Neighbor Unreachability Detection Is Too Impatient
updates
- rfc-4861 — Neighbor Discovery for IP version 6 (IPv6)
Extracted elements (19)
IPv6 NUD is operationally more brittle than IPv4 ARP because RFC 4861 constants (MAX_MULTICAST_SOLICIT, MAX_UNICAST_SOLICIT, RETRANS_TIMER) became conformance test requirements, whereas ARP imposes no mandatory retransmission time limit, allowing implementors to choose more robust behavior.
MAX_RETRANS_TIMER is set to 60 seconds for consistency with DHCPv6, providing a familiar upper bound for operators and ensuring retransmissions do not become so infrequent that link-layer address changes go undetected for excessively long periods.
RFC 4861 NUD timeouts (3 unicast probes, 1 second apart) were optimized for the case where alternative neighbors exist, allowing fast failover. When no alternative neighbor is available, these timeouts are far too short and cause unnecessary multicast traffic and spurious NCE invalidation.
The example algorithm uses BACKOFF_MULTIPLE=3, MARK_UNREACHABLE=3, MAX_UNICAST_SOLICIT=5, and MAX_RETRANS_TIMER=60. This marks the NCE UNREACHABLE after 4 seconds (vs. 2 seconds in RFC 4861), a small additional delay relative to the 30,000 ms default ReachableTime, while providing much greater robustness to transient failures.
When an NCE is prematurely discarded due to short NUD timeouts and there is no alternative neighbor, subsequent IPv6 packets cause multicast Neighbor Solicitations (to the solicited-node multicast address) every second instead of unicast NUD probes, increasing network multicast load. Longer probing also handles transient failures like spanning tree reconvergence.
For RFC 4861 Section 6.3.6 default router preference, an NCE in the UNREACHABLE state is not 'known to be reachable'. The text 'in any state other than INCOMPLETE' must be read as 'in any state other than INCOMPLETE or UNREACHABLE' to correctly deprioritize unreachable default routers.
RetransTimer and ReachableTime continue to be set from protocol constants RETRANS_TIMER and REACHABLE_TIME by default and are overridden by values advertised in Router Advertisements as specified in RFC 4861; this behavior is unchanged by RFC 7048.
RFC 4861 Appendix C state machine for the case 'NA, Solicited=1, Override=0, Different link-layer address than cached' must add UNREACHABLE to the list of states (alongside STALE, PROBE, DELAY) where the NCE is left unchanged.
A node MAY garbage collect a Neighbor Cache Entry at any time as specified in RFC 4861; this freedom is unchanged by the introduction of the UNREACHABLE state. An implementation MAY prefer garbage collecting UNREACHABLE NCEs over others.
A node MUST switch to multicast Neighbor Solicitations within 60 seconds of the initial retransmission, even if it sends some unicast NS while in the UNREACHABLE state, to handle a potential link-layer address change for the target.
A node SHOULD NOT use an NCE created by a Redirect to send packets if that NCE is in the UNREACHABLE state; instead, packets should follow the next-hop selection algorithm in RFC 4861 Section 5.2, which disregards unreachable NCEs.
If an implementation transmits more than MAX_UNICAST_SOLICIT/MAX_MULTICAST_SOLICIT packets, it SHOULD use exponential backoff of the retransmit timer to avoid significant background load from implementations retransmitting large numbers of Neighbor Solicitations.
If no IPv6 packet is sent using an UNREACHABLE NCE, it is RECOMMENDED to stop the multicast NS retransmissions until either the NCE is garbage collected or IPv6 packets are again sent using the NCE.
In places where RFC 4861 says to discard/delete the NCE after N probes (Sections 7.3 and 7.3.3, and Appendix C), an implementation MUST instead transition to the UNREACHABLE state, except that NCEs created by a Redirect MAY be deleted rather than transitioned.
The exponential backoff timer SHOULD be clamped at a reasonable maximum retransmit timeout, such as 60 seconds (MAX_RETRANS_TIMER), to prevent retransmission intervals from growing excessively large.
An example (non-normative) algorithm introduces configurable parameters: BACKOFF_MULTIPLE (exponential base), MAX_RETRANS_TIMER (cap on retransmit interval), and MARK_UNREACHABLE (number of transmissions after which the NCE transitions to UNREACHABLE). The retransmit interval is computed as (BACKOFF_MULTIPLE ^ solicit_retrans_num) * RetransTimer * JitterFactor.
Updated NUD state transition table: PROBE state on retransmit timeout after N retransmissions now transitions to UNREACHABLE (increasing timeout and sending multicast NS) instead of discarding the entry. UNREACHABLE state on retransmit timeout stays in UNREACHABLE (increasing timeout and sending multicast NS).
Relaxing the NUD retransmission behavior is believed to have no security impact. In particular, it does not affect the application of Secure Neighbor Discovery (SEND, RFC 3971).
A new UNREACHABLE state is introduced in the NUD conceptual model. When a PROBE NCE exhausts N retransmissions, it transitions to UNREACHABLE (instead of being discarded). In UNREACHABLE, the NCE retains the cached link-layer address, packets continue to be sent to that address, but NUD probes switch to multicast Neighbor Solicitations with exponential backoff. UNREACHABLE re-transitions to UNREACHABLE on each retransmit timeout.