L3 · addressing · reviewed
NDP
Neighbor Discovery Protocol
IPv6’s on-link discovery: NS/NA replace ARP, RS/RA find routers and prefixes, and DAD proves an address is unique — a rogue RA is an incident.
Presenter modeEmbed this figure
Why it exists
IPv6 has no ARP. Neighbor Discovery covers address resolution, router and prefix discovery, parameter discovery, Duplicate Address Detection, and neighbor unreachability — all as ICMPv6 messages with Hop Limit 255. IntroductionRFC 4861 · DRAFT STANDARD · September 2007
Because ND is ordinary IP traffic, it can be filtered and secured — and because any node can send an RA, access-layer RA Guard is mandatory in hostile or messy L2 domains. Model and ApplicabilityRFC 6105 · INFORMATIONAL · February 2011
Neighbor Solicitation resolves an on-link address
Host A needs Host B’s link-layer address. It sends NS to B’s solicited-node multicast; B replies with NA. Same job as ARP, different packet and multicast group.
A has a packet for 2001:db8::b on-link but no neighbor cache entry. It must learn B’s MAC before the frame can leave. A · 2001:db8::a: Cache incomplete for ::b. L2. B · 2001:db8::b.
- Link
- Blocking
- Packet in flight
- Discarded
- Emphasis
Text equivalent of this diagram
| Element | Kind | State |
|---|---|---|
| A · 2001:db8::a | host | Cache: incomplete for ::b |
| L2 | switch | — |
| B · 2001:db8::b | host | — |
| A · 2001:db8::a — L2 | link | up |
| L2 — B · 2001:db8::b | link | up |
A has a packet for 2001:db8::b on-link but no neighbor cache entry. It must learn B’s MAC before the frame can leave.
What changed
- Emphasis on A · 2001:db8::a
- A · 2001:db8::a: Cache → incomplete for ::b
How it works
Neighbor Solicitation (Type 135) asks for a Target Address’s link-layer address or probes a tentative address for DAD. Neighbor Advertisement answers. Neighbor Solicitation Message FormatRFC 4861 · DRAFT STANDARD · September 2007
Router Solicitation / Advertisement carry prefix options, MTU, and Router Lifetime. SLAAC forms addresses from prefixes with the autonomous flag; default routers come from lifetime, not from the address alone. Router Advertisement Message FormatRFC 4861 · DRAFT STANDARD · September 2007
DAD must complete before an address is usable. It depends on solicited-node multicast reaching the segment. Duplicate Address DetectionRFC 4862 · DRAFT STANDARD · September 2007
On the wire
Constructed examples, encoded from the field table below them — not captured traffic.
- IPv6
- Next Header 58 (ICMPv6). Hop Limit 255. For resolution, destination is the solicited-node multicast of the target; for DAD, the same multicast of the tentative address with an unspecified source. RFC 4861
- ICMPv6 Neighbor Solicitation
- Type 135, Code 0, checksum, reserved, Target Address, then optional ND options. RFC 4861
Configure it
interface GigabitEthernet0/0/1 ipv6 address 2001:db8:1::1/64 ipv6 nd prefix 2001:db8:1::/64 ipv6 nd ra lifetime 1800Prefix enables SLAAC when the autonomous bit is set (default on many platforms). Router lifetime 1800 installs this router as default — lifetime 0 would advertise prefixes without being a gateway.
Common mistake: Setting `ipv6 nd ra suppress` on the only uplink while expecting hosts to learn a default router.
RFC 4861 §4.2
ipv6 nd raguard policy HOST-PORTS device-role host interface range GigabitEthernet1/0/1-48 ipv6 nd raguard attach-policy HOST-PORTSHost ports must not forward RAs. Trunks to real routers use a router device-role policy instead.
RFC 6105 §2
Verify
show ipv6 interface GigabitEthernet0/0/1- RA parameters and joined solicited-node groups.
show ipv6 nd raguard policy HOST-PORTS- Policy attached to access interfaces.
Caveats
- Marked draft: RA Guard CLI differs between Catalyst IOS-XE and some router images.
- Also enable edge/portfast on host ports so DAD multicast is not delayed by STP.
When it breaks
Symptom first, because that is what you have when it happens.
A host gets an IPv6 address and cannot reach anything off-link.
Narrow it down
- Check whether a router advertisement is being received at all.
- Read the router lifetime in the advertisement — zero means "do not use me as a default router".
- Confirm the host has a default route, not just an address.
Cause
An address and a default router arrive by the same mechanism but are separate pieces of it. A prefix with the autonomous flag set gives an address; a non-zero router lifetime gives a default route. One without the other is a host that is configured and isolated.
Fix
Check the router lifetime as well as the prefix flags. A device advertising prefixes with a zero lifetime is doing so deliberately and is not your gateway.
Router Advertisement Message FormatRFC 4861 · DRAFT STANDARD · September 2007IPv6 connectivity works intermittently, and hosts pick up addresses from an unexpected prefix.
Narrow it down
- Capture router advertisements and count how many distinct sources are sending them.
- Identify the unexpected source — often a hypervisor, a phone tethering, or a device with connection sharing on.
- Check whether RA Guard is enabled on access ports.
Cause
Anything on the segment can send a router advertisement. Unlike DHCP there is no server to authorise, so a rogue advertisement is accepted on the same terms as a real one.
Fix
Enable RA Guard on every access port. This is the IPv6 equivalent of DHCP snooping and is needed for the same reason.
Model and ApplicabilityRFC 6105 · INFORMATIONAL · February 2011A host is unreachable for the first few seconds after boot, then works normally.
Narrow it down
- Check whether duplicate address detection is running and how long it takes.
- Look for an interface that reports up before the link is actually forwarding.
- Confirm the switch port is an edge port.
Cause
Duplicate address detection must complete before an address is usable, and it needs multicast to be forwarding. A port still in spanning tree listening or learning drops the solicitation, so detection times out rather than completing.
Fix
Make host-facing ports edge ports. The same misconfiguration that delays DHCP delays this, and here it delays every address rather than one.
Duplicate Address DetectionRFC 4862 · DRAFT STANDARD · September 2007Ping to an on-link IPv6 neighbor fails; the host shows incomplete neighbor cache.
Narrow it down
- Capture whether Neighbor Solicitation leaves the sender.
- Check ACLs or wireless client isolation that block ICMPv6 types 135/136.
- Confirm solicited-node multicast is not pruned incorrectly.
Cause
Address resolution never completes. Without a Neighbor Advertisement the cache stays incomplete and upper-layer traffic never gets a destination MAC.
Fix
Permit ND ICMPv6 on the segment and verify multicast forwarding for solicited-node groups.
Sending Neighbor SolicitationsRFC 4861 · DRAFT STANDARD · September 2007Traffic blackholes after a silent failover until something refreshes the neighbor.
Narrow it down
- Check neighbor cache state (REACHABLE vs STALE) on the sending host.
- Look for missing unsolicited NAs from the new owner of the address.
- Compare with IPv4 gratuitous ARP behaviour you expected to mirror.
Cause
Neighbor Unreachability Detection eventually probes, but until then STALE entries may send to an old link-layer address. Failovers that do not announce can leave a window of blackholing.
Fix
Have the taking-over node send unsolicited Neighbor Advertisements; align expectations with NUD timers rather than ARP announce habits alone.
Neighbor Unreachability DetectionRFC 4861 · DRAFT STANDARD · September 2007
Design notes
A host normally has many addresses: link-local, one or more globals, often temporary privacy addresses. “The” IPv6 address is usually the wrong troubleshooting question.
Do not treat Neighbor Discovery as “just ARP.” Router discovery and DAD are first-class failure modes that ARP never had.
NAT64 translates address families; it is not part of NDP. Mixing those vocabularies hides whether the fault is on-link discovery or translation.
Misconceptions
- “Neighbour discovery is ARP for IPv6.”
- It does ARP’s job and several others: router discovery, prefix and parameter discovery, duplicate address detection, and unreachability detection. It also runs inside ICMPv6, so it has a hop limit and can be secured and filtered like any IP traffic — which ARP cannot. IntroductionRFC 4861 · DRAFT STANDARD · September 2007
- “SLAAC means you do not need DHCPv6.”
- SLAAC gives an address and a router. It does not give DNS resolvers unless the router advertisement carries the RDNSS option and the host supports it, which is why many networks run both.
- “A host has one IPv6 address.”
- It normally has several: a link-local, one or more global addresses, often a privacy address that rotates, and any number from other prefixes being advertised. Troubleshooting "the" address of an IPv6 host is usually the wrong question.
More walkthroughs
RA gives prefix and default router separatelybaseline
A host sends RS; the router replies with RA. Prefix options with the autonomous flag build addresses; Router Lifetime installs a default route. One without the other leaves a host configured and isolated.
The host sends Router Solicitation to ask for configuration. It already has a link-local address; it does not yet have a global address or a default router. Host · link-local only: State RS sent. Router · RA. Off-link.
- Link
- Blocking
- Packet in flight
- Discarded
- Emphasis
Text equivalent of this diagram
| Element | Kind | State |
|---|---|---|
| Host · link-local only | host | State: RS sent |
| Router · RA | router | — |
| Off-link | cloud | — |
| Host · link-local only — Router · RA | link | up |
| Router · RA — Off-link | link | up |
The host sends Router Solicitation to ask for configuration. It already has a link-local address; it does not yet have a global address or a default router.
What changed
- Emphasis on Host · link-local only
- Host · link-local only: State → RS sent
DAD needs multicast; rogue RA needs RA Guardfailure
Duplicate Address Detection sends NS for a tentative address and needs multicast forwarding. Separately, any host can send an RA — RA Guard on access ports is the DHCP-snooping equivalent.
The host forms a tentative address and joins its solicited-node multicast. It sends NS with that address as Target. Silence means unique; a defending NA means collision. Host · booting: DAD tentative · probing. Access. Legit RA. Rogue · fake RA.
- Link
- Blocking
- Packet in flight
- Discarded
- Emphasis
Text equivalent of this diagram
| Element | Kind | State |
|---|---|---|
| Host · booting | host | DAD: tentative · probing |
| Access | switch | — |
| Legit RA | router | — |
| Rogue · fake RA | host | — |
| Host · booting — Access | link | up |
| Access — Legit RA | link | up |
| Access — Rogue · fake RA | link | up |
The host forms a tentative address and joins its solicited-node multicast. It sends NS with that address as Target. Silence means unique; a defending NA means collision.
What changed
- Emphasis on Host · booting
- DAD NS: Host · booting → Access
- Host · booting: DAD → tentative · probing
Terms
- SLAAC
- Stateless Address Autoconfiguration: a host forms an IPv6 address from a prefix advertised with the autonomous flag. It does not by itself install DNS resolvers.
- RA Guard
- Access-layer filtering that blocks Router Advertisements on ports that should not send them — the IPv6 counterpart to DHCP snooping for rogue gateway prevention.
- Solicited-node multicast
- A link-local multicast address derived from the low 24 bits of an IPv6 address. Neighbor Solicitations for resolution and DAD are sent here instead of to all nodes.