Why your cloud monitoring is blind to IPv6 blackholes (and how to fix it)
TL;DR: your checker probably takes the first address the resolver hands back, and on a dual-stack host that is the AAAA record. If IPv6 is a blackhole — a route that exists and drops packets — every check waits for its full timeout and then reports the target as down. The target answered in 281 ms on IPv4 the whole time. This post is the ten-second experiment that proves it, the two different…
IPv6 blackholes can cause cloud monitoring to incorrectly report a target as down when it is actually functioning properly. This issue arises because monitoring tools often take the first address provided by the resolver, which may be an IPv6 address on a dual-stack host. If the IPv6 address leads to a blackhole route (a route that exists but drops packets), the monitoring check will wait until its timeout period expires, then report the target as down despite the IPv4 address responding correctly.
The problem lies in the fact that the timeout setting is faithfully reporting how long it waited, rather than identifying the root cause. This leads to confusion and unnecessary alerts. To properly differentiate between the two types of IPv6 failures, a two-file CLI tool can be used that measures the response times for IPv4 and IPv6 separately. This tool reveals that a blackholed IPv6 prefix results in a timeout, while a no route scenario results in an immediate ENETUNREACH error.
The distinction between these two failure shapes is crucial, as they have different implications for troubleshooting and remediation. In a containerized environment, a default Docker bridge network lacks IPv6 routing, which can cause the monitoring tool to incorrectly attribute issues to the absence of IPv6 support, even when the IPv4 address is functioning correctly.
This highlights the importance of configuring checks to record the specific conditions under which they operate, as a monitoring tool's behavior is influenced by the environment in which it runs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
