus guess if a certain person is there.

There is an easy tool for that: "arp-scan". It's available on Ubuntu Linux 13.04 after installing it "sudo apt-get install arp-scan". You have to run it as root:

$ sudo arp-scan --localnet --interface=wlan0
Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.0.1 64:d1:a3:03:8a:01 Sitecom Europe BV
192.168.0.113 00:06:dc:44:57:f3 Syabas Technology (Amquest)
192.168.0.102 04:46:65:7a:9d:55 (Unknown)
192.168.0.108 00:1f:e1:9f:eb:d2 Hon Hai Precision Ind. Co., Ltd.
192.168.0.109 f0:5a:09:35:ff:42 (Unknown)
192.168.0.102 04:46:65:7a:9d:55 (Unknown) (DUP: 2)
192.168.0.104 00:37:6d:01:ed:9a (Unknown) (DUP: 1)

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 256 hosts scanned in 1.336 seconds (191.62 hosts/sec). 7 responded

It works, but some MAC addresses are unknown. If you want the newer version, get it from http://www.nta-monitor.com/tools-resources/security-tools/arp-scan and compile it. Result:


$ sudo ./arp-scan --localnet --interface=wlan0
Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.0.1 64:d1:a3:03:8a:01 Sitecom Europe BV
192.168.0.113 00:06:dc:44:57:f3 Syabas Technology (Amquest)
192.168.0.104 00:37:6d:01:ed:9a Murata Manufacturing Co., Ltd.
192.168.0.109 f0:5a:09:35:ff:42 Samsung Electronics Co.,Ltd
192.168.0.108 00:1f:e1:9f:eb:d2 Hon Hai Precision Ind. Co., Ltd.
192.168.0.102 04:46:65:7a:9d:55 Murata Manufacturing Co., Ltd.

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 1.981 seconds (129.23 hosts/sec). 6 responded

So the f0:5a:09:35:ff:42 is my Samsung Android smartphone. That means I'm at home (or I left my phone at home ;-) )

Tip: run arp-scan a few times; sometimes it shows more lines that other times.

Measure IPv4 versus IPv6 traffic with netstat on Linux

There appears to be an easy way to measure IPv4 versus IPv6 traffic on Linux:



sander@hapee:~$ netstat -s  | grep -i octet | grep -vi cast
    InOctets: 242397362
    OutOctets: 76157803
sander@hapee:~$ netstat -s -6 | grep -i octet | grep -vi cast
    Ip6InOctets: 105884560
    Ip6OutOctets: 21024110
sander@hapee:~$ 

For those who don't know: an octet is an 8-bit byte.

Be aware that that the netstat counter apparantly is 32-bit, and two's complement, so the value will go from 0 to 2^31, and then to -2^31. So the value can be negative:

sander@hapee:~$ netstat -s  | grep -i octet | grep -vi cast

    InOctets: -249959401

    OutOctets: 72041351

If you use MRTG, MRTG can take care of these rollovers

UPDATE:

The current git version of net-tools / netstat solves the roll-over. Installation using git:


git clone git://net-tools.git.sourceforge.net/gitroot/net-tools/net-tools
cd net-tools/
make config
make

sudo make install

Result:


$ netstat -s | grep -i octet | grep -vi cast
    InOctets: 44243555321
    OutOctets: 216954870
$ 

So counter is at 44GB, well above 4.2GB. No more rollover. :-)

EDIT:
A one-liner to show traffic in GB:


$ ./netstat -s | grep -i octet | grep -vi cast | awk '{ print $2/(1024*1024*1024) " GB" }'
65.0086 GB
1.51142 GB

$ ./netstat -s -6 | grep -i octet | grep -vi cast | awk '{ print $2/(1024*1024*1024) " GB" }'
5.0461111 GB
0.7176651 GB

Use netstat to show IPv4 versus IPv6 traffic

If you wonder how much IPv6 versus IPv4 traffic your system does, there is an nice estimation: use "netstat -s" to show the amount of inbound packets. Packets is not the same as bytes, but assuming the IPv4 packets have the same mean size as IPv6 packets, you're fine. The exact commands are:

netstat -s | grep "total packets" | awk '{ print $1 }'
netstat -s -6 | grep "total packets" | awk '{ print $1 }'

which will show the packets for IPv4 resp IPv6

Please note that the first command will only show IPv4 packets, and not the total of IP packets. See the below test for proof

sander@hapee:~$ netstat -s | grep "total packets" | awk '{ print $1 }'
32648268
sander@hapee:~$ netstat -s -6 | grep "total packets" | awk '{ print $1 }'
177887898

sander@hapee:~$ wget -4 http://ftp.belnet.be/ubuntu.com/ubuntu/releases/precise/ubuntu-12.04.2-desktop-i386.iso -O /dev/null

sander@hapee:~$ netstat -s | grep "total packets" | awk '{ print $1 }'
32688502
sander@hapee:~$ netstat -s -6 | grep "total packets" | awk '{ print $1 }'
177887937

sander@hapee:~$ wget -6 http://ftp.belnet.be/ubuntu.com/ubuntu/releases/precise/ubuntu-12.04.2-desktop-i386.iso -O /dev/null

sander@hapee:~$ netstat -s | grep "total packets" | awk '{ print $1 }'
32688526
sander@hapee:~$ netstat -s -6 | grep "total packets" | awk '{ print $1 }'
178028250
sander@hapee:~$

In the above output you'll see the IPv4-download only rises the first counter (meaning it only measures IPv4), and the IPv6-download only rises the second counter (IPv6 traffic).
I'm writing a tool to put this info into MRTG graphs

IPv6 only bittorrent with Transmission

You can make Tranmission share torrent files via IPv6 only quite easily: just add http://www.appelboor.com/dump/blocklist.txt as the blocklist via Transmission: Edit -> Preferences -> Privacy.

Result: IPv6 only peers:

Download speeds is around 24 Mbps, so quite reasonable:

A lot of bittorrent IPv6 peers ...