TechKnowSurge
Cisco CCNA 1.8 CompTIA Network+ 3.4 CompTIA Network+ 1.4 Cisco CCNA 1.9
InteractiveNetworkFree

NDP Process Sequencer

Order a host's Neighbor Discovery activity — multicast group join, duplicate address detection, Router Solicitation and Advertisement, then neighbor resolution — reasoning from what source address each message needs rather than from the ICMPv6 type numbers.

Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Neighbor Discovery is usually met as a list of five message types with numbers attached — 133, 134, 135, 136, 137 — and a student who can recite that list still cannot say what has to be true before any one of them may be sent. That gap is what this activity is built to close, and it is why the set is shaped as one host's bring-up rather than as a flat parade of message types. The five NDP messages are not one linear process. Neighbor resolution and router discovery are separate exchanges, and duplicate address detection is not a message type at all but a use of the Neighbor Solicitation message. Forcing those into a single fake chain would teach an ordering the protocol does not have. What the module's lessons do trace, across the multicast membership demo, the duplicate address detection demo, the routers lesson and the neighbors lesson, is a genuine chronology: a single host from the moment its interface comes up to the moment it puts a frame on the wire for a neighbor. That chronology is real, its steps are causally ordered rather than conventionally ordered, and it is what the cards follow. One rule reasons the whole thing out, and it is the rule the cards are written to expose: every message needs a valid source address, and a host starts with none. From that, the sequence is forced rather than memorized. The host must join its solicited-node multicast group before it can possibly hear an objection raised in that group, so the Multicast Listener Report precedes the check rather than following it. Duplicate address detection must source from the unspecified address, because using the tentative address to ask whether the tentative address is free would defeat the question being asked. Silence — the one step in the set with no packet of its own — is what promotes the address from tentative to usable, and it is the pivot everything else hangs on. The Router Solicitation then becomes possible for the first time, not because a specification says it comes fourth but because it is the first moment the host has a legal source address to put in it. The Router Advertisement replies to the all-nodes group rather than to the asker alone, which is why a host that simply waits gets configured without ever asking. The real difficulty, and the reason the type numbers are deliberately not a shortcut here, is Type 135. It appears twice, near the beginning and near the end, separated by nearly the whole sequence, doing two entirely different jobs. Once it asks whether the host's own tentative address is already claimed; once it asks a known neighbor for its MAC address. The difference is visible in exactly one field. The first sources from the unspecified address and derives its multicast group from the sender's own address; the second sources from the sender's confirmed address and derives the group from the target's. Setting the two beside each other in a single ordered sequence is what turns that field from a detail into the thing that identifies which job is being done, and a student who places both correctly has had to reason about the source address to do it. The contrast with IPv4 is worth naming on the last two cards for the same reason. ARP floods the segment; the solicited-node multicast address means the equivalent IPv6 question reaches the one host that can answer it. All seven cards are presented every run rather than sampled, because a bring-up with a step missing is not a shorter version of the same object — the causal chain is the entire skill being assessed. This pairs well with the module's Wireshark demos, which show these exact packets in live captures. Running it after the duplicate address detection and routers demos works best: the ordering forces a commitment about what has to be true before each message, and the captures then make that commitment concrete at the frame level.

What you'll learn

Aligned to

Cisco CCNA
1.8 Configure and verify IPv6 addressing and prefix
1.9 Describe IPv6 address types
CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services
1.4 Explain common networking ports, protocols, services, and traffic types

Key terms

Neighbor Discovery Protocol
NDP
An IPv6 protocol that replaces ARP and handles router discovery, address autoconfiguration, and address resolution on local links.
Neighbor Solicitation
NS
An ICMPv6 message used in IPv6 Neighbor Discovery to request the MAC address corresponding to a specific IPv6 address or to verify that a neighbor is still reachable. Neighbor Solicitation is also used during Duplicate Address Detection to check that a new IPv6 address is unique.
Neighbor Advertisement
NA
An ICMPv6 message sent in response to a Neighbor Solicitation, providing the MAC address corresponding to a requested IPv6 address as part of the Neighbor Discovery Protocol. NA messages are also sent unsolicited to announce link-layer address changes.
Router Solicitation
RS
An ICMPv6 message sent by an IPv6 host when it initializes to prompt routers on the link to send a Router Advertisement immediately, rather than waiting for the next periodic RA interval. Router Solicitation speeds up IPv6 address autoconfiguration on newly connected devices.
Router Advertisement
RA
An ICMPv6 message periodically broadcast by IPv6-enabled routers to announce their presence, advertise network prefixes, and provide default gateway information for SLAAC. Hosts also request RAs immediately on startup by sending a Router Solicitation.
Duplicate Address Detection
DAD
An IPv6 mechanism that verifies a newly assigned address is unique on the link before it is used for communication. A device sends a Neighbor Solicitation for its tentative address; if no response is received, the address is confirmed unique and assigned.
Solicited-Node Multicast Address
A special IPv6 multicast address in the FF02::1:FF00:0/104 range that is derived from the last 24 bits of a device's IPv6 address, used by Neighbor Discovery to efficiently perform address resolution without broadcasting to all hosts. Instead of flooding all devices the way ARP does in IPv4, NDP sends solicitations only to the small group of devices sharing those same 24 bits.
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
Global Unicast Address
GUA
A publicly routable IPv6 unicast address beginning with the prefix 2000::/3, equivalent in role to a public IPv4 address, used to identify a device uniquely across the internet. GUAs are assigned by ISPs and regional internet registries and are the addresses used for internet-facing communication in IPv6.
Unspecified Address
The IPv6 address ::/128 (all zeros), used to indicate the absence of an address, typically before a device has been assigned one.
Stateless Address Autoconfiguration
SLAAC
An IPv6 mechanism that allows devices to automatically generate a globally unique IPv6 address using the network prefix from a Router Advertisement combined with a locally generated interface identifier, without requiring a DHCP server. SLAAC uses the EUI-64 process or a random interface ID to create the host portion of the address.
IPv6 Multicast
An IPv6 address type where a single source sends traffic to multiple subscribed destination devices simultaneously.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
ICMPv6 Multicast Listener Report
An ICMPv6 message a host sends to notify local routers and neighbors of its IPv6 multicast group memberships.
Multicast MAC Address
A MAC address beginning with the fixed prefix 01:00:5E, where the last 23 bits map directly to the corresponding multicast IP address to identify multicast group traffic.
Neighbor Discovery
ND
The IPv6 protocol suite defined in RFC 4861 that uses ICMPv6 messages to perform address resolution, router discovery, prefix advertisement, and neighbor reachability detection. ND replaces the ARP, ICMP router discovery, and ICMP redirect functions used in IPv4.
Interface ID
The last 64 bits of an IPv6 address that uniquely identify a specific interface or node within a network, equivalent to the host portion in IPv4.
Network Prefix
An IP address combined with a subnet mask that identifies a specific network or range of addresses advertised in routing protocols.
Prefix Length
The number of consecutive 1-bits in a subnet mask, written after a slash (e.g., /24), that defines how many bits of an IP address represent the network portion versus the host portion. A /24 prefix means the first 24 bits identify the network, leaving 8 bits for host addresses.
MAC Address
A 48-bit hardware address assigned to a network interface and written as six hexadecimal octets, such as 00:1A:2B:3C:4D:5E. It identifies a device uniquely on a local network segment, and switches forward frames by looking it up in their MAC address table.
Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Unicast
A transmission type in which a packet is sent from one source directly to one specific destination device, identified by its unique IP or MAC address. Unicast is the standard delivery method for most internet traffic such as web browsing and file downloads.
Default Gateway
The router that a device uses to send traffic to destinations outside its local network.
Maximum Transmission Unit
MTU
The largest size of a packet or frame that can be transmitted over a network link without fragmentation, typically 1500 bytes for Ethernet. When packets exceed the MTU, they must be fragmented at Layer 3 or the sender must reduce the packet size via Path MTU Discovery.
Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.

Topics

Interactive Ordering

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →