147 lines
9.3 KiB
Markdown
147 lines
9.3 KiB
Markdown
# WSL mirrored networking diagnosis — Codex-956atf
|
||
|
||
**Historical investigation, superseded by user issue1/comment328.** Root stopped
|
||
this reviewer when the user required VirtioProxy-only and made the VPN immutable,
|
||
including no inspection. The diagnostic recommendation below is not an active
|
||
next step and was not executed. Preserve these earlier findings as evidence,
|
||
without repeating host/VPN inspection. The current configuration and actual
|
||
prescribed-probe result are in
|
||
[the current WSL setup report](release-wsl-956atf-20260911.md#current-result-after-the-users-newest-solution).
|
||
|
||
2026-09-11, `/root/wsl_network_review`. Read-only review for user
|
||
[issue1/316](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-316),
|
||
coordinated in issue1/323. Root owns active guest provisioning, configuration,
|
||
compiler/native execution, shared ledgers and publication. This report owns no
|
||
application changes. Other teams' hosts are not this host.
|
||
|
||
## Finding and failure stage
|
||
|
||
**The strongest concrete lead is globally disabled Windows IPv6:**
|
||
`HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents`
|
||
is `4294967295` / `0xFFFFFFFF`, independently read twice. Windows exposes IPv6
|
||
only on loopback, although the Ethernet0, WSL and AmneziaVPN adapter IPv6
|
||
bindings all report enabled. This apparent discrepancy is expected: Microsoft
|
||
documents that the global registry setting does not change adapter checkboxes.
|
||
[Microsoft IPv6 configuration guidance](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows)
|
||
also identifies `0xFFFFFFFF` as an incorrect IPv6-disable value; simply changing
|
||
it to `0xFF` would still disable IPv6 and is not a proposed WSL fix.
|
||
|
||
Microsoft explicitly documents WSL connectivity failure when IPv6 is disabled
|
||
through this registry value.
|
||
[Official WSL troubleshooting](https://learn.microsoft.com/en-us/windows/wsl/troubleshooting#wsl-has-no-network-connection-when-disabling-ipv6)
|
||
The older primary [WSL issue11002](https://github.com/microsoft/WSL/issues/11002)
|
||
has the same mirrored-mode symptom, only `lo`. That issue used older Windows/WSL
|
||
and a different VPN, so similarity alone is not a causal diagnosis here.
|
||
|
||
The observed failure is **at or before mirrored NIC/address/route installation**,
|
||
not an ordinary failed DNS lookup alone. The root's exact user316 probe reaches
|
||
the Linux shell, but `ip -br addr` has only `lo` with `127.0.0.1/8`,
|
||
`10.255.255.254/32` and `::1/128`; there is no route.
|
||
`ping 1.1.1.1` immediately returns `Network is unreachable` (exit2),
|
||
`getent hosts google.com` exits2, and `curl -4 https://api.ipify.org` exits6.
|
||
The `/etc/resolv.conf -> /mnt/wsl/resolv.conf` symlink is dangling. A nameserver
|
||
edit cannot create a missing network interface or route. The tunneled-DNS
|
||
loopback address by itself does not prove the DNS service completed setup.
|
||
|
||
This is a ranked diagnosis, **not a proven root cause or successful fix**.
|
||
No host/VPN/firewall/security/IPv6 setting was changed, no WSL process/service
|
||
was restarted, and this reviewer did not invoke WSL or install anything.
|
||
|
||
## Local evidence
|
||
|
||
Read-only inventory began `2026-09-11T14:47:01.666Z`; this machine is
|
||
Windows11 Pro `10.0.26200`, boot `2026-09-11T13:57:52.500Z` (root's precise boot
|
||
record). Installed `C:\Program Files\WSL\wslservice.exe` reports `2.7.13.0`.
|
||
The already verified guest is Ubuntu26.04, Linux6.18.33.2-microsoft-standard-WSL2.
|
||
|
||
- `WslService`, `hns`, `vmcompute` and `SharedAccess` were running; SharedAccess
|
||
is Manual, not disabled. FSE driver reports Running/Boot. Therefore missing
|
||
ICS or stopped FSE is not supported by this snapshot.
|
||
- Ethernet0, WSL vSwitch/vEthernet and AmneziaVPN WireGuard were Up. Windows had
|
||
IPv4 defaults through Ethernet0 and AmneziaVPN. WSL vEthernet retained its
|
||
earlier `172.21.64.0/20` host-side subnet. Its presence does not prove that a
|
||
mirrored guest endpoint exists.
|
||
- Current `.wslconfig` was read back as exactly `[wsl2]`,
|
||
`networkingMode=mirrored`, `dnsTunneling=true`. The earlier setup report's
|
||
restored-absent-config statement is historical and superseded by user316.
|
||
- `ExternalInterfaceConstraint` is absent in the WSL machine registry key.
|
||
- `Get-HnsNetwork` and `Get-HnsEndpoint` serialized as empty strings. A separate
|
||
explicit `hnsdiag.exe list networks` and `list endpoints` each returned
|
||
`Access is denied.` **Do not interpret the empty strings as zero networks.**
|
||
- HNS Admin/Operational and Hyper-V Compute/Worker/VID/Storage/Hypervisor logs
|
||
denied this token access. Existing accessible VmSwitch Operational events
|
||
were queried, without enabling any log. The latest60 snapshot spans roughly
|
||
14:48:04–14:48:30, not the entire requested14:20+ period.
|
||
- Those60 events include FSE Switch deletion, activation, bind notifications and
|
||
host-vNIC connect/disconnect events with mostly `STATUS_SUCCESS`. They show
|
||
integration churn, but no causal error/guest-endpoint mapping is established.
|
||
A separate bounded errors/warnings query14:41–14:44 returns three event285
|
||
`IOCTL_ENUM_NIC_COUNT_EX` warnings. Their rendered execution/queued/expected
|
||
durations are all0ms; this cannot quantify a scheduling timeout.
|
||
- About2,401,592KiB host memory was free at the inventory. Active WSL shell
|
||
processes belong to provisioning; no attempt was made to terminate them.
|
||
|
||
Private evidence is under `.local/wsl-956atf-20260911/network-review/`:
|
||
`windows-inventory.log`, `hns-ipv6.log`, `ipv6-constraint-confirmation.log`,
|
||
`bindings-hnsdiag.log`, `vmswitch-events.json`, `fse-and-boot-warnings.log`.
|
||
`hns-ipv6.log` has heterogeneous PowerShell table formatting that hides binding
|
||
columns; `bindings-hnsdiag.log` is the explicit JSON replacement for that part.
|
||
Console access errors from the original log inventory are not embedded in its
|
||
stdout-only file; the access boundary above records that limitation.
|
||
The source probes remain in the parent evidence directory as
|
||
`network-probe.log`, `network-mirrored-probe.log`,
|
||
`network-virtioproxy-probe.log`, `network-user316-probe.log`.
|
||
|
||
## Ranked hypotheses and limits
|
||
|
||
1. **Global IPv6 disable prevents correct WSL mirrored integration.** Strongest
|
||
support: exact local disabling bitmask, loopback-only host IPv6, Microsoft's
|
||
explicit documented WSL failure condition and matching primary issue.
|
||
Limits: no WSL/HNS error trace or controlled correction has tied the missing
|
||
guest NIC to this setting on WSL2.7.13. The setting's owner/reason is unknown.
|
||
2. **HNS/FSE/WSL endpoint creation or guest-network synchronization fails.**
|
||
No guest NIC and FSE lifecycle churn support investigating this stage.
|
||
[Version-matched Microsoft source](https://github.com/microsoft/WSL/blob/2.7.13/src/windows/service/exe/MirroredNetworking.cpp)
|
||
creates mirrored network mappings/endpoints, sends guest notifications, then
|
||
waits for mirrored goal state. Its useful diagnostic names include
|
||
`FailedToStartNetworkManager`, `WaitForMirroredGoalStateFailed`,
|
||
`MirroredNetworking::AddNetworkEndpoint` and GNS notification results.
|
||
Local HNS properties and these ETL events are inaccessible/not collected;
|
||
therefore a specific failing API cannot yet be named.
|
||
3. **Guest initialization/synchronization latency or configuration conflict.**
|
||
Root-session startup timeout and initially `starting` systemd are recorded.
|
||
Later systemd running/no failed units and repeated missing NIC results
|
||
weaken a transient-only explanation. There is no evidence yet that Ubuntu
|
||
network management removed a successfully mirrored device.
|
||
4. **Ordinary traffic filtering/VPN interaction.** This may still explain the
|
||
earlier NAT mode's working route/DNS but timed-out HTTPS. Root's effective
|
||
Hyper-V default outbound policy was Allow. Neither that policy nor an active
|
||
VPN rules out all filtering, but ordinary packet drops do not explain why
|
||
the current guest lacks a non-loopback NIC. No VPN change is permissible.
|
||
|
||
## One lowest-risk next action
|
||
|
||
**Root should obtain one privileged, read-only HNS/Compute event-and-object
|
||
snapshot of the existing VM before proposing a configuration correction.**
|
||
An exact prepared script is
|
||
`.local/wsl-956atf-20260911/network-review/collect-existing-hns-readonly.ps1`.
|
||
It lists HNS networks/endpoints and reads existing HNS/Compute logs with bounded
|
||
time/count filters, records errors and exit statuses, and performs no WSL
|
||
launch/restart, tracing-session change, network mutation or package operation.
|
||
Run it once with an already available authorized administrative token; if that
|
||
token is unavailable, preserve the access limitation rather than bypassing it.
|
||
This can distinguish failed host endpoint creation from later guest delivery,
|
||
while keeping current mirrored+DNS settings and active provisioning intact.
|
||
|
||
The documented global IPv6 correction is a **host-wide change with a required
|
||
Windows restart**, not an ordinary WSL `.wslconfig` adjustment; it could alter
|
||
VPN behavior and is outside this read-only lease. Do not apply it silently.
|
||
No route/NAT, firewall, adapter-binding, VPN, resolv.conf or registry reset is
|
||
recommended as the next action. Microsoft's full networking log collector was
|
||
reviewed but not run: its restart mode removes HNS state/stops WSL service and
|
||
its general collector controls tracing sessions, so it is not interchangeable
|
||
with the bounded snapshot above.
|
||
|
||
This diagnosis does not block root's verified offline dependency path and
|
||
does not establish Linux compiler, desktop or release acceptance.
|