Neighbor Discovery Protocol (NDP)

What Neighbor Discovery Protocol Does

Neighbor Discovery Protocol is a key part of IP version 6, and it does several different things. Number one, there is not an equivalent of ARP. There is no broadcast that can be sent out to find out MAC addresses of machines, so we've got to do it through multicasting, and we do it through Neighbor Discovery Protocol. So we discover MAC addresses, that translation between IP addresses and MAC addresses, using the Neighbor Discovery Protocol.

The other thing that we do is we are able to find things like routers on the network. So there's something called router solicitation to find the routers, and when we find routers it also allows us to get some information like the prefix information or the network information, so that way we can create a global unicast address and send it out to the rest of the network. It also, if there's multiple routers that are connected together, it will allow those routers to communicate back and forth. So Neighbor Discovery Protocol really allows for a lot of this communication to happen, to establish connections between devices.

Packet Types

Neighbor Discovery Protocol uses several different packet types to get information. One of those is a neighbor solicitation. A neighbor, because it's asking a neighbor for information, and solicitation because that's the process of asking. So it is going to send a neighbor solicitation and perhaps maybe ask something like, what is your MAC address? And then the neighbor will reply back with the MAC address, and that is a neighbor advertisement. So if it's an S, it's a solicitation; if it's an A, it's an advertisement, and that's a response. So the question is solicitation, and the response or the answer is an advertisement.

So that is if you are trying to find information from a neighbor. Let's say you're trying to find information from a router. Can you guess what that's going to be? If a neighbor is a neighbor solicitation, what would a router be? If you guessed router solicitation, then you would be correct. And what do you think the response would be? If you guessed router advertisement, then you would be correct. So a router solicitation is to find out what routers are on the network, and a router advertisement is to get a response. And once again, that could be between a node that's on a network asking for a router, but it also could be possibly between two routers that are trying to discover each other as well.

So those are some of the different packet types. One last one is a redirect. So if something were to go down, a device could send out a redirect to the machines on the network.

Neighbor Discovery Runs on ICMP Version 6

Now, these Neighbor Discovery protocols actually don't use IP version 6, they actually use ICMP version 6. ICMP is a protocol and it's found on layer 3. So here we see layer 3 right here, and we see that there's IP version 4, there's IP version 6, and there's ICMP. So it's one that we'll be talking about further, and we're going to go much more in depth into that. Just know that in this case right here we're actually talking about a different protocol. It is not IP version 6, but it sends out an ICMP message. And you can also think of, you probably have pinged before and are familiar with the command ping. Well, ping is an ICMP packet that's going out.

What's interesting about this is actually the header of it really isn't any different. It's still the same IP version 6 header, it just has some different information that's attached behind it. So it kind of looks like it's a layer 4 in some senses, but it really does operate at layer 3.

ICMP has different types that are associated with it, so those types are numbered. So for instance, if you send out a 128, that is an echo request, that's a ping. When you get a response to that ping, that's an echo reply, so that is a type 129. And that's embedded onto the ICMP header, and it will have these different types that are associated with it.

So where does this come into Neighbor Discovery Protocol? Well, Neighbor Discovery Protocol doesn't use those, but it does use these others right here. So router solicitation is a type 133, router advertisement is a type 134, neighbor solicitation is a type 135, a neighbor advertisement is a type 136, and a redirect message is 137.

Router Solicitation and Advertisement

So when it comes to router solicitation and advertisement, that is a machine that's asking a question from a router. And we already know that to ask a question from routers on the network, it uses a multicast address. Can you think of what multicast address we have already said addresses all routers on the network? You might have to go back and look at some notes for that one, but if you are thinking along the lines of ff02::2, that is the multicast address for routers.

So this machine right here is going to send out a packet that's destined for ff02::2, and this switch is going to see any devices that have subscribed to that multicast group, which would be this router, it would have subscribed to that multicast group. So that packet will be forwarded to this router right here, and that router will be able to get that packet.

Now, what is the reason for this machine right here asking this question? Well, for one, SLAAC uses this to say, hey, what is our network? I want to know our network so I can create a global unicast address, and then I can reach the rest of the world. And so it gets some information back from the router. And once again, what's being sent is a router solicitation, and then it's a router advertisement that's being sent back. And so then this machine gets that information and can create an address that is reachable to the outside world. So that's one of the use cases for this.

So the packet that's being sent, we've already said it's being sent to ff02::2, and it is a type 133, because that's a router solicitation. And what's being sent back with the router advertisement is a type 134, with the router advertisement being sent back.

Neighbor Solicitation, Advertisement, and Redirect

Similarly, the neighbor solicitation and advertisement, as we mentioned before, are being sent back and forth. We have neighbor solicitation asking, hey, what's your MAC address, and the neighbor advertisement that comes back. And those are 135 and 136. So 135 and 136 are the types that get sent and received back. So that's neighbor solicitation and advertisement, to find out things like MAC addresses that are associated with the IP version address.

Then we have redirect. So a machine may get its information from a router that is on how to get out, and it may be out this device right here. But perhaps there's multiple devices with connections to the internet, and perhaps this connection goes down, and so this router no longer has connection to the outside world. Well, then what can happen is a redirect can be sent to this machine, and this machine then can get information to actually go out this other route. And so redirect just routes the traffic if something were to go down or something to happen. Then redirects can be used to redirect the traffic to go out a different destination.