IPv6 Neighbor Discovery

NDP and Local IPv6 Network Functions

In IPv4, the Address Resolution Protocol (ARP) maps a known IP address to a link-layer address such as a MAC address on the local network. An ARP Request is a broadcast sent to every device on the segment. Each device receives the frame and checks whether it concerns its address, which adds traffic and processing overhead.

IPv6 defines local configuration and neighbor functions through Neighbor Discovery. The protocol uses IPv6 multicast and ICMPv6 messages.

This protocol is the Neighbor Discovery Protocol (NDP). NDP covers link-layer address resolution, router and prefix discovery, redirects, neighbor reachability detection, and interaction with address autoconfiguration. DHCPv6 remains a separate protocol used for address assignment or other parameters. NDP is built on specific ICMPv6 messages.

These messages have defined ICMPv6 types and use link-local scope, so their handling depends on the interface and link. A router does not forward these messages beyond the link to which they apply. NDP does not carry application data; it provides information needed to choose a neighbor, router, and local path.

Multicast Instead of Broadcast for Neighbor Resolution

NDP uses multicast addresses to direct discovery messages toward a group associated with the target address. ARP broadcast and NDP multicast have different link-layer behavior. An NDP receiver parses the ICMPv6 message and its options, then updates the local neighbor-cache state.

• ARP broadcast: An ARP Request is a Layer 2 broadcast sent to the MAC address FF:FF:FF:FF:FF:FF. Interfaces of all devices on the segment receive the frame and filter it by the destination address, which can increase link and device processing overhead. The receiving interface may pass the frame to the host processor even when the request concerns another device.
• NDP - solicited-node multicast: For every unicast or anycast IPv6 address it owns, an interface joins the corresponding multicast group, called the solicited-node multicast address. The address is formed by appending the last 24 bits of the IPv6 address to the prefix FF02::1:FF00:0/104. Several interfaces may join the same group when their addresses end with the same 24-bit value.

When Host A wants to find Host B's link-layer address, it sends a Neighbor Solicitation to Host B's solicited-node address. On Ethernet, an IPv6 multicast address maps to a MAC address in the 33:33 range. A switch can limit the frame's scope when MLD snooping is enabled; without it, multicast may be sent to more ports. This limits Layer 2 forwarding and does not change the IPv6 group-formation rules.

Example:Host A sends a query to the group associated with the last 24 bits of Host B's address. Host B responds with a Neighbor Advertisement, while other hosts do not need to respond.

The Five Core NDP Message Types

NDP defines five types of ICMPv6 messages. They are RS type 133, RA type 134, NS type 135, NA type 136, and Redirect type 137. RS and RA use router groups or a response to a host, NS and NA identify a neighbor target, and Redirect is normally unicast. Each has a separate role in local IPv6 communication.

NDP in Practice: Core Functions

These five message types perform several functions on a local IPv6 network. NDP does not carry application data; it provides information needed to choose a neighbor, router, and local path. The messages contain typed options, such as link-layer addresses, prefixes, and lifetimes, so implementations can update separate pieces of local state.

• Address Resolution (NS & NA): This is the function corresponding to ARP. A host sends a Neighbor Solicitation to the target's solicited-node address. The target responds with a unicast Neighbor Advertisement containing its link-layer address in the Target Link-Layer Address option. The host stores the information in its Neighbor Cache and can send later packets without another query.
• Router and Prefix Discovery (RS & RA):The host sends a Router Solicitation and a router responds with a Router Advertisement. The RA contains prefixes, lifetimes, autoconfiguration flags, and other parameters. The router's link-local source address and Router Lifetime identify the default router. M and O flags can indicate DHCPv6 use for addresses or additional configuration data.
• Duplicate Address Detection - DAD (NS & NA): Before assigning an address, for example one created with SLAAC, a host performs DAD. It sends NS to the solicited-node address for the address it wants to use, with the unspecified source address (::). An NA or NS indicating a conflict causes the address to be rejected. No response permits assignment under the DAD procedure, but does not prove that every collision is absent. IPv4 can use gratuitous ARP for a similar purpose. DAD checks for a conflict on the link and does not authenticate message senders.
• Neighbor Unreachability Detection - NUD (NS & NA):NDP tracks neighbor reachability. An entry in the neighbor cache eventually changes from "REACHABLE" to "STALE". Before using a stale entry, the host initiates reachability confirmation with a unicast Neighbor Solicitation. A Neighbor Advertisement confirms a two-way path. Depending on the response, an entry may pass through the DELAY and PROBE states. REACHABLE reflects successful confirmation, rather than only the presence of an address in the cache. Continued lack of responses causes the entry to be removed from the neighbor cache.

ARP and NDP: Function Comparison