NCSI passive probe not working ipv6

Question

Hello,

i have problems getting NCSI to work with ipv6. Client is Windows 11 (Build 22621.1992) on an Win Server 2022 HyperV. Client is on VLAN 22 in this case for test purposes and behind openwrt with ipv6 nat.

Ipv6 is working without problems can access msftconnecttest.com without problems can ping any ipv6 sites. Active probe is working well, as soon as i disable second network adapter active probe is made with success, but passive only sees localnetwork.

ipv4 is working like a charm and disabled in this case.

Active probe:

Funktionsänderung für "{****}" (Familie (0x6008001000000): v6, Funktion: Internet, ChangeReason: ActiveHttpProbeSucceeded)

Passive probe:

Funktionsänderung für "{****}" (Familie (0x6008001000000): v6, Funktion: Lokal, ChangeReason: PassivePacketHops)

Tried all with gpo and registry. Minimize hops and and and but without success.

PS C:\Users\********> tracert ipv6.msftconnecttest.com

Routenverfolgung zu a1968.i6g1.akamai.net [2a02:26f0:f500:9::5c7b:8515]
über maximal 30 Hops:

  1    <1 ms    <1 ms    <1 ms  fd22::254
  2     1 ms    <1 ms     1 ms  fritz.box [2003:********]
  3     5 ms     4 ms     4 ms  2003:0:8800:8800::1
  4     *        9 ms     *     2003:0:1808::1
  5     7 ms     7 ms     6 ms  2003:0:f00::41d
  6     8 ms     7 ms     6 ms  g2a02-26f0-fb00-0304-0000-0000-0000-0001.deploy.static.akamaitechnologies.com [2a02:26f0:fb00:304::1]
  7     9 ms     7 ms     7 ms  g2a02-26f0-fb00-0607-0000-0000-0000-0001.deploy.static.akamaitechnologies.com [2a02:26f0:fb00:607::1]
  8     8 ms     6 ms     6 ms  g2a02-26f0-f500-0009-0000-0000-5c7b-8515.deploy.static.akamaitechnologies.com [2a02:26f0:f500:9::5c7b:8515]

What can i do to make passive probe working?

thanks

Answer 1

Hello All,

Christian and I investigated the cause of the problem and found an explanation for this case; the distinguishing characteristics of this case are:

• IPv6 connectivity only.
• No NCSI active probing.
• Use of NAT66 (client system does not have a global unicast IPv6 address; it is using a unique local address).

The passive probing heuristics used in this case are hop count and whether the interface has a global unicast IPv6 address. Since the client system does not have a global unicast IPv6 address, the hop count based estimate of Internet connectivity is downgraded to just local/subnet connectivity by the NCSI passive probing code.

Gary

Answer 2

Hello,

1. Tested already no difference
2. Will check with openwrt community but there is not much config with ipv6 nat and it works like a charm only NCSI making problems.
3. Also testet at this moment with physical PC with Realtek NIC. No difference
4. DNS settings are good and can resolve any IPV6 like the ipv6.msftconnecttest.com
5. checked settings, all are good, also tried many settings in registry and gpo
6. hyperv nic is up to date and on physical i didn't check cause 2 different machines same problem.
7. like 3 so i didnt test with different vswitch
8. that would be next but passsive probing doesnt generate traffic it analyses it!? I'll have a look.
9. Thats not an Insider build its just an updated Win 11 (July 11, 2023—KB5028185 (OS Build 22621.1992))

Will also make a Feedback but I don't think that it is that big issue.

thanks

Answer 3

Hello C. Eckart,

I would suggest using Event Tracing for Windows to try to understand the behaviour and results of passive probing.

I tried using a trace session that included the Microsoft-Windows-NCSI provider, the ncsi.dll NCSI TraceLogging providers and a network packet trace provider (such as Microsoft-Windows-PktMon or Microsoft-Windows-NDIS-PacketCapture).

The resulting trace file included events such as those pictured below:

One can then try to identify recently (in the last 15 seconds) received packets that led to the HopCount estimate; in my test, I think that the packets were like those pictured below:

I think that some calculation using the IPv6 HopLimit value of 236 is the source of the "hopCount=20" event in the first image.

Perform a similar test in your set-up and see whether that throws any light on the problem and whether that suggests a solution.

Gary

Answer 4

Hello,

first thanks for replies. I'll make a trace and investigate it further.

But for now i also investigated the analyse event log of nsci and i saw this:

NCSI Event ID 4048

Nächster Hop zum Internet wurde geändert für "{b30f8ea2-0a57-4a33-a5cf-a17db022a798}" (Familie (0x6008001000000): v6, HasNextHopToInternet: true, NextHopAddress: fe80::acf2:c9ff:fed0:f6b)

Does "HasNextHopToInternet" mean what i guess?

And also another Event ID 4026 for proxy detection:

Die Proxyerkennung wurde beendet (HasProxy=122).

"Hasproxy=122" can you say me what the 122 means?

thanks

Answer 5

Hello,

Thank you for your question and for reaching out with your question today.

It seems that you are facing issues with NCSI (Network Connectivity Status Indicator) and passive probe functionality on a Windows 11 client with IPv6 connectivity. Passive probe is responsible for detecting the local network's connectivity status. Since active probe is successful, it indicates that the client has connectivity to external sites, but passive probe only sees the local network.

To troubleshoot and potentially resolve the passive probe issue, you can try the following steps:

1. Check Firewall Settings: Ensure that there are no restrictive firewall settings on the Windows 11 client or the OpenWrt router that could be blocking passive probe packets.
2. Check Router and VLAN Configurations: Verify the router and VLAN configurations on OpenWrt to ensure that they are properly set up for IPv6 connectivity. Ensure that there are no misconfigurations or issues with NAT that could interfere with NCSI passive probe.
3. Check Hyper-V Network Adapter Settings: Review the Hyper-V network adapter settings for the Windows 11 virtual machine. Verify that the network adapter is correctly connected to the appropriate virtual switch and has the necessary IPv6 settings.
4. Check DNS Configuration: Ensure that the DNS settings on the Windows 11 client are correct and that it can resolve external domain names using IPv6.
5. Check NCSI Registry Settings: Verify the NCSI registry settings on the Windows 11 client to ensure that they are correctly configured for IPv6. The NCSI registry settings can be found in the following location:

   
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
   
   

6. Update Network Drivers: Make sure that the network drivers on the Windows 11 client are up to date. Outdated or incompatible network drivers could cause connectivity issues.
7. Test with a Different Virtual Switch: As a test, try connecting the Windows 11 virtual machine to a different virtual switch in Hyper-V. This can help identify if the issue is related to the current virtual switch configuration.
8. Monitor Network Traffic: Use network monitoring tools to analyze the traffic between the Windows 11 client and the OpenWrt router. This can help identify if there are any packet drops or abnormalities during passive probe attempts.
9. Check Windows Insider Preview Builds: Since you are using a Windows 11 Insider Preview build, it's possible that the issue might be related to the specific build. Consider checking Windows Insider release notes and forums to see if there are any known issues or updates related to NCSI or IPv6 connectivity.

If the issue persists after trying the above steps, you may consider reporting the problem to Microsoft through the Windows Insider Program Feedback Hub. This can help bring the issue to the attention of Microsoft's development team and potentially lead to a resolution in future updates.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.