Neighbor Discovery Protocol

The IPv6 protocol, carried in ICMPv6, by which nodes on a link find each other, their routers and link-layer addresses.

Neighbor Discovery (RFC 4861) does what ARP, ICMP Router Discovery and ICMP Redirect did in IPv4, and adds unreachability detection. Every address resolution, router choice and duplicate check on an IPv6 link runs through it, so dropping its messages breaks IPv6 outright.

It is five ICMPv6 messages, types 133 to 137: Router Solicitation and Router Advertisement, Neighbor Solicitation and Neighbor Advertisement, and Redirect. All are sent with a hop limit of 255 and receivers check it, so a message that crossed a router is rejected; fragmented ND messages must be ignored. Resolution takes one multicast solicitation to the target's solicited-node group, carrying the asker's MAC, and one unicast advertisement back, after which both ends hold an entry.

Each Neighbor Cache entry moves through INCOMPLETE, REACHABLE, STALE, DELAY and PROBE. With default timers reachability lasts a random 15 to 45 seconds; a stale entry waits 5 seconds after the next packet, then sends three unicast probes one second apart and is deleted if none is answered.

The protocol trusts the link. Nothing tells a host which neighbours may send Router Advertisements or whether an advertiser owns the address it claims, so rogue RAs, mostly accidental, and spoofed advertisements send packets to unexpected places, and a scan of a /64 can fill a router's cache from off-link. SEND adds signatures but RFC 9099 says it should not be relied upon; RA-Guard, rate limits and right-sized subnets are what is used. On Linux, ip -6 neigh show lists the cache with its states.

Also known as: ndp, nd, neighbor discovery, neighbour discovery, ipv6 neighbor discovery, rfc 4861

Sources

← All glossary entries