Добавлю еще информации:
У абонента флудит роутер ipv6 multicast
22:49:10.029208 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.043079 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.058325 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.074276 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.089977 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.105564 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.120958 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.137882 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.152060 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.168015 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
22:49:10.183501 c4:a8:1d:44:2c:0b > 33:33:00:01:00:02, ethertype IPv6 (0x86dd), length 161: fe80::c6a8:1dff:fe44:2c0b.546 > ff02::1:2.547: dhcp6 solicit
Последствие - нагрузка CPU до 50%, свитч иногда не отвечает на ping.
Решение
Коммутатор D-Link DES-3200 rev C1
Обычные ACL не сработают, т.к. ipv6 multicast забирается процессором, потому используем:
сreate cpu access_profile profile_id 1 ethernet ethernet_type
config cpu access_profile profile_id 1 add access_id auto_assign ethernet ethernet_type 0x86DD port 1-16 deny
enable cpu_interface_filtering
и обязательно:
config multicast vlan_filtering_mode all filter_unregistered_groups