I have a number of Linux machines, on a few of which I have set up a 6to4 tunnel, so that they are on IPv6 with 2001: prefixes. One is at home, one at work. I can send traffic from one to another, and if I look on the router, I see ip encapsulated traffic type 41 as expected. Generally, all the Linux machines have a fe80:: scope:link address, and often a fec0:: scope:site address. Many also have a 2002: scope:global address. I'm not sure where that is coming from. If I ping6 those addresses from offsite, I can see an encapsulated icmp6 packet at the router coming from 192.88.99.1 to a laptop onsite. The laptop owner does not know anything about it. I'm guessing that if I wait long enough, I'll see router advertisement packets coming from the laptop, but as I write this it's gone offline. (I was trying to test a tunnel and was confused to see traffic routed via 2001:478:235::7 (ARIN says EP-NET Almond Oil Process) when the tunnel was down.) Is there a chance this is malware ? Or just a Teredo tunnel on Windows that got active somehow ? I also see various Windows machines trying to ping6 2002:c058:6301::c058:6301: via 192.88.99.1, but get "hop limit"