Lesson 43 · IPv6

Neighbor Discovery

IPv6 has no ARP and no broadcast. Instead, a set of small ICMPv6 messages called Neighbor Discovery lets a computer check its address is unique, find its router, learn its neighbors' MAC addresses through multicast, keep track of which neighbors are still there, and take a shortcut when the router points one out.

10 min10 steps5 questionsBeginner

Fig 43 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Your computer wants the MAC address of 2001:db8:1::20. Where does it send its Neighbor Solicitation?

IPv6 has no broadcast. The solicited-node group is built from the last 24 bits of the address, so in practice only the owner listens and other computers' network cards drop the frame.

02What does Duplicate Address Detection do?

Until the check passes the address is only "tentative". If another device answers, that address is already taken and must not be used.

03What does a Router Advertisement tell the computers on a link?

In the figure the router offers itself as default router for 1800 seconds and says 2001:db8:1::/64 is on this link. It is sent to ff02::1, all nodes, and also carries the router's own MAC.

04A neighbor cache row says STALE. What does that mean?

REACHABLE lasts roughly 30 seconds after a confirmation. Then the row turns STALE; sending to it leads to a short DELAY and then a direct Neighbor Solicitation (PROBE). A row still waiting for its first answer is INCOMPLETE.

05Why does the router send your computer an ICMPv6 Redirect?

The router still delivers the packet, then tells you the better first hop. When the Redirect's target equals the destination, it means the destination itself is your neighbor.

Key terms

Glossary

Neighbor Discovery (ND): IPv6's set of ICMPv6 messages (RFC 4861) for finding neighbors' MAC addresses, finding routers, checking for duplicate addresses and redirecting traffic. It replaces ARP.
Neighbor Solicitation / Advertisement: The question "who has this IPv6 address?" (ICMPv6 type 135) and its answer "it is at this MAC" (type 136).
Router Solicitation / Advertisement: A host asking "any routers here?" (type 133, to ff02::2) and a router announcing itself and the link's prefix (type 134, to ff02::1).
Multicast: Sending one message to a group address that only devices that joined the group accept, unlike a broadcast that everyone receives.
Solicited-node multicast address: A group like ff02::1:ff00:20 made from the last 24 bits of an IPv6 address, so a Neighbor Solicitation reaches (almost) only the owner.
Neighbor cache: A computer's table of IPv6 neighbors and their MAC addresses, with a state for each row: INCOMPLETE, REACHABLE, STALE, DELAY or PROBE.
Duplicate Address Detection (DAD): The check a computer makes before using an address: a Neighbor Solicitation about it, sent from ::, that nobody should answer.
Link-local address: An IPv6 address starting with fe80:: that only works on the local link. Routers send Neighbor Discovery messages from theirs.

Fine print

Notes and sources

Addresses come from the IPv6 documentation prefix 2001:db8::/32 (RFC 3849); MACs from the documentation block 00:00:5e:00:53:xx (RFC 9542). The short endings ::10, ::20 and ::1 are set by hand so they are easy to read; most computers pick random 64-bit endings (RFC 7217, RFC 8981).
IPv6 multicast rides in Ethernet frames addressed to 33:33 plus the last 32 bits of the group (RFC 2464), so ff02::1:ff00:20 becomes 33:33:ff:00:00:20. A network card ignores groups it has not joined, so unlike an ARP broadcast, other computers are not disturbed. Switches with MLD snooping go further and only send the frame to ports that joined.
Compared with ARP (RFC 826): ARP is its own protocol with its own EtherType and shouts to everyone; Neighbor Discovery is ICMPv6 inside IPv6, uses multicast, and also finds routers, learns the prefix, checks for duplicate addresses and redirects traffic.
Hop limit 255 proves a message came from the same link, but anyone on the link can still lie, just like with ARP. Defences include RA Guard on switches (RFC 6105) and Secure Neighbor Discovery (SEND, RFC 3971), which signs messages but is rarely deployed.
You can see your own neighbor cache with "ip -6 neigh" on Linux, "ndp -a" on macOS, or "netsh interface ipv6 show neighbors" on Windows.

Quiz Unlocks after the last step.