Enhanced Duplicate Address Detection
updates
Extracted elements (19)
Enhanced DAD is intentionally limited to DAD operations only. Extending it to all ND solicitations and advertisements is theoretically possible but would increase implementation complexity and memory usage on the sender node, which must store nonce state for all tracked ND messages.
In the rare collision case where two nodes use the same target address and generate the same random nonce, the algorithm incorrectly treats a genuine duplicate as a loopback. The design accepts this because: the event is logged for administrator review, the nodes will continue probing, and it is unlikely they will choose the same nonce again given quality random number generators.
The Enhanced DAD algorithm reuses the Nonce Option from SEND (RFC 3971) rather than defining a new option, because a single-use nonce already provides the necessary uniqueness property. Each NS(DAD) per address uses a different nonce, so a looped back message is identifiable by matching the stored nonce.
The problem motivating Enhanced DAD is that IPv4 recovers automatically after a loopback is removed, but IPv6 remains in DAD-failed state requiring manual intervention. In access concentrator deployments, a single looped back NS(DAD) can affect thousands of broadband modem subscribers simultaneously.
RFC 4861 is updated in two ways: NS messages with an unspecified source address used in Enhanced DAD add the Nonce option and implement the Enhanced DAD state machine; and RetransTimer MAY be overridden by a link-specific document if a node supports Enhanced DAD.
The operational mitigation options (disabling DAD per interface or using Layer 2 loopback detection) do not require both ends of the circuit to support Enhanced DAD simultaneously. They are effective for unidirectional loopback but may not be effective for bidirectional loopback unless both ends comply.
A service provider router, such as an access concentrator or network core router, SHOULD support the DAD deactivation per interface as a mitigation for loopback-induced DAD failures.
Detecting looped back DAD messages using a Layer 2 protocol SHOULD be enabled by default, and it MUST be a configurable option if the Layer 2 technology provides means for detecting loopback messages on an interface circuit.
If a received NS(DAD) targeting the interface's tentative/optimistic address includes a nonce but no match is found with any stored nonce, the node SHOULD log a system management message for a DAD-failed state and SHOULD update statistics counters.
If a receiver using Enhanced DAD finds a nonce match between a received NS(DAD) targeting its tentative/optimistic address and a stored nonce, the node SHOULD log a system management message, SHOULD update statistics counters, and MUST drop the received message (treating it as looped back).
If any NS(DAD) probe is looped back within RetransTimer milliseconds after sending DupAddrDetectTransmits NS(DAD) messages, the interface MUST continue with another MAX_MULTICAST_SOLICIT number of NS(DAD) messages transmitted RetransTimer milliseconds apart, each using a different nonce.
On detecting a genuine duplicate address matching the tentative or optimistic address of a trusted access concentrator's interface, the access concentrator SHOULD log a system management message, drop the received ND message, and block the modem on whose Layer 2 service identifier the duplicate NS(DAD) or NA message was received.
When a Layer 2 protocol detects that a loopback is present on an interface circuit, the device MUST temporarily disable DAD on the interface. When the protocol detects that a loopback is no longer present (or the interface state has changed), the device MUST (re-)enable DAD on that interface.
When sending an NS(DAD) for a tentative or optimistic interface address, the sender MUST generate a random nonce associated with the interface address, MUST store the nonce internally, and MUST include the nonce in the Nonce option of the NS(DAD) message.
NS(DAD) is shorthand for a Neighbor Solicitation (RFC 4861) with an unspecified IPv6 source address (::) issued during Duplicate Address Detection. Enhanced DAD augments NS(DAD) by adding the Nonce option from SEND (RFC 3971) to enable loopback detection.
The Enhanced DAD algorithm detects looped back NS(DAD) messages by embedding a random nonce (from the SEND Nonce Option, RFC 3971) in each Neighbor Solicitation sent during Duplicate Address Detection. Each NS(DAD) for a given interface address uses a unique nonce, and if the sender receives back an NS(DAD) with a matching nonce, it identifies the message as looped back rather than a genuine duplicate.
A rogue node can deliberately change the nonce in a looped back NS(DAD) to bypass loopback detection specified by Enhanced DAD. SEND is recommended to prevent this exploit, as it authenticates ND messages cryptographically.
The nonce does not protect against a DoS attack where a rogue node replies with a fake NA to all DAD probes, causing DAD failure for all probed addresses. SEND is recommended to circumvent this exploit. Additionally, disabling DAD creates a window during which a remote on-link rogue can issue reflected NS(DAD) messages; SAVI (RFC 6620) and SEND are recommended mitigations.
During Enhanced DAD, an interface address begins in tentative or optimistic state. If no DAD failure indication or looped back probe is received within RetransTimer × DupAddrDetectTransmits, the address moves to assigned state. If looped back probes are detected, the interface retransmits up to MAX_MULTICAST_SOLICIT additional NS(DAD) messages; if none loop back within that period, probing stops and the address moves to assigned state. A genuine duplicate causes a DAD-failed state.