Duplicate Address Detection Proxy
Extracted elements (23)
6LoWPAN Neighbor Discovery (RFC 6775) was rejected because its Address Registration Option requires modifications to all host nodes, whereas DAD-Proxy requires changes only to the first-hop router.
ND Proxy (RFC 4389) is insufficient because the AN only forwards ND messages to the BNG (not to other CPEs), and the BNG must not forward link-local scoped messages between CPEs, making ND Proxy deployment on either node ineffective for cross-CPE DAD.
Standard DAD (RFC 4862) cannot work in a point-to-multipoint network with a split-horizon forwarding scheme because the Access Node forwards NS messages only to the BNG, never to other CPEs, so a CPE performing DAD never receives a reply from a conflicting peer.
The IPv6 Mobility Manager proxy approach (RFC 6275) was rejected for DSL/Fiber access networks because it multicasts NA messages on the home link, which violates operator requirements for security and scalability that demand NA messages be received only by the NS sender.
The mechanism is explicitly described as 'not completely reliable' because it is strongly based on DAD, which itself is not reliable; the document's goal is to enable DAD to function in split-horizon topologies, not to improve DAD's fundamental reliability properties.
DAD-Proxy is incompatible with SEND (RFC 3971) because the proxy cannot sign ND messages with the CGA private key. RFC 6496 provides a standards-track solution and SHOULD be deployed alongside DAD-Proxy to restore SEND compatibility.
Both the BNG and CPEs MUST support unicast transmission on the link layer of IPv6 multicast messages (RFC 6085) in order to generate and process the unicast NA used to signal DAD failure.
Each entry in the Binding Table MUST contain an IPv6 Address field and a Link-layer Address field.
Implementations SHOULD allow an operator to query the current occupancy level of the Binding Table to determine if it is approaching full capacity.
On receipt of an unsolicited NA for an IPv6 address already in the Binding Table, each entry associated with that address MUST be updated: the link-layer address is replaced by the one in the unsolicited NA.
The Binding Table MUST be large enough for the deployment; if separate from the Neighbor Cache it MUST be at least as large. Implementations MUST state their fixed or maximum configurable Binding Table size.
The BNG MUST check the reality of a potential address conflict by triggering NUD (RFC 4861 Section 7.3.1) for the existing address owner IPv6-CPE1 as though a packet had to be sent to it.
The BNG SHOULD support logging and alarm emission whenever a duplicate IPv6 address is detected, and SHOULD provide an operator interface to view logs and current Binding Table entries.
When a potential conflict is detected (different link-layer source) and IPv6-CPE1 is not in the Neighbor Cache, the BNG MUST create a STALE Neighbor Cache entry for IPv6-CPE1 using Link-layer-CPE1 from the Binding Table, then immediately confirm reachability via NUD.
When an entry exists and the NS link-layer source matches the existing entry (same CPE still performing DAD), the BNG MUST NOT reply or forward the NS message.
When NUD yields a negative result (IPv6-CPE1 removed from Neighbor Cache), the BNG MUST delete the conflicting Binding Table entry and replace it with a new entry mapping the same IPv6 address to Link-layer-CPE2.
When NUD yields a positive result (real conflict confirmed), the BNG MUST reply to the DAD-performing CPE2 with a unicast NA message: L2 destination is Link-layer-CPE2, IPv6 destination is all-nodes multicast, Target Address is the conflicting tentative address, and Target Link-layer Address is the BNG's receiving interface address.
When the BNG receives a DAD NS and no entry exists for the tentative address, the BNG MUST create a Binding Table entry (tentative address + link-layer source from NS) and MUST NOT reply to the CPE or forward the NS.
The DAD-failure NA message sent by the BNG uses: L2 source = BNG interface address, L2 destination = Link-layer-CPE2; IPv6 source = BNG interface address, IPv6 destination = all-nodes multicast; ICMPv6 Target Address = conflicting tentative IPv6 address, Target Link-layer Address = BNG receiving interface L2 address.
The DAD-Proxy Binding Table, maintained per point-to-multipoint domain (e.g., per VLAN), stores one entry per known IPv6 address. Each entry contains two fields: an IPv6 Address and a Link-layer Address.
DAD-Proxy does not interoperate with SEcure Neighbor Discovery (SEND, RFC 3971) because the BNG does not hold the private key of the CGA needed to sign proxied ND messages. RFC 6496 (Secure Proxy ND Support for SEND) SHOULD be implemented on both BNG and CPEs to address this.
To protect against IP source address spoofing in data packets, DAD-Proxy can be combined with Source Address Validation Improvement (SAVI) mechanisms (RFC 6620, SAVI-SEND, SAVI-MIX), with the BNG acting as the SAVI device and CPE MAC addresses as Binding Anchors.
The DAD-Proxy state machine (Appendix A) defines four states/events: DAD-NS reception (no entry → create entry; entry exists → Existing Entry event), Existing Entry (same L2 → no action; different L2 → Conflict? event), Conflict? (in NC with correct L2 → Reachable? event; not in NC → create STALE NC entry, then Reachable? event), Reachable? (NUD negative → update Binding Table to CPE2; NUD positive → send NA).