13.2 ICMPv6, NDP, and Address Autoconfiguration

After an IPv6 host joins a link, it must verify that its address doesn't conflict with another device, discover a router, learn the prefix, and resolve the link-layer address of neighboring devices. These capabilities are primarily handled by ICMPv6 Neighbor Discovery. Disabling ICMPv6 entirely effectively cuts off the IPv6 host's control loop.

NDP Goes Beyond "IPv6 ARP"

Neighbor Discovery Protocol (NDP) uses five types of ICMPv6 messages:

Message	Type	Primary Function
Router Solicitation (RS)	133	A host requests a router to send a Router Advertisement (RA) promptly
Router Advertisement (RA)	134	Announces default routes, prefixes, and other link-layer parameters
Neighbor Solicitation (NS)	135	Performs address resolution, detects neighbor reachability, and conducts duplicate address detection
Neighbor Advertisement (NA)	136	Responds to a Neighbor Solicitation or proactively advertises changes in neighbor information
Redirect	137	A router informs a host about a more suitable next hop on the same link

ICMPv6 also supports Path MTU Discovery (PMTUD), error reporting, and path probing through Packet Too Big, Destination Unreachable, and Time Exceeded messages. Security policies should finely filter ICMPv6 messages based on function and scope, rather than simply dropping all ICMPv6 traffic.

Getting a Solicited-Node Multicast from a Unicast Address

Address resolution does not broadcast to all nodes. Each node joins the corresponding solicited-node multicast group for every unicast or anycast address it owns:

unicast:              2001:db8::1234:5678
low 24 bits:                    34:5678
solicited-node group: ff02::1:ff34:5678
Ethernet multicast:   33:33:ff:34:56:78

When the sender initiates an NS message to a target address, it sends the request to this multicast group. Nodes that share the same low 24 bits of the address may also receive the request, so the receiver must still verify the Target Address in the NS message.

import ipaddress


def solicited_node(address: str) -> ipaddress.IPv6Address:
    target = int(ipaddress.IPv6Address(address))
    prefix = int(ipaddress.IPv6Address("ff02::1:ff00:0"))
    return ipaddress.IPv6Address(prefix | (target & 0xFFFFFF))


assert str(solicited_node("2001:db8::1234:5678")) == "ff02::1:ff34:5678"

Neighbor Cache Is Not a Permanent ARP Table

NDP maintains neighbor reachability states. Common states include:

State	Meaning
INCOMPLETE	Resolving the link-layer address
REACHABLE	Recent evidence indicates the neighbor is reachable
STALE	The entry exists, but reachability evidence has expired
DELAY	Pausing active probing, waiting for upper-layer confirmation
PROBE	Sending unicast NS probes
FAILED	Resolution or reachability confirmation failed

On Linux, view the states with:

ip -6 neigh show

STALE does not mean failure. It indicates that the neighbor may enter a follow-up confirmation process when needed; treating all non-REACHABLE entries as unreachable would result in false positives.

Duplicate Address Detection

Before an address is put into regular use, a node typically performs Duplicate Address Detection (DAD): it sends Neighbor Solicitation (NS) messages using an unspecified address :: as the source. If the node receives a Neighbor Advertisement (NA/NS) indicating that the address is already in use, it should not activate that address.

Check the Linux address state:

ip -6 address show

In the output, tentative indicates that DAD has not yet completed, while dadfailed signifies a DAD failure. DAD reduces the risk of address conflicts on the same link, but it does not provide cryptographic proof of ownership.

What RA Provides

Hosts can send RS requests to announce their presence, and routers also periodically send RA messages. RA messages and their options may include:

• Router Lifetime: the duration during which this router can serve as a default gateway;
• Prefix Information Option: on-link prefix information and the autonomous address configuration flag;
• MTU (Maximum Transmission Unit);
• Reachable time and retransmission timer recommendations;
• RDNSS/DNSSL: recursive DNS servers and search domains;
• Route Information Option: more specific routing information.

The L and A flags in the prefix option have distinct meanings: L indicates that the prefix can be used for on-link determination; A indicates that the prefix can be used for SLAAC. These two flags should not be treated as equivalent or interchangeable.

The M/O flags in RA can signal the presence of stateful address configuration or other DHCPv6-related information, but client behavior and operating system policies cannot be fully described by these two flags alone. Deployment must include targeted validation of behavior on the specific client platforms in use.

The Complete SLAAC Process

A typical process on a regular host:

1. Form a link-local address
2. Perform DAD on the candidate address
3. Send an RS message, or wait for an RA message
4. Construct an address from the prefix information marked with the A flag
5. Perform DAD on the newly formed address
6. Learn default router, on-link prefix, MTU, and other parameters from the RA message
7. Manage the address lifecycle based on preferred and valid lifetimes

Once an address exceeds its preferred lifetime, it becomes deprecated and may still be used by existing connections, but new connections typically avoid using it as a source address. After the valid lifetime expires, the address is no longer valid.

Interface ID Should No Longer Default to MAC-Based EUI-64

Early textbooks often used modified EUI-64 to derive a 64-bit interface identifier from a MAC address. While this makes the bit structure easier to explain, it enables cross-network correlation of addresses and exposes link-layer identifiers.

Modern hosts typically combine two mechanisms:

• RFC 7217: Generates a stable, opaque interface identifier for each prefix, without exposing the underlying MAC address;
• RFC 8981: Creates temporary addresses with a finite lifetime, reducing the ability to track addresses over time.

The specific default values are determined by the operating system. A single interface may simultaneously hold link-local addresses, stable addresses, temporary addresses, and DHCPv6 addresses. Applications should not assume that "one network interface equals one IP address."

SLAAC and DHCPv6 Are Not Mutually Exclusive

Capability	RA/SLAAC	DHCPv6
Default Route	Provided by RA	DHCPv6 typically does not replace RA-provided default routes
Address Assignment	SLAAC can assign addresses	Stateful DHCPv6 can provide leased addresses
DNS Information	RDNSS/DNSSL options in RA can supply DNS details	DHCPv6 can also provide DNS information
Additional Configuration	RA options are limited	DHCPv6 can carry more extensive configuration data

Common deployment scenarios include SLAAC-only, SLAAC combined with stateless DHCPv6, and RA paired with stateful DHCPv6. Client support is critical, some end platforms handle DHCPv6 address configuration differently than desktop systems.

Observe Rather Than Forge NDP

Prioritize observing packets generated by the operating system rather than using Scapy to forge RA/NA messages in a real local network. Malicious or erroneous RA messages can alter the default routing and DNS configurations of hosts on the same link.

# Address, Routing, and Neighbor Status
ip -6 address show
ip -6 route show
ip -6 neigh show

# Observe only on the current interface NDP
sudo tcpdump -i eth0 -nn 'icmp6 && ip6[40] >= 133 && ip6[40] <= 137'

The fixed filter using ip6[40] to read packet types is only suitable for packets with ICMPv6 immediately following the basic header and no extension headers. A more robust offline analysis should have the protocol parser traverse the Next Header chain, or use Wireshark's icmpv6.type display filter.

Security Boundaries

NDP by default does not authenticate, making it vulnerable to attacks such as forged RA and NA messages, neighbor cache exhaustion, and other link-layer spoofing threats. While SEND defines cryptographic protections, these are not widely deployed in practice, so it's incorrect to claim that "NDP is inherently secure."

Common mitigation strategies include:

• RA Guard and trusted port policies within switched networks;
• DHCPv6 Guard, control-plane rate limiting, and protection against neighbor table overflow;
• Wireless access isolation, 802.1X authentication, and layer-2 security controls;
• Monitoring for anomalous RA messages, prefix advertisements, default route changes, and neighbor state transitions.

RA Guard itself must support proper implementation features such as extension header awareness, merely enabling a switch setting is insufficient to eliminate the attack surface.

Troubleshooting Checklist

When encountering "an IPv6 address exists but access fails," verify the following based on evidence:

1. Is the address still tentative or has it been dadfailed?;
2. Is there a link-local address in place along with a valid default route?;
3. Has the RA lifetime associated with the default route expired?;
4. Is the destination on-link or routed through a router? What is the neighbor entry state?;
5. Does the firewall permit essential ICMPv6 traffic, particularly Packet Too Big and NDP messages?;
6. Is the source address selection using an inappropriate or deprecated address?;
7. Has the container or namespace received a RA, or is routing instead statically configured by the platform?

Lesson Summary

NDP integrates address resolution, router discovery, DAD (Duplicate Address Detection), and neighbor reachability confirmation into ICMPv6. SLAAC is responsible for generating and maintaining addresses based on router advertisements, with RA remaining the primary source for default routing. DHCPv6 can supplement or take over certain configuration tasks, but it cannot simply replace RA.

The next lesson explores the challenges these mechanisms face when deployed in real-world applications: DNS, address selection, Happy Eyeballs, IPv6-only environments, and NAT64.

Specification Entry Points

• RFC 4861: Neighbor Discovery for IPv6;
• RFC 4862: IPv6 Stateless Address Autoconfiguration;
• RFC 7217: Stable and Opaque Interface Identifiers;
• RFC 8981: Temporary Address Extensions;
• RFC 8106: IPv6 Router Advertisement Options for DNS Configuration;
• RFC 8415: DHCP for IPv6.