ot-br-posix thread multicast not working for Inbound IPv6 Multicast

[rretanubun]

Context

I am trying to experience the backbone border router feature by following this codelab
https://openthread.io/codelabs/openthread-border-router-ipv6-multicast

Versions of the thread devices in use

linux-for-ot-br : Debian GNU/Linux 12 (bookworm)
ot-br : OPENTHREAD/6de5cd8; POSIX; Apr 11 2024 08:40:01 (latest available)
nrf   : OPENTHREAD/thread-reference-20230706-453-g6de5cd825; NRF52840; Apr 11 2024 11:31:39

Setup differences

I am using nrf52840-usb-dongle instead of nrf52840-dk and ethernet instead of
Wifi AP (a LAN switch with an eero pod acting as the router, connected to the LAN switch)

Issue

I am failing the Verify Inbound IPv6 Multicast check

When sending the same multicast ping from the Raspberry Pi OTBR
I am not seeing responses from nRF52840 End Device 1, Instead I am seeing
a response from Laptop and an IPv6 address of the eth0 on the Raspberry Pi OTBR

In case it helps, here is syslog from otbr-agent while the ping is being processed
ot-br-output-while-ping-from-otbr-to-multicast.log

Like this:

ping -6 -c 8 -b -t 5 -I eth0 ff05::abcd
PING ff05::abcd(ff05::abcd) from fd56:48e9:29aa:1:2be0:687c:db65:e395 eth0: 56 data bytes
64 bytes from fd56:48e9:29aa:1:2be0:687c:db65:e395: icmp_seq=1 ttl=64 time=0.089 ms // R-Pi otbr Address
64 bytes from fd56:48e9:29aa:1:a400:8084:1a5c:450: icmp_seq=1 ttl=64 time=0.828 ms
<snip>
64 bytes from fd56:48e9:29aa:1:a400:8084:1a5c:450: icmp_seq=7 ttl=64 time=1.41 ms>
64 bytes from fd56:48e9:29aa:1:2be0:687c:db65:e395: icmp_seq=8 ttl=64 time=0.071 ms

--- ff05::abcd ping statistics ---
8 packets transmitted, 8 received, +7 duplicates, 0% packet loss, time 7044ms
rtt min/avg/max/mdev = 0.059/0.989/4.219/1.303 ms

e395 is the RPi's otbr eth0 address:
inet6 fd56:48e9:29aa:1:2be0:687c:db65:e395/64 scope global dynamic noprefixroute

450 is the laptop address:

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
<snip>
    inet6 fd56:48e9:29aa:1:a400:8084:1a5c:450/64 scope global temporary dynamic
       valid_lft 599468sec preferred_lft 80986sec

ip -6 mroute show table all on the RPi-ot-br-posix shows this:
(fd56:48e9:29aa:1:da3a:ddff:feb2:54f,ff05::abcd) Iif: eth0 Oifs: wpan0 State: resolved

What works: outbound IPv6 Multicast

From nRF52840 End Device 2 I am able to get ping response from nRF52840 End Device 1 and the Laptop device

What works: Unicast pings from LAN -> OTBR -> Thread-devices

From the laptop device, unicast ping to both nRF52840 End Devices addresses works okay

Ping to nRF52840 End Device 1 (the one that is multicast subscribed)
ping -c 3 fdb7:7581:330f:1:2f4f:9f:8000:99ae
PING fdb7:7581:330f:1:2f4f:9f:8000:99ae(fdb7:7581:330f:1:2f4f:9f:8000:99ae) 56 data bytes
64 bytes from fdb7:7581:330f:1:2f4f:9f:8000:99ae: icmp_seq=1 ttl=63 time=17.0 ms
64 bytes from fdb7:7581:330f:1:2f4f:9f:8000:99ae: icmp_seq=2 ttl=63 time=15.7 ms
64 bytes from fdb7:7581:330f:1:2f4f:9f:8000:99ae: icmp_seq=3 ttl=63 time=23.0 ms

--- fdb7:7581:330f:1:2f4f:9f:8000:99ae ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2005ms
rtt min/avg/max/mdev = 15.663/18.558/22.965/3.166 ms

Ping to nRF52840 End Device 2 (not multicast subscribed)
ping -c 3 fdb7:7581:330f:1:3fd9:8ac6:428a:f614
PING fdb7:7581:330f:1:3fd9:8ac6:428a:f614(fdb7:7581:330f:1:3fd9:8ac6:428a:f614) 56 data bytes
64 bytes from fdb7:7581:330f:1:3fd9:8ac6:428a:f614: icmp_seq=1 ttl=63 time=16.0 ms
64 bytes from fdb7:7581:330f:1:3fd9:8ac6:428a:f614: icmp_seq=2 ttl=63 time=16.6 ms
64 bytes from fdb7:7581:330f:1:3fd9:8ac6:428a:f614: icmp_seq=3 ttl=63 time=16.7 ms

--- fdb7:7581:330f:1:3fd9:8ac6:428a:f614 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 16.027/16.437/16.666/0.290 ms

Linux networking checks

I am aware of RA-guard and the Laptop device is configured as recommended from
ref: https://openthread.io/codelabs/openthread-border-router#prepare-linux-host

sudo sysctl -n net.ipv6.conf.ens33.accept_ra
1
sudo sysctl -n net.ipv6.conf.ens33.accept_ra_rt_info_max_plen
64

I also tried applying the same settings on the Linux-hosting the ot-br-posix
sudo sysctl -n net.ipv6.conf.eth0.accept_ra
1
sudo sysctl -n net.ipv6.conf.eth0.accept_ra_rt_info_max_plen
64
followed by sudo ot-ctl br disable && sleep 100 && sudo ot-ctl br enable

but I am still not getting responses from nRF52840 End Device 1
when validating Inbound IPv6 Multicast

ot-ctl checks

my OTBR is indeed the primary BBR

sudo ot-ctl bbr
BBR Primary:
server16: 0x1800
seqno:    77
delay:    5 secs
timeout:  3600 secs
Done
rpi5@rpi5:~ $ sudo ot-ctl rloc16
1800

Thanks for reading this far, sorry for the long post.
What Am I missing in my setup?

Thanks for everyone's time!

[superwhd]

Sorry for the late reply. Are you still seeing this issue?

According to your log file I don't see relevant lines related to the multicast forwarding. Could you share the complete log since otbr-agent started?
Also, It may be helpful if you can share the packet capture (wireshark/tcpdump) on the eth0 interface of your Rpi.

cc @sunytt