Neighbor Discovery for IP Version 6 (IPv6)
obsoleted by
- rfc-4861 — Neighbor Discovery for IP version 6 (IPv6)
obsoletes
- rfc-1970 — Neighbor Discovery for IP Version 6 (IPv6)
updated by
- rfc-4311 — IPv6 Host-to-Router Load Sharing
Extracted elements (27)
Neighbor Solicitations target solicited-node multicast addresses derived from the low-order 24 bits of the target's address, spreading address resolution across 2^32 multicast groups. This greatly reduces address-resolution-related interrupts on non-target nodes compared to IPv4 ARP broadcast, and avoids interrupting non-IPv6 machines entirely.
Routers are identified in Router Advertisements and Redirect messages by their link-local addresses rather than global unicast addresses. This allows hosts to maintain correct router associations across site renumbering events where global prefixes change but link-local addresses remain stable.
Setting Hop Limit to 255 and discarding packets with any other value makes Neighbor Discovery immune to off-link senders that accidentally or intentionally inject ND messages. In IPv4, off-link senders could freely send ICMP Redirects and Router Advertisements. This was chosen as a lightweight, always-available guard requiring no cryptographic infrastructure.
Unsolicited Neighbor Advertisements are described as a performance enhancement only (unreliable), not a correctness mechanism. The Neighbor Unreachability Detection algorithm independently ensures all nodes reliably discover changed link-layer addresses, at the cost of potentially longer convergence delay.
On NBMA links (X.25, ATM, Frame Relay), address resolution and the delivery mechanism for Router Solicitations/Advertisements are not specified by this document; only Redirect, Neighbor Unreachability Detection, and next-hop determination are required as described. Hosts on NBMA links may dynamically acquire neighbor link-layer addresses from Redirect messages if manual default router configuration is supported.
The Prefix Information, Redirected Header, and MTU options each specify that they MUST be silently ignored when appearing in ND messages other than their designated message type (RA for Prefix Information and MTU; Redirect for Redirected Header). This allows future option reuse across message types without breaking existing implementations.
All ND messages MUST be sent with an IPv6 Hop Limit of 255, and receivers MUST silently discard any ND message received with a Hop Limit other than 255. This prevents off-link nodes from injecting forged ND messages.
In a Redirect message, when the target is the actual communication endpoint (i.e., the destination is an on-link neighbor), the Target Address MUST contain the same value as the Destination Address. Otherwise the target is a better first-hop router and the Target Address MUST be the router's link-local address.
Nodes MUST silently discard an ND packet containing an option with a Length field of zero. Receivers MUST silently ignore any options they do not recognize and continue processing the remainder of the message.
The Override (O) flag SHOULD NOT be set in solicited advertisements for anycast addresses or in solicited proxy advertisements. It SHOULD be set in all other solicited advertisements and in unsolicited advertisements so that receivers update their cached link-layer addresses.
The Solicited (S) flag in a Neighbor Advertisement MUST NOT be set in multicast advertisements or in unsolicited unicast advertisements. The Router (R) flag indicates the sender is a router and is used by NUD to detect a router that transitions to a host.
The source address of a Router Advertisement MUST be the link-local address assigned to the sending interface. Similarly, the source address of a Redirect MUST be the link-local address of the interface from which the Redirect is sent.
The Source Link-Layer Address option MUST NOT be included in a Neighbor Solicitation or Router Solicitation when the source IP address is the unspecified address. In multicast Neighbor Solicitations it MUST be included; in unicast Neighbor Solicitations it SHOULD be included.
The Target Link-Layer Address option MUST be included in Neighbor Advertisements responding to multicast solicitations on link layers that have addresses, to prevent infinite NS recursion. When responding to unicast solicitations, including this option SHOULD be done but is not strictly required.
Hosts maintain four conceptual data structures per interface: Neighbor Cache (per-neighbor link-layer address, IsRouter flag, and NUD state), Destination Cache (next-hop mapping updated by Redirects), Prefix List (on-link prefixes from RAs with invalidation timers; link-local prefix has infinite lifetime), and Default Router List (routers from RAs, favoring reachable routers).
Neighbor Discovery defines five ICMPv6 message types: Router Solicitation (Type 133), Router Advertisement (Type 134), Neighbor Solicitation (Type 135), Neighbor Advertisement (Type 136), and Redirect (Type 137). Together these support router discovery, prefix discovery, address resolution, neighbor unreachability detection, and redirect functions.
Next-hop determination performs a longest prefix match against the Prefix List: if the destination is on-link the next hop equals the destination itself; otherwise a router is selected from the Default Router List. Results are cached in the Destination Cache. If the Default Router List is empty, the destination is assumed on-link.
The Router Advertisement M-bit (Managed address configuration) instructs hosts to use a stateful protocol (e.g., DHCPv6) in addition to stateless autoconfiguration. The O-bit (Other stateful configuration) instructs hosts to use a stateful protocol for non-address configuration. A Router Lifetime of zero means the router SHOULD NOT appear on the default router list.
Without the use of IPsec Authentication Headers, ND is vulnerable to attacks by on-link nodes, including rogue Router Advertisements, Neighbor Cache poisoning, and spoofed Neighbor Solicitations/Advertisements. The Hop Limit=255 mechanism provides protection only against off-link attackers; it cannot protect against malicious nodes on the same link.
Each Neighbor Cache entry passes through five reachability states driven by NUD: INCOMPLETE (address resolution in progress, link-layer address unknown), REACHABLE (recently confirmed reachable), STALE (reachability unknown, no probe sent yet), DELAY (traffic sent recently, waiting for upper-layer confirmation before probing), and PROBE (sending unicast NS probes to actively verify reachability).
All ND options use a TLV format: Type (8-bit) and Length (8-bit, in units of 8 octets including Type and Length fields). Length=0 is invalid and MUST cause silent discard of the enclosing packet. Five option types are defined: Source Link-Layer Address (1), Target Link-Layer Address (2), Prefix Information (3), Redirected Header (4), MTU (5).
Neighbor Advertisement (Type 136) carries three 1-bit flags (R=Router, S=Solicited, O=Override), a 29-bit Reserved field (initialized to zero, ignored), and a 128-bit Target Address (MUST NOT be multicast). The S-bit serves as reachability confirmation for NUD; the O-bit controls whether the advertisement overrides an existing cached link-layer address.
Neighbor Solicitation (Type 135) carries a 32-bit Reserved field and a 128-bit Target Address, which MUST NOT be a multicast address. Source is either an assigned address or the unspecified address (during DAD); destination is the solicited-node multicast address corresponding to the target or the target address itself.
Prefix Information option (Type 3, Length 4) carries: Prefix Length (8-bit, 0-128), L-bit (on-link flag), A-bit (autonomous address-configuration flag), Valid Lifetime (32-bit, seconds), Preferred Lifetime (32-bit, seconds), Reserved2 (32-bit), and Prefix (128-bit). All-ones lifetime (0xffffffff) represents infinity.
Redirect (Type 137) carries a 32-bit Reserved field, a 128-bit Target Address (the better first-hop), and a 128-bit Destination Address (the redirected destination). Source MUST be the link-local address of the sending interface; destination is the source of the triggering packet; Hop Limit is 255.
Router Advertisement (Type 134) carries: Cur Hop Limit (8-bit unsigned), M flag (1-bit managed address configuration), O flag (1-bit other stateful configuration), Reserved (6-bit), Router Lifetime (16-bit, seconds, max ~18.2 hours), Reachable Time (32-bit, milliseconds), and Retrans Timer (32-bit, milliseconds). Source MUST be the interface link-local address; Hop Limit is 255.
Router Solicitation (Type 133) carries a 32-bit Reserved field (initialized to zero, ignored by receiver) and an optional Source Link-Layer Address option. IP source is an assigned interface address or the unspecified address; destination is typically FF02::2 (all-routers); Hop Limit is 255.