About this interactive
Neighbor Discovery is usually met as a list of five message types with numbers attached — 133, 134, 135, 136, 137 — and a student who can recite that list still cannot say what has to be true before any one of them may be sent. That gap is what this activity is built to close, and it is why the set is shaped as one host's bring-up rather than as a flat parade of message types. The five NDP messages are not one linear process. Neighbor resolution and router discovery are separate exchanges, and duplicate address detection is not a message type at all but a use of the Neighbor Solicitation message. Forcing those into a single fake chain would teach an ordering the protocol does not have. What the module's lessons do trace, across the multicast membership demo, the duplicate address detection demo, the routers lesson and the neighbors lesson, is a genuine chronology: a single host from the moment its interface comes up to the moment it puts a frame on the wire for a neighbor. That chronology is real, its steps are causally ordered rather than conventionally ordered, and it is what the cards follow. One rule reasons the whole thing out, and it is the rule the cards are written to expose: every message needs a valid source address, and a host starts with none. From that, the sequence is forced rather than memorized. The host must join its solicited-node multicast group before it can possibly hear an objection raised in that group, so the Multicast Listener Report precedes the check rather than following it. Duplicate address detection must source from the unspecified address, because using the tentative address to ask whether the tentative address is free would defeat the question being asked. Silence — the one step in the set with no packet of its own — is what promotes the address from tentative to usable, and it is the pivot everything else hangs on. The Router Solicitation then becomes possible for the first time, not because a specification says it comes fourth but because it is the first moment the host has a legal source address to put in it. The Router Advertisement replies to the all-nodes group rather than to the asker alone, which is why a host that simply waits gets configured without ever asking. The real difficulty, and the reason the type numbers are deliberately not a shortcut here, is Type 135. It appears twice, near the beginning and near the end, separated by nearly the whole sequence, doing two entirely different jobs. Once it asks whether the host's own tentative address is already claimed; once it asks a known neighbor for its MAC address. The difference is visible in exactly one field. The first sources from the unspecified address and derives its multicast group from the sender's own address; the second sources from the sender's confirmed address and derives the group from the target's. Setting the two beside each other in a single ordered sequence is what turns that field from a detail into the thing that identifies which job is being done, and a student who places both correctly has had to reason about the source address to do it. The contrast with IPv4 is worth naming on the last two cards for the same reason. ARP floods the segment; the solicited-node multicast address means the equivalent IPv6 question reaches the one host that can answer it. All seven cards are presented every run rather than sampled, because a bring-up with a step missing is not a shorter version of the same object — the causal chain is the entire skill being assessed. This pairs well with the module's Wireshark demos, which show these exact packets in live captures. Running it after the duplicate address detection and routers demos works best: the ordering forces a commitment about what has to be true before each message, and the captures then make that commitment concrete at the frame level.
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →