Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 3

IPv6 Neighbor Discovery Protocol (NDP) Fundamentals

Recommended resources

Hello! In our previous session, we successfully configured IPv6 addresses on router interfaces, laying the digital groundwork for our network. But an address is only useful if others can find you. This brings us to a fundamental question: how do IPv6 devices discover each other and their local routers on a network segment?

In this lesson, we will answer that question by exploring the Neighbor Discovery Protocol (NDP). You will learn how NDP serves as the backbone of local IPv6 communication, handling the critical functions of address resolution (finding MAC addresses) and router discovery. This protocol effectively replaces several IPv4 mechanisms, most notably the Address Resolution Protocol (ARP), but with significant improvements in efficiency.

The Five Functions of Neighbor Discovery

In IPv4, the network relied on a collection of separate protocols to function: ARP for address resolution, ICMP Router Discovery for finding gateways, and DHCP for address assignment. IPv6 consolidates these and other local communication tasks into a single, efficient suite of mechanisms called the Neighbor Discovery Protocol, which operates using ICMPv6 messages.

NDP is responsible for five key functions:

  1. Router Discovery: Hosts can locate routers on the local link.
  2. Address Resolution: Nodes can resolve an IPv6 address to its corresponding link-layer (MAC) address.
  3. Stateless Address Autoconfiguration (SLAAC): Hosts can automatically configure their own IP addresses using information from a local router.
  4. Neighbor Unreachability Detection (NUD): Nodes can determine if a neighbor is still reachable.
  5. Duplicate Address Detection (DAD): Nodes can verify that an address they wish to use is not already in use on the link.
This flowchart shows how the two primary pairs of NDP messages—Router Solicitation/Advertisement and Neighbor Solicitation/Advertisement—facilitate the protocol's key applications.

Today, we'll focus on the two most fundamental functions: router discovery and address resolution. To do this, NDP uses a specific set of five ICMPv6 messages.

IPv6: Neighbor Discovery Protocol (NDP) - Cisco Community

This short article from the Cisco Community provides a concise list of the five ICMPv6 message types that form the basis of NDP.

Read the introduction and focus on Table 1-A, which lists the ICMPv6 message types from 133 to 137. We will be discussing the first four in detail.

As you saw, the five key messages are:

  • Type 133: Router Solicitation (RS)
  • Type 134: Router Advertisement (RA)
  • Type 135: Neighbor Solicitation (NS)
  • Type 136: Neighbor Advertisement (NA)
  • Type 137: Redirect

Let's explore how these messages work together in pairs to manage local network communication.

Router Discovery: Finding the Way Out (RS and RA)

When a host (like a PC) boots up on an IPv6 network, it has no prior knowledge of the network's structure. It needs to find a default gateway to communicate with devices outside its local network. This process is called Router Discovery.

  1. Router Solicitation (RS): The host begins by sending a Router Solicitation (RS) message. This is an ICMPv6 Type 133 message sent to the special multicast address FF02::2, known as the "all-routers" address. Every IPv6 router on the local link listens to this address. The RS message is essentially the host asking, "Are there any routers on this link?"

  2. Router Advertisement (RA): Any router on the link that receives the RS message replies with a Router Advertisement (RA) message (ICMPv6 Type 134). Routers also send out RA messages periodically, even if they haven't been solicited. This message contains crucial information for the host, including:

    • The network prefix and prefix length (e.g., 2001:db8:acad::/64).
    • Its own Link-Local Address, which the host can use as its default gateway.
    • Flags indicating whether the host should use SLAAC, a stateful DHCPv6 server, or both for addressing.

The following video provides a clear, practical explanation of this RS/RA exchange.

What is Neighbor Discovery Protocol (NDP)?

This clip from CBT Nuggets explains the router discovery process using RS and RA messages.

Watch the segment from this section. Pay close attention to how the client sends an RS to the all-routers address (FF02::2) and how the router responds with an RA containing the network prefix. This is the core of router discovery and the foundation for SLAAC.

Address Resolution: Finding a Neighbor (NS and NA)

Once a host knows its own address and its default gateway, it needs a way to communicate with other devices on the same local link. To send an Ethernet frame, it needs the destination device's MAC address. This is the same problem that ARP solves in IPv4. In IPv6, this is called Address Resolution and uses Neighbor Solicitation and Neighbor Advertisement messages.

Here's how it works, and where IPv6 introduces a major efficiency improvement over IPv4's ARP broadcasts:

  1. The Solicited-Node Multicast Address: Instead of broadcasting to every single device on the network as ARP does, IPv6 uses a clever trick. The sending device takes the destination IPv6 address and creates a special multicast address called a solicited-node multicast address. This address has the prefix FF02::1:FF00:0/104, and the last 24 bits are copied from the destination IPv6 address. A device joins this multicast group for each of its configured unicast addresses. Because the last 24 bits are usually unique, this message will likely only be processed by the single target device, dramatically reducing network noise.

  2. Neighbor Solicitation (NS): The sending host sends a Neighbor Solicitation (NS) message (ICMPv6 Type 135) to this solicited-node multicast address. The message effectively asks, "The device using this IPv6 address, please tell me your MAC address."

  3. Neighbor Advertisement (NA): The target device, which is listening on that solicited-node multicast address, receives the NS. It replies with a unicast Neighbor Advertisement (NA) message (ICMPv6 Type 136) sent directly back to the original sender. This NA message contains the target device's MAC address.

The sending host now has all the information it needs: the destination IPv6 address and the destination MAC address. It can now build the Layer 2 frame and send the packet. This information is stored in a neighbor cache, which is the IPv6 equivalent of an ARP cache. You can view this on a Cisco router with the command show ipv6 neighbors.

This diagram perfectly illustrates the two-way exchange for address resolution.

This diagram shows Node A sending a multicast Neighbor Solicitation to find Node B, and Node B responding with a unicast Neighbor Advertisement containing its link-layer (MAC) address.

To see this entire process in action with real network packets, the following Wireshark demonstration is invaluable.

What is Neighbor Discovery Protocol (NDP)?

This video continues with a detailed look at the NS/NA process and then shows a live packet capture of all the NDP messages we've discussed.

First, watch the explanation of Neighbor Solicitations to solidify your understanding of how they replace ARP. Then, watch the practical Wireshark demonstration from this point. Here you will see: A Router Solicitation sent from a PC. The corresponding Router Advertisement from the router. An NS message used for Duplicate Address Detection (DAD)—a check to ensure the PC's new address is unique. The NS/NA exchange for address resolution when a ping is initiated.

The Full Picture

By combining these message pairs, NDP provides a comprehensive solution for local network operations. Routers advertise their presence and network prefixes (RA), allowing hosts to find them (RS) and configure their own addresses. When hosts need to talk to each other, they resolve IPv6 addresses to MAC addresses efficiently (NS/NA) without the overhead of network-wide broadcasts.

For a final, more formal reading, this official Cisco document breaks down the messages.

IPv6 Neighbor Discovery - Cisco

This Cisco guide provides a technical deep-dive into the NDP messages.

First, read the introductory section, IPv6 Neighbor Discovery, for a formal definition. Next, skim the section on the Neighbor Solicitation Message. Focus on understanding its purpose for resolving link-layer addresses. Finally, skim the section on the Router Advertisement Message to see the list of information it typically includes.

Conclusion

In this lesson, we demystified the operations happening "under the hood" on an IPv6 local network. You now understand the central role of the Neighbor Discovery Protocol and how it uses ICMPv6 messages to handle tasks that required multiple protocols in IPv4.

Key Takeaways:

  • NDP is a suite of mechanisms in IPv6 that replaces ARP, ICMP Router Discovery, and other functions.
  • Router Discovery is accomplished through Router Solicitation (RS) and Router Advertisement (RA) messages, allowing hosts to find gateways and learn network prefixes.
  • Address Resolution is handled by Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages, which map IPv6 addresses to MAC addresses.
  • NDP is more efficient than ARP because it uses solicited-node multicast addresses for address resolution, avoiding disruptive network-wide broadcasts.
  • The results of address resolution are stored in a neighbor cache, viewable on a Cisco router with show ipv6 neighbors.

The Router Advertisement messages we discussed are the key to one of IPv6's most powerful features. In our next lesson, we will build directly on this knowledge to configure and verify Stateless Address Autoconfiguration (SLAAC), a method that allows hosts to automatically assign their own unique IPv6 addresses without needing a DHCP server.