Neighbor Discovery for IP Version 6 (IPv6)
obsoleted by
- rfc-2461 — Neighbor Discovery for IP Version 6 (IPv6)
Extracted elements (30)
Address resolution multicasts are spread across approximately 2^32 solicited-node multicast addresses (one per low-order 32 bits of target address), greatly reducing the number of nodes interrupted by address resolution compared to IPv4 ARP broadcasts.
Link-local addresses are used to uniquely identify routers in RA and Redirect messages so that hosts can maintain router associations even after a site renumbers to new global prefixes, unlike IPv4 where router identity was tied to global addresses.
Router Advertisements use and Redirect messages are required to carry the router's link-layer address in the message rather than requiring a separate address resolution exchange. This reduces round trips and improves responsiveness during router changes.
Setting the IP Hop Limit to 255 in all ND messages and requiring receivers to validate this field makes Neighbor Discovery immune to spoofed ND messages from off-link senders, because routers decrement the Hop Limit and off-link packets arrive with values less than 255.
On NBMA links (X.25, ATM, Frame Relay), address resolution and the delivery mechanism for Router Solicitations/Advertisements are not specified by this document. Redirect, Neighbor Unreachability Detection, and next-hop determination SHOULD be implemented as specified here.
A Router Lifetime of 0 in a Router Advertisement indicates the router is not a default router and SHOULD NOT appear on the default router list. The Router Lifetime applies only to the router's usefulness as a default router, not to other fields or options.
All Neighbor Discovery messages MUST be sent with an IPv6 Hop Limit of 255. Receivers MUST silently discard ND packets with a Hop Limit other than 255. This prevents off-link nodes from injecting ND messages.
In a Redirect message, when the target is the actual endpoint (destination is a neighbor), the Target Address field MUST contain the same value as the ICMP Destination Address. Otherwise the Target Address MUST be the router's link-local address.
Nodes MUST silently discard any ND packet that contains an option with length zero. All option Length fields carry the option size in units of 8 octets, and zero is explicitly invalid.
On link layers that have addresses, the Source Link-Layer Address option MUST be included in multicast Neighbor Solicitations and SHOULD be included in unicast Neighbor Solicitations.
Receivers MUST silently ignore any ND options they do not recognize and continue processing the remainder of the message. This applies to all five ND message types.
The Solicited (S) flag in a Neighbor Advertisement MUST NOT be set in multicast advertisements or in unsolicited unicast advertisements; it is only valid in unicast responses to a specific Neighbor Solicitation.
The Source Address of a Router Advertisement MUST be the link-local address assigned to the sending interface. Similarly, the Source Address of a Redirect message MUST be the link-local address assigned to the interface from which the message is sent.
The Target Address field in Neighbor Solicitation and Neighbor Advertisement messages MUST NOT be a multicast address.
Neighbor Advertisement (ICMP Type 136): carries R (Router), S (Solicited), and O (Override) flags plus a 128-bit Target Address. Used both as a response to Neighbor Solicitations and as unsolicited announcements of link-layer address changes.
Neighbor Solicitation (ICMP Type 135): sent to determine a neighbor's link-layer address or to verify reachability. Sent multicast to the solicited-node address for address resolution, or unicast when probing a known neighbor. Carries a 128-bit Target Address field.
Redirect (ICMP Type 137): sent by routers to inform a host of a better first-hop for a destination. Contains a 128-bit Target Address (better next-hop or the neighbor itself) and a 128-bit Destination Address, with an optional Target Link-Layer Address and Redirected Header.
Router Advertisement (ICMP Type 134): sent periodically or in response to a Router Solicitation. Contains Cur Hop Limit (8-bit), M and O flags (1-bit each), Router Lifetime (16-bit, seconds), Reachable Time (32-bit, ms), and Retrans Timer (32-bit, ms), plus optional Prefix Information and MTU options.
Router Solicitation (ICMP Type 133): sent by hosts to prompt routers to generate Router Advertisements immediately. Source address is the interface address or the unspecified address; destination is typically the all-routers multicast address FF02::2.
The Destination Cache maps destination IP addresses to next-hop neighbor IP addresses, and is updated by Redirect messages. The Prefix List and Default Router List drive next-hop determination; the Default Router List favors routers with confirmed reachability.
The Neighbor Cache maps a neighbor's on-link unicast IP address to its link-layer address, IsRouter flag, reachability state, unanswered probe count, and next NUD event time. It also holds a queue of packets pending address resolution completion.
The solicited-node multicast address is formed by appending the low-order 32 bits of a target's IP address to the 96-bit prefix FF02::1:0:0/96, yielding an address in FF02::1:0:0 to FF02::1:FFFF:FFFF. Addresses differing only in high-order bits map to the same solicited-node address.
This document defines five ICMPv6 message types for Neighbor Discovery: 133 (Router Solicitation), 134 (Router Advertisement), 135 (Neighbor Solicitation), 136 (Neighbor Advertisement), 137 (Redirect), and five ND option types: 1 (Source Link-Layer Address), 2 (Target Link-Layer Address), 3 (Prefix Information), 4 (Redirected Header), 5 (MTU).
Nodes that change their link-layer address can multicast unsolicited Neighbor Advertisements to notify neighbors quickly; however, this mechanism is unreliable and not authenticated. The Neighbor Unreachability Detection algorithm provides the authoritative, if slower, resolution.
Without the IP Authentication Header, Neighbor Discovery messages are vulnerable to various attacks including rogue Router Advertisements, spoofed Neighbor Advertisements that poison caches, and fabricated Redirect messages. The Hop Limit = 255 check provides only on-link protection.
Neighbor Cache entries cycle through five reachability states: INCOMPLETE (address resolution in progress), REACHABLE (confirmed reachable within ReachableTime), STALE (no longer confirmed reachable; no probe sent until traffic is sent), DELAY (traffic sent recently; waiting for upper-layer confirmation before probing), PROBE (unicast NS probes being sent to verify reachability).
All ND options share a common TLV structure: Type (8-bit), Length (8-bit, value in units of 8 octets; value 0 is invalid), followed by type-specific data. Defined option types are: 1=Source Link-Layer Address, 2=Target Link-Layer Address, 3=Prefix Information, 4=Redirected Header, 5=MTU.
MTU option (Type=5, Length=1): 16-bit Reserved field followed by a 32-bit unsigned integer MTU value. Used in Router Advertisements to ensure all nodes on a variable-MTU link use the same MTU.
Prefix Information option (Type=3, Length=4): Prefix Length (8-bit), L-bit (on-link flag), A-bit (autonomous address configuration flag), Valid Lifetime (32-bit, seconds; 0xffffffff=infinity), Preferred Lifetime (32-bit, seconds; 0xffffffff=infinity), Reserved2 (32-bit), Prefix (128-bit).
Source/Target Link-Layer Address option (Type=1/2): variable-length link-layer address following the 2-byte Type/Length header; length in 8-octet units (e.g., Length=1 for IEEE 802 Ethernet addresses). Format and byte ordering are link-type specific.