Table of Contents
Overview
Neighbor Discovery in IPv6 is the collection of mechanisms that lets IPv6 devices discover each other on the same link, learn each other's addresses, find routers, and keep track of which neighbors are reachable. It replaces and extends several IPv4 mechanisms such as ARP, some parts of ICMP, and router discovery. Neighbor Discovery uses ICMPv6 messages that travel only within the local network segment, not across routers.
Understanding Neighbor Discovery is essential to see how an IPv6 node can join a network, find a router, get its configuration, and then send packets efficiently to local neighbors.
Roles and Functions
IPv6 Neighbor Discovery covers several distinct tasks on a local link:
It lets hosts discover routers on the link. A host learns which devices are routers and which default gateway it should use.
It lets nodes discover link layer addresses of neighbors, so a device can map an IPv6 address to a MAC address or other link layer identifier.
It allows routers to advertise prefix information and configuration flags, which are used by features such as SLAAC.
It provides a way to detect duplicate addresses on the link, so that two devices do not use the same IPv6 address at the same time.
It monitors reachability of neighbors, so that a node can stop sending traffic to a neighbor that is no longer reachable and can try to find an alternative next hop.
All these tasks are built on a small set of ICMPv6 messages, which work together as a protocol suite.
Neighbor Discovery Messages
Neighbor Discovery primarily uses five ICMPv6 message types. Each one has a specific purpose on the local link.
| ICMPv6 Message | Direction | Main Purpose |
|---|---|---|
| Router Solicitation (RS) | Host to routers | Ask for router information and configuration |
| Router Advertisement (RA) | Routers to hosts | Announce router presence and prefix information |
| Neighbor Solicitation (NS) | Node to node | Ask for link layer address or check reachability |
| Neighbor Advertisement (NA) | Node to node | Reply with link layer address or reachability info |
| Redirect | Router to host | Suggest a better next hop for a destination |
All of these are ICMPv6 messages and carry information specific to IPv6 Neighbor Discovery, such as options for link layer addresses or prefixes.
Neighbor Discovery uses ICMPv6, not ARP, for mapping IPv6 addresses to link layer addresses and for router discovery.
Router Discovery and Configuration
A critical part of Neighbor Discovery is how hosts learn about routers and network configuration. This is mainly done through Router Solicitation and Router Advertisement messages.
When a host joins an IPv6 network, it does not yet know which routers are present. It can passively wait for periodic Router Advertisements, or actively send a Router Solicitation to the all routers multicast address. Routers listen for these solicitations and reply with Router Advertisements.
A Router Advertisement includes several important fields and options. It identifies the sender as a router, and it can contain one or more prefix information options, which tell hosts which IPv6 prefixes exist on the link. It also includes flags that tell hosts whether to use SLAAC, DHCPv6, or both, for address and other configuration information. Router Advertisements may also include details such as the default router lifetime and link MTU.
Through this exchange, a host learns which routers to use as default gateways and which prefixes apply on the local link. All of this is confined to the local network segment, and no external server is required.
Address Resolution on the Local Link
IPv6 address resolution, which is what ARP did in IPv4, is handled by Neighbor Solicitation and Neighbor Advertisement messages. When a node wants to send a packet to a neighbor on the same link, it needs the neighbor's link layer address, for example the MAC address on Ethernet.
If a node does not have an entry for the destination IPv6 address in its neighbor cache, it sends a Neighbor Solicitation to a special solicited-node multicast address that corresponds to the target IPv6 address. This design reduces the number of nodes that need to process the request, because only nodes with matching addresses listen to that solicited-node group.
The node that owns the target IPv6 address responds with a Neighbor Advertisement. The advertisement includes the sender's link layer address, which the original node stores in its neighbor cache. From that point, the node can send frames directly to the neighbor using the learned link layer address.
IPv6 address resolution uses Neighbor Solicitation to a solicited-node multicast address and Neighbor Advertisement responses, not broadcast traffic.
Duplicate Address Detection
Before a node starts using an IPv6 address on a link, it must verify that no other node is already using the same address. This process is called Duplicate Address Detection, and it also uses Neighbor Solicitation and Neighbor Advertisement messages.
When a node wants to configure an address on an interface, it treats that address as tentative. It sends a Neighbor Solicitation message that targets the address it wants to use, again using the appropriate solicited-node multicast address. The source address of this message is either unspecified or a valid existing address on the interface, depending on the situation.
If another node on the link already has this address configured, that node will respond with a Neighbor Advertisement. When the original node receives such a response, it knows the address is already in use and must not assign it to its interface.
If no Neighbor Advertisement is received within a defined period, the node concludes that the address is not in use and transitions it from tentative to preferred, which means it can now use it for normal communication.
An IPv6 node must not use an address on a link until Duplicate Address Detection completes without any conflicting Neighbor Advertisement response.
Neighbor Cache and Reachability
Each IPv6 node maintains a neighbor cache, which is a table that stores information about recent neighbors. This is similar in purpose to an ARP cache in IPv4, but it includes more state information. Entries can contain the neighbor's IPv6 address, link layer address, and a state that indicates how recently and how successfully the neighbor has been contacted.
Typical neighbor states include:
| State | Meaning |
|---|---|
| Incomplete | Address resolution is in progress, link layer address unknown |
| Reachable | Neighbor is known to be reachable recently |
| Stale | Address known, but reachability information is old |
| Delay | Waiting briefly before probing reachability |
| Probe | Actively sending Neighbor Solicitations to verify reachability |
These states are updated on the basis of traffic. For example, when upper layer protocols receive acknowledgments from a neighbor, this is evidence that the neighbor is reachable. When the timer associated with the reachable state expires, the entry can move to stale.
If the node needs to send traffic to a neighbor in a stale state, it may first use existing information and then trigger active probing by sending a unicast Neighbor Solicitation. If no response is received after a number of attempts, the neighbor may be considered unreachable and the entry removed or marked as failed. At that point, new routing decisions or address resolution may be attempted.
Redirect Messages
Neighbor Discovery also provides a way for routers to inform hosts about a better next hop for certain destinations on the same link. This is done through Redirect messages.
When a host sends traffic to a router as its default gateway, the router might see that there is a more direct path to the destination through another router or directly to a neighbor on the same link. The router can then send an ICMPv6 Redirect message back to the host. The redirect message tells the host which next hop to use for that particular destination address or prefix.
The host updates its neighbor cache or routing information so that subsequent packets take the more efficient path. This process improves efficiency on the local link without manual configuration. It does not change routing behavior across different networks, only within that particular link between the host and its immediate routers and neighbors.
Security Considerations
Because Neighbor Discovery relies on unauthenticated ICMPv6 messages by default, it is vulnerable to several possible attacks on a local segment. A malicious node could send fake Router Advertisements and cause hosts to use it as a default router or to adopt incorrect prefixes. An attacker could send forged Neighbor Advertisements to redirect traffic intended for another host, or to perform denial of service by asserting that certain addresses are already in use or unreachable.
To address these issues, there is a security extension called Secure Neighbor Discovery, or SEND, which uses cryptographic mechanisms and certificates to validate Neighbor Discovery messages. However, SEND is complex and not widely deployed in many environments.
Network administrators often use alternative protections, such as RA guard on switches, which filters unauthorized Router Advertisements, and other first hop security features. Neighbor Discovery behavior is also monitored with tools that can capture ICMPv6 messages and reveal unexpected or malicious traffic patterns.
Even without deep security mechanisms, it is important to understand that Neighbor Discovery traffic occurs on the local link and that any node on that link can potentially influence other nodes through these messages. Proper network segmentation and configuration can reduce risk in many scenarios.