Sponsored Links

Virgin Media has a working IPv6 network... sort of.

jamesmacwhite

Casual Member
So I'm sure there are many people aware of the IPv6 mega thread over on the Virgin Media community forums that's been on-going for over 10 years now about the lack of IPv6. Well more recently lukegb on Twitter found out that there is in fact a live IPv6 network hiding in plain sight and it's usable. Sort of.

A while ago, I accidentally discovered part of this by seeing Router Advertisements for IPv6 prefixes on the WAN side. I was tipped off when I changed a Linux kernel parameter called accept_ra on my network interfaces to 2 and suddenly two IPv6 routes from Virgin Media showed up in the routing table.

I dug into it a bit more and found these can be revealed by using tcpdump on the WAN interface, example:

Bash:
tcpdump -vvvv -ttt -i eth1.2 icmp6 and 'ip6[40] = 134'

This will poll my Virgin Media WAN interface for ICMP6 traffic specifically for Router Advertisement packets, surprise, these RA messages are present:

Code:
tcpdump: listening on eth1.2, link-type EN10MB (Ethernet), capture size 262144 bytes
 00:00:00.000000 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 80) fe80::201:5cff:fe9c:2847 > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 80
        hop limit 0, Flags [managed, other stateful], pref medium, router lifetime 9000s, reachable time 3600000ms, retrans timer 0ms
          prefix info option (3), length 32 (4): 2a02:8800:f000:18b0::/64, Flags [onlink], valid time 2592000s, pref. time 604800s
            0x0000:  4080 0027 8d00 0009 3a80 0000 0000 2a02
            0x0010:  8800 f000 18b0 0000 0000 0000 0000
          prefix info option (3), length 32 (4): 2a02:88fd:18:a::/64, Flags [onlink], valid time infinity, pref. time infinity
            0x0000:  4080 ffff ffff ffff ffff 0000 0000 2a02
            0x0010:  88fd 0018 000a 0000 0000 0000 0000

There are two notable prefixes in the RA:
  • 2a02:8800:f000:18b0::/64
  • 2a02:88fd:18:a::/64
The former based on testing seems to be some internal network, possibly management network. You will get administratively denied messages when trying to route or ping addresses within this prefix. You can't actually get to addresses within this prefix on the wider IPv6 internet outside of VM either. The latter appears to be a publicly routed prefix.

Luke when one step further than I did and essentially assigning yourself a suitable address within this prefix, you can get working IPv6, which Luke shows from test-ipv6.com:


The prefix differs based on customer/area ref I believe.

Obviously, this isn't actually live and I don't think VM engineers expect anyone to be messing with this, but it at least confirms there's certainly a working IPv6 network there. This is present on both residential and business lines. With the talks around DS-Lite and such, it's interesting that this is essentially dual-stack.

While the Router Advertisements have the managed flag, DHCPv6 traffic seems to be filtered, so no prefix delegation, hence manually having to assign a IPv6 address to actually test it. It has also been noted not everyone seems to be able to see these Router Advertisements. I have only be able to verify them using a Linux based OS/Router, I've seen others say they can't see them. Equally, unless you are using your own kit, I doubt you'll be able to ever see the RA packets on the Hubs as they are locked down and will be ignoring them.

Virgin Media to launch IPv6 in 2021 anyone?!
 
I think they've been technically "ready" for a few months now, but for whatever reason haven't flicked the switch. I've somewhat given up on chasing them over this as it's become a long-winded story of disappointment :).

As for DS-Lite, I was given the impression a couple of years ago that they'd scrapped that and adopted dual-stack, so no real surprise if the latter turns out to be true.
 
I'm on Rogers in Canada and was seeing RAs long before Roger provided native IPv6 support (They did offer 6rd & 6to4 tunnels for a few years). What you need to see is DHCPv6-PD, which will provide a WAN address and a prefix for your local network. I get a /56 prefix, which I can split into 256 /64s. Also, there's a good chance the WAN address will not be used for routing, as link local addresses are often used. In fact, strictly speaking, you don't even need a WAN IPv6 address, other than link local. I've been using IPv6 for over 11 years, the first 6 via 6in4 tunnel, from another provider, and then native as provided by Rogers.
 
Sponsored Links
I think they've been technically "ready" for a few months now, but for whatever reason haven't flicked the switch. I've somewhat given up on chasing them over this as it's become a long-winded story of disappointment :).

As for DS-Lite, I was given the impression a couple of years ago that they'd scrapped that and adopted dual-stack, so no real surprise if the latter turns out to be true.

Indeed! The IPv6 mega thread on the Virgin's own community forums is over 10 years old now.

I did discover these back in December 2020 but they could have been there for a long time before that, one contact I had seemed to suggest it's not "new".

Do you think they could be push the button with DOCSIS 3.1 being mostly rolled out by the end of the year? (if the target is still on track). I don't think it has any real bearing in terms of IPv6 being tied to DOCSIS3.1 but some have noted work notes that mention "DOCSIS 3.1 and DS configuration". I wonder if any of the kit in the network needs changes for it which is being done at the same time.
 
I'm on Rogers in Canada and was seeing RAs long before Roger provided native IPv6 support (They did offer 6rd & 6to4 tunnels for a few years). What you need to see is DHCPv6-PD, which will provide a WAN address and a prefix for your local network. I get a /56 prefix, which I can split into 256 /64s. Also, there's a good chance the WAN address will not be used for routing, as link local addresses are often used. In fact, strictly speaking, you don't even need a WAN IPv6 address, other than link local. I've been using IPv6 for over 11 years, the first 6 via 6in4 tunnel, from another provider, and then native as provided by Rogers.

Yes absolutely, you would normally expect a DHCPv6 prefix delegation, but as this isn't really official, they are likely filtering DHCPv6 traffic out entirely given this isn't really live. The interesting part is you can just technically assign yourself an IPv6 address in the valid subnet and it works!

Of course not really useful given it's one IPv6 address on the WAN, but interesting all the same.
 
Last edited:
Digging up this post for advice :)

I've been playing with tcpdump & discovered the following addresses on VM.

2a02:8800:f000:634::/64 and 2a02:88fd:5::/64

Now I can only assume the last is reachable but I cannot for the life of me work out what would be a valid working IPv6 address & gateway from the above so I can test. Call me a bit thick but it just isn't clicking, number/info overload!

Any pointers would be gratefully received.
 
Sponsored Links
Digging up this post for advice :)

I've been playing with tcpdump & discovered the following addresses on VM.

2a02:8800:f000:634::/64 and 2a02:88fd:5::/64

Now I can only assume the last is reachable but I cannot for the life of me work out what would be a valid working IPv6 address & gateway from the above so I can test. Call me a bit thick but it just isn't clicking, number/info overload!

Any pointers would be gratefully received.
Well, the gateway is usually the first usable address, in this case 2a02:88fd:5::1/64, but this is just a convention. Worth a try.
 
Thanks @Lucian!
Sadly i'm not able to get a working IPV6 link.

* The gateway at 2a02:88fd:5::1 does respond to pings externally (using an online tool).
* Even after setting up a static address of 2a02:88fd:5::4422 and the gateway as 2a02:88fd:5::1 on the wan link, I cannot ping6 to bbc.co.uk. The address is resolved correctly, and i even see some noise from the cmts mac via tcpdump but no ping replies!

Now this is where it gets odd. I restarted the ipv4 wan link and i'm now somehow on a completely different network segment and it appears to be on VMs static ip business side.. What?!??

Yes, it's a home connection with the hub in modem mode, it only got installed on Oct 1st.

Before I completely finished setting up my router (openwrt 21.02 newifi d2) all dhcp releases were from the pool 80.6.xxx.xxx/23 (cpcxxxx-covexx-2-0-custxxx.3-1.cable.virginm.net) but now coming from 80.5.xxx.xxx/24 (xxx.xxx-5-80.static.virginmediabusiness.co.uk).

What is going on here? When I was messing with IPv6 i created a new interface alias and left the IPv4 wan interface separate. The only thing i changed on the ipv4 wan was to send the hostname, which is "OpenWrt"..

Undoing of "sending of the hostname" and restarting the ipv4 a few times has changed nothing.. So it looks like i'm stuck on the business side of VM!

It's very odd and have no idea how it happened!

- Ideas welcome :)
 
Thanks @Lucian!
Sadly i'm not able to get a working IPV6 link.

* The gateway at 2a02:88fd:5::1 does respond to pings externally (using an online tool).
* Even after setting up a static address of 2a02:88fd:5::4422 and the gateway as 2a02:88fd:5::1 on the wan link, I cannot ping6 to bbc.co.uk. The address is resolved correctly, and i even see some noise from the cmts mac via tcpdump but no ping replies!

Now this is where it gets odd. I restarted the ipv4 wan link and i'm now somehow on a completely different network segment and it appears to be on VMs static ip business side.. What?!??

Yes, it's a home connection with the hub in modem mode, it only got installed on Oct 1st.

Before I completely finished setting up my router (openwrt 21.02 newifi d2) all dhcp releases were from the pool 80.6.xxx.xxx/23 (cpcxxxx-covexx-2-0-custxxx.3-1.cable.virginm.net) but now coming from 80.5.xxx.xxx/24 (xxx.xxx-5-80.static.virginmediabusiness.co.uk).

What is going on here? When I was messing with IPv6 i created a new interface alias and left the IPv4 wan interface separate. The only thing i changed on the ipv4 wan was to send the hostname, which is "OpenWrt"..

Undoing of "sending of the hostname" and restarting the ipv4 a few times has changed nothing.. So it looks like i'm stuck on the business side of VM!

It's very odd and have no idea how it happened!

- Ideas welcome :)
Can't offer any direct support on why IPv6 doesn't work, but bearing in mind this is completely not supported and technically not even intended to be public knowledge probably (well unless Liberty Global engineers have happened to notice the chatter about it!). So it might not work reliably, although you aren't really missing out on much, given with the lack of prefix delegation you can't really use it, unless you start getting really clever with configuration but for something that's not meant to be used currently. It is more of a proof of concept/look at this nerdy IPv6 banter.

Interesting regarding your DHCP lease, I'm not entirely familiar with the VM Business side, but I got the impression the static service isn't all that different from the general residential network. Sometimes when you do traceroute requests you may find traffic from the residential service traversing the VM Business side occasionally on certain hops for example. The GRE tunnels are the key thing for the static IPs. It's possible that the IP could have originally been under VM Business but since released back into the main pool but the rDNS is outdated.

Easiest way to confirm is change the WAN MAC address for your VM connection to force the lease to change. I doubt you have been put onto a static IP, but stranger things have happened!
 
Easiest way to confirm is change the WAN MAC address for your VM connection to force the lease to change. I doubt you have been put onto a static IP, but stranger things have happened!
I changed the router out for an RPI4 and I still have the exact same static IP, the mac address is completely different. I even restarted the hub 3! :confused:

Hmm, looking at my configs again I may know what is causing it. However I won't say here in case it causes VM issues.
 
Sponsored Links
As a follow-up to my last post. I've tried my hardest to explain my findings on the VM forums without saying exactly how to do it (by it I mean getting a static IP on a home connection that isn't just a sticky IP) and it kinda feels like no one believes me. Am I going insane here? :unsure:
 
Top
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £24.00
132Mbps
Gift: None
Shell Energy UK ISP Logo
Shell Energy £26.99
109Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £27.99
145Mbps
Gift: None
Zen Internet UK ISP Logo
Zen Internet £28.00 - 35.00
100Mbps
Gift: None
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £15.00
150Mbps
Gift: None
YouFibre UK ISP Logo
YouFibre £19.99
150Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
BeFibre UK ISP Logo
BeFibre £21.00
150Mbps
Gift: £25 Love2Shop Card
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (5472)
  2. BT (3505)
  3. Politics (2524)
  4. Openreach (2291)
  5. Business (2251)
  6. Building Digital UK (2234)
  7. FTTC (2041)
  8. Mobile Broadband (1961)
  9. Statistics (1778)
  10. 4G (1654)
  11. Virgin Media (1608)
  12. Ofcom Regulation (1451)
  13. Fibre Optic (1392)
  14. Wireless Internet (1386)
  15. FTTH (1381)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules