IPv6 neighbor discovery

Time: 30 min

GNS3 project: v6-a1-linklocal (reuse it)

Do this — the same job in IPv6

Start a capture on the H1 cable.

On H1:

ip -6 neigh flush all
ping -c1 -I eth0 <H2's IPv6 address>

Compare the two captures.

What just happened

• H1 had to first send a Neighbor solicitation message to learn the MAC address of H2, before it could send the actual data packet.
• H3 responded with a Neighbor advertisement
• Both types of messages use ICMP6

• This is NDP — Neighbour Discovery Protocol. IPv6 doesn't use ARP. Rather, it relies on multicasting to achieve the same goal, using ICMP6

Do this — read the destination address

In the capture, find the Neighbour Solicitation and read its destination, at both layers.

What just happened

• The IPv6 destination is not H2's address — H1 does not know it is reachable yet. It is something like ff02::1:ff00:12, a solicited-node multicast address, built by taking the last 24 bits of the address being looked for and pasting them onto a fixed prefix.
• The Ethernet destination is not broadcast either. It is 33:33:ff:00:00:12 — a multicast MAC derived from the multicast IPv6 address in the same mechanical way.
• An interface needs to have joined that multicast group to process it. A NIC that has not joined that multicast group discards the frame in hardware. That is, H3's operating system is never asked to look at the frame at all.
• Any host whose address happens to end in the same 24 bits will join the same group and will have to process the solicitation. Though not perfectly targeted, it significantly reduces the number of hosts interrupted by a soliciation on the segment.
• IPv6 has no broadcast address at all. It was replaced by multicast to reduce the blast radius of of a solicitation, of which there are many types.

Record