Yesterday's Windows update causes IPv4 to be default

[David Farmer]

On 11/14/12 21:52 , Dale W. Carder wrote:

> So, what happens when there is a captive portal to force daily
> registration such as at hotels or for corporate guests?  With this
> algorithm it would appear that ipv6 would be effectively permanently
> disabled even though the network is dual stacked.
>
> Or am I missing something?
>

Checkout, http://blog.superuser.com/2011/05/16/windows-7-network-awareness/

------
How does it work?
Windows does indeed check a Microsoft site for connectivity, using the 
Network Connectivity Status Indicator site. There are a few variations 
of the connection checking process:

1. NCSI performs a DNS lookup on www.msftncsi.com, then requests 
http://www.msftncsi.com/ncsi.txt. This file is a plain-text file and 
contains only the text Microsoft NCSI.

2. NCSI sends a DNS lookup request for dns.msftncsi.com. This DNS 
address should resolve to 131.107.255.255. If the address does not 
match, then it is assumed that the internet connection is not 
functioning correctly.

The exact sequence of when which test is run is not documented; however, 
a little bit of digging around with a packet sniffing tool like 
Wireshark reveals some info. It appears that on any connection, the 
first thing NCSI does is requests the text file (step 1 above). NCSI 
expects a 200 OK response header with the proper text returned. If the 
response is never received, or if there is a redirect, then a DNS 
request for dns.msftncsi.com is made. If DNS resolves properly but the 
page is inaccessible, then it is assumed that there is a working 
internet connection, but an in-browser authentication page is blocking 
access to the file. This results in the pop-up balloon above. If DNS 
resolution fails or returns the wrong address, then it is assumed that 
the internet connection is completely unsuccessful, and the “no internet 
access” error is shown.
-----

So, it looks like there is a test for a captive portal in the IPv4 
portion of NCSI.  I seems logical that this happens before it gets to 
the ipv6.msftncsi.com test, but I don't know for sure.


-- 
================================================
David Farmer               Email: farmer at umn.edu
Office of Information Technology
University of Minnesota
2218 University Ave SE     Phone: 1-612-626-0815
Minneapolis, MN 55414-3029  Cell: 1-612-812-9952
================================================