Course contents

Chapter 3: IPv6 ConfigurationLesson 4 of 6

IPv6 Neighbor Discovery (NDP)

RS, RA, NS and NA messages, solicited-node multicast, duplicate address detection and the neighbour cache.

Intermediate · 11 min read

Technical definition

Neighbor Discovery Protocol (NDP) is the set of ICMPv6 messages IPv6 uses to find routers, resolve IPv6 addresses to MAC addresses, detect duplicate addresses and track neighbour reachability. It replaces ARP.

Four messages and one protocol

IPv6 Neighbor Discovery: four ICMPv6 messages
IPv6 Neighbor Discovery: four ICMPv6 messagesA host sends a router solicitation to all routers and gets a router advertisement with the prefix and gateway. To find another host's MAC address it sends a neighbor solicitation to that host's solicited-node multicast address and gets a neighbor advertisement back.HostRouterRS (ICMPv6 type 133)Router Solicitation → ff02::2 (all routers)“Is there a router here?”RA (type 134)Router Advertisement → ff02::1 or the hostPrefix, gateway, flags (M, O)NS (type 135)Neighbor Solicitation → solicited-node ff02::1:ffXX:XXXX“Who has 2001:db8:1::10?” (replaces ARP)NA (type 136)Neighbor Advertisement → the asker“It is me, here is my MAC”First pair: finding the router. Second pair: finding a neighbour's MAC (needed to send a frame).
NDP replaces ARP and adds router discovery, duplicate address detection and redirects. It runs over ICMPv6, so blocking ICMPv6 breaks IPv6.

NDP uses ICMPv6, so it is part of IPv6 rather than a separate protocol like ARP. The four messages work in two pairs. Router Solicitation and Router Advertisement let a host learn the prefix and gateway. Neighbor Solicitation and Neighbor Advertisement let a host learn another device's MAC address.

NDP message types
NDP message typesMessage; ICMPv6 type; Sent to; Purpose. Router Solicitation (RS): 133 ff02::2 (all routers) A host asks for a Router Advertisement now Router Advertisement (RA): 134 ff02::1 (all nodes) or the asking host Router announces prefix, MTU, default gateway and flags; sent periodically too Neighbor Solicitation (NS): 135 Solicited-node multicast, or unicast to check Who has this address? Also used for duplicate address detection Neighbor Advertisement (NA): 136 The asker, or ff02::1 when unsolicited Here is my MAC address Redirect: 137 The host A router points to a better first hopMessageICMPv6 typeSent toPurposeRouterSolicitation (RS)133ff02::2 (all routers)A host asks for a RouterAdvertisement nowRouterAdvertisement (RA)134ff02::1 (all nodes) orthe asking hostRouter announces prefix,MTU, default gateway andflags; sent periodicallytooNeighborSolicitation (NS)135Solicited-node multicast,or unicast to checkWho has this address?Also used for duplicateaddress detectionNeighborAdvertisement (NA)136The asker, or ff02::1when unsolicitedHere is my MAC addressRedirect137The hostA router points to abetter first hop

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Types 133 to 137 are the NDP messages. Learn them by number as well as name; packet captures show the number.

How address resolution works

PC1 wants to send to 2001:db8:1::10 on its LAN but has no MAC address for it.

  1. PC1 sends a Neighbor Solicitation to the solicited-node multicast address built from the last 24 bits of the target: ff02::1:ff00:10. The frame goes to the matching multicast MAC address, 33:33:ff:00:00:10.
  2. Only the host with that address (and any others sharing the last 24 bits) is listening. It replies with a Neighbor Advertisement by unicast, containing its MAC address.
  3. PC1 stores the answer in its neighbour cache, the IPv6 equivalent of the ARP table.

Duplicate address detection

Before using a new unicast address, a host sends a Neighbor Solicitation for that address from the unspecified address ::. If anyone answers, the address is a duplicate and is not used. This is how SLAAC addresses stay unique without a server.

Checking the neighbour cache

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:1::10                              0 000c.29aa.0010  REACH Gi0/0
FE80::20C:29FF:FEAA:10                      2 000c.29aa.0010  STALE Gi0/0
Example output. REACH means the neighbour was confirmed recently; STALE means it was not confirmed for a while and will be checked when traffic next uses it.
Neighbour cache states
Neighbour cache statesState; Meaning. INCMP: Resolution in progress: an NS was sent, no answer yet REACH: Reachable: confirmed within the last few seconds or minutes STALE: Not recently confirmed; still used until traffic triggers a check DELAY: Waiting a short time to see if upper layers confirm reachability PROBE: Sending unicast Neighbor Solicitations to confirmStateMeaningINCMPResolution in progress: an NS was sent, no answer yetREACHReachable: confirmed within the last few seconds or minutesSTALENot recently confirmed; still used until traffic triggers a checkDELAYWaiting a short time to see if upper layers confirm reachabilityPROBESending unicast Neighbor Solicitations to confirm

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A failed check removes the entry and the address becomes unreachable.

Test yourself

Predict · scenario 1

PC1 needs the MAC address of 2001:db8:1::10. Which message does it send first?

Predict · scenario 2

What is the ICMPv6 type number of a Router Advertisement?

Predict · scenario 3

A host builds its SLAAC address. What does it do before using it?

FAQ

What replaces ARP in IPv6?
Neighbor Solicitation and Neighbor Advertisement messages in ICMPv6, sent to a solicited-node multicast address so only likely targets process them.
What is the solicited-node multicast address?
ff02::1:ff followed by the last 24 bits of the unicast address. For 2001:db8:1::10 the last 24 bits are 000010, so the group is ff02::1:ff00:10. Devices with that low-order part join the group, so a query reaches only a few hosts.
Why is blocking ICMPv6 a problem?
IPv6 depends on it. Block neighbor discovery and path MTU messages and hosts cannot find routers or neighbours and large packets break. Filter specific types, never all of ICMPv6.