Simple Procedures for Detecting Network Attachment in IPv6
Extracted elements (29)
False positives (a host incorrectly concluding it has reattached to a previously visited network) are not acceptable, whereas false negatives (failing to recognize a known link and re-running full address configuration) are acceptable. This asymmetry motivates the conservative verification requirements such as matching both IPv6 and MAC addresses in the NA response.
Manually assigned addresses are explicitly excluded from Simple DNA. Probes for manual addresses require aggressive retransmission (no fallback autoconfiguration exists if probes are lost), and a DHCPv6 exchange on a network using manual addressing could cause the host to adopt a dynamic address instead of its manual configuration, inverting the expected precedence.
Simple DNA uses a per-router probing model rather than a per-link model: instead of determining whether the host is on the same link, it probes each previously known router individually. This allows reuse of configuration from any router encountered across multiple prior attachments and optimizes movement between a known set of links.
DHCPv6, as specified in RFC 3315, only attempts to confirm addresses obtained on the most recently attached link. Simple DNA operates alongside DHCPv6 without modifying the DHCPv6 protocol or state machine; DHCPv6 results take precedence over NS/NA results for DHCPv6-assigned addresses.
Simple DNA requires no router modifications; routers following standard RFC 4861 neighbor discovery procedures will delay RAs by 0–500 ms and rate-limit consecutive all-nodes multicast RAs to one per 3 seconds, giving a worst-case 3.5-second delay. NS-based unicast probing bypasses this delay when the host has a valid prior configuration.
Simple DNA shares DNAv4's (RFC 4436) goal of minimizing handover latency on reattachment but differs in mechanism: it supports both SLAAC and DHCPv6 addresses (DNAv4 is IPv4-only) and does not require router modification. The per-router probing approach also differs from DNAv4's per-link approach.
A Simple DNA implementation SHOULD NOT retransmit a Neighbor Solicitation more than twice. To dampen spurious link-up indications, the host SHOULD NOT perform the Simple DNA procedure more than once per second. If any response is received to a unicast NS, pending retransmissions of the same NS MUST be canceled.
After a DHCPv6 address assignment, the host MUST create one SDAT entry for each on-link router associated with the DHCPv6-assigned address.
For each router in the candidate router set (SDAT entries associated with at least one valid address), the host MUST send a unicast Neighbor Solicitation to the router's link-local address and MUST set the link-layer destination to the MAC address stored in the SDAT. The host MUST NOT send unicast NS to a router not associated with any valid address in the SDAT.
If at least one SDAT entry for a given candidate router has the S-Flag set (indicating a prior SEND-secured RA), the host SHOULD use SEND to secure the NS probe sent to that router.
If the host has confirmed reattachment to a previously visited link via NS/NA, it SHOULD NOT perform Duplicate Address Detection on addresses confirmed as operable. If NS probing fails or RS probing returns different prefixes than those in the SDAT, the host MUST begin fresh address configuration as indicated by the received RA.
On receiving a link-layer 'up' indication, the host will initiate a DHCPv6 exchange (per RFC 3315) to verify whether DHCPv6-assigned addresses and configuration are still usable on the link. The Simple DNA procedure does not modify the DHCPv6 protocol or state machine.
On reception of a Router Advertisement from a router known in the SDAT, the host MUST first mark all addresses associated with that router as inoperable, then process the RA per RFC 4861 Section 6.3.4. The RA processing may subsequently restore addresses as operable.
The host SHOULD maintain the SDAT by removing entries when a prefix's valid lifetime expires, removing a router from an SDAT entry when it stops advertising a prefix (after three consecutive RAs without that prefix), and adding a router to an SDAT entry when it begins advertising a prefix that already has an entry.
The host SHOULD send NS-based unicast probes in parallel with the multicast Router Solicitation so that the DNA procedure never runs slower than standard neighbor discovery. A Simple DNA implementation SHOULD limit its NS-based probing to at most six previously seen routers.
Upon receiving a link-layer 'up' indication, the host MUST mark all currently configured non-tentative IP addresses as inoperable and MUST set all Neighbor Cache entries for routers on the Default Router List to STALE, to speed up acquisition of a new default router if a link change has occurred.
When a link-layer 'up' indication is received, the host SHOULD immediately send a single Router Solicitation to the all-routers multicast address (FF02::2) using a valid link-local address as the source. Even if the host holds more than one valid IPv6 address, it MUST send only one RS.
When a Neighbor Advertisement is received in response to an NS probe, the host MUST verify that both the IPv6 and link-layer (MAC) addresses of the router match the expected SDAT values before utilizing the associated configuration. The host MUST then mark all addresses associated with that router in the SDAT as operable.
When a RA creates or modifies an SDAT entry and the RA is protected by SEND, the S-Flag MUST be set to 1 in the corresponding SDAT entries. The host MUST add an SDAT entry for each address configured from autoconfigurable prefixes in the RA, each pre-existing address from those prefixes, and each DHCPv6 address known to be operable.
Where NS/NA and RS/RA results conflict for the same router, the RS/RA result is definitive. Exception: if the NA was SEND-secured but the RA was not, the host MUST wait SEND_NA_GRACE_TIME (40 ms) for a SEND-secured RA before adopting NS/NA conclusions.
Where NS/NA conclusions and DHCPv6 exchange conclusions conflict for a DHCPv6-assigned address, the DHCPv6 exchange result is considered definitive.
SEND_NA_GRACE_TIME is a constant defined as 40 milliseconds: the optional waiting period after a Neighbor Solicitation before adopting a non-SEND RA's link change information when a SEND-secured NA has been received.
The router identifier is formed from the combination of the link-local IPv6 address and the link-layer (MAC) address of a router. This compound identifier is the index key for SDAT entries and is assumed to be unique across links.
The Simple DNA Address Table (SDAT) is a per-interface data structure indexed by router identifier (link-local IPv6 address plus link-layer MAC address of the router). Each entry stores the IPv6 address and its lifetimes, prefix (SLAAC), DHCP-specific parameters (DUID, IAID, IA type), and three flags: D-Flag (SLAAC vs DHCPv6), O-Flag (operable/inoperable), and S-Flag (whether SEND was used in the RA that created the entry).
After receiving a link-up indication, a host may receive spoofed RAs from non-SEND devices. The host SHOULD send a Neighbor Solicitation to its existing SEND router and SHOULD ensure that unsecured RA information does not replace SEND state within MIN_DELAY_BETWEEN_RAS, giving a legitimate SEND router time to respond. If the current default router is SEND-secured, the host SHOULD wait SEND_NA_GRACE_TIME before adopting a new default router.
Unless SEND or another secure address configuration mechanism is used, Simple DNA does not provide authenticated identification of the network. The host MUST NOT make security-sensitive decisions based on DNA alone; in particular it MUST NOT conclude it has moved from an untrusted to a trusted network solely on the basis of the DNA procedure.
Address operability transitions: on link-layer 'up', all non-tentative addresses enter AS_INOPERABLE. On receipt of a confirming NA (matching IPv6 and MAC), associated SDAT addresses transition to AS_OPERABLE. On receipt of an RA from a known router, associated addresses revert to AS_INOPERABLE before standard RA processing may update them.
NS probe messages use a link-local source address, the router's link-local address as both IPv6 destination and ND Target Address, Hop Limit 255, and the router's MAC address as the link-layer destination. The probing node SHOULD include the source link-layer address option.
RS probe messages use a link-local source address, the all-routers multicast address as IPv6 destination, and Hop Limit 255. The probing node SHOULD NOT include the source link-layer address option in the RS.