NDP - Neighbors

Let's take an even deeper dive into NDP, neighbor discovery protocol, specifically about neighbor solicitation and neighbor advertisements. We're going to talk about NDP and multicasting, then we're going to get into neighbor solicitation, and then we'll talk about the solicited node multicast address — we're going to get a little more in depth into that. We'll talk about neighbor solicitation packets and what those look like, and then neighbor solicitation advertisements. Really, specifically what we're going to take a look at is the addresses, the layer 2 and layer 3 addresses of these different packet types.

ICMP Packet Types

In our last video we mentioned how ICMP is different than IPv6. Although the headers look the same, there are some different content that's involved in it, so we have different ICMP packet types. Somewhere in there is a type field in the packet header, and it will identify what type of packet it is. What we're going to be looking at today is this neighbor solicitation and neighbor advertisements, and what the process is for these neighbor solicitations and neighbor advertisements.

Multicast Addresses

A few videos ago we also talked about multicasting addresses, so that's going to be important to keep in mind as well. We've got these ff02, which means that these are the multicasts that are going to stick to the local area network, or the immediate subnet, the immediate network, and so it doesn't go beyond that firewall or router or that layer three device.

The one that we're particularly going to be talking about here is the all nodes — the ones that get sent out, the multicast address that gets sent out to all of the nodes and all of the hosts. So all of your nodes and hosts should be subscribing to this multicast address. Those multicast addresses, the IPv6, relate to a layer 2, because we know that switches will forward based off of MAC addresses, and so we need a multicast MAC address to actually send this out.

The other thing that we can draw from this, as we have talked about in the past, is the solicited node multicast. The solicited node multicast is the multicast address that belongs to a single machine. For your local link, and some of your other connections, some of your other IPv6 connections, it will create this solicited node multicast address. The MAC address layer is going to line up with what the IPv6 address looks like as well, and so this is important to use during this neighbor discovery protocol. We'll see how that plays a role in all of this.

Why ARP Doesn't Work Here

In IPv4 we have what's called ARP, address resolution protocol, and that translates between IPv4 and the MAC address. We actually still need to communicate — this is still a layer 2 network, so we still need to communicate via layer 2 addresses, or those MAC addresses — so we still need to translate from IPv6 to those MAC addresses as well.

But the problem with ARP is it uses broadcast to be able to discover that information. A packet gets sent out, or a frame gets sent out, and says, who belongs to this IPv4 address? And then a reply back comes and says, I do, with a MAC address. We no longer have that capability to send out broadcasts, and so we have to send out multicast, and we do that through this neighbor solicitation.

The Scenario

In this scenario, this PC right here, this desktop, wants to ping this server right here. What it knows is it knows its own MAC address, and it knows its own link local address, and so it already has started out with some information here. It also knows this IP address, because I'm typing in the ping command and then typing in this address to ping this address right here.

What I don't know, though — this machine doesn't know the MAC address. For it to ping, it needs to send this information out with the layer 3 address, but it also needs the layer 2 address so the switch knows to forward onto this device right here. So we need to somehow translate between this link local address and this MAC address, and figure out what the MAC address is.

Now, for the purpose of this, they're the same here because it's using that EUI-64, but that's not always going to be the case — these are going to be different sometimes.

So how does this process happen? We send out a neighbor solicitation to get this information, and it's going to respond back with a neighbor advertisement. But how are we going to send out a neighbor solicitation to this device to get that information through the neighbor solicitation?

Calculating the Solicited Node Multicast Address

Each of these devices needs to figure out their solicited node multicast addresses, and to do that it's a pretty simple conversion. Here we have one of those IP addresses, one of those link local addresses that are on those machines.

The solicited node multicast address always starts out with ff02 colon colon one colon ff, and then the remaining bits are filled in with the end bits of this machine. So if we were to fill this in, we'd say three three three two two two two one one. There you go, there is the multicast address that this machine is going to join.

So it's going to join this, but when it tells the switch — the switch doesn't operate at a layer 3, so it doesn't understand IPv6. So we actually have to translate this once again, and we have to translate it into a MAC address. Each one of these multicast addresses gets translated into a MAC address so that the switch can understand who belongs to which group.

This starts out with 3 3 ff, and then the last 8 of these digits just come down. So ff comes down, and then one one, two two two two three three, and then we fill that in. So here now is the MAC address of the multicast group associated with that machine.

So the machine has this multicast address and it's going to elect to be a part of this multicast group right here. It's a multicast group of one machine.

Each of these devices figures out what their solicited node multicast address is and what their layer two multicast address is going to be, and then they tell the switch that they are part of these groups. So now this switch knows that this device right here, coming in on whatever port it's coming in on, is associated with this multicast group right here. And same thing with this PC right here — this switch now understands that this PC is associated with that layer 2.

The Neighbor Solicitation

Let's get back to where this device is pinging this device and what that looks like. What does this device know? What it knows is its MAC address, its link local address, its solicited node multicast address, and its layer 2 MAC address that's associated with it. That's information that it knows. It also knows the link local address of this machine over here, because we typed in ping and then typed in this address right here, so it knows that information.

Now what it's going to do is it needs to find out what is the MAC address of this machine before it can ping it. So it's got to discover what this MAC address is. What it's going to do to discover that is it's going to send a neighbor solicitation asking, what is your MAC address? It can do this by sending this information to the multicast group that's listed right here. Then when it sends that out, this switch will know how to forward it.

How does it know this information? It can calculate it. Just like this machine calculated this information based off of what its link local address is, this machine can do the same thing. We know the link local address because we typed ping and typed that in there, and it can calculate it to figure out what group it's supposed to be a part of, what multicast group it's supposed to be a part of. So it knows that information.

What it's going to do is calculate this information, and that's what it's going to put into the layer 2 and layer 3 of this packet that it's going to send out, this frame that it's going to send out. The layer 2 and layer 3 address that it's going to send as its source is going to be this information, because it doesn't really need to use this solicited node multicast information for this frame that's going out. It can actually use its own MAC address and its own link local address to send this packet out.

The Neighbor Advertisement

So then the question is, what does this advertisement look like coming back? We know it's a type 136. In a type 136, what is going to be the destination layer 2 and layer 3 destination addresses, and what's going to be the source layer 2 and layer 3 addresses?

At this point, it already knows its own MAC address and its link local address, so it can use this for the source information — it has no problem using that as the source information. And since this device sent over, with the original neighbor solicitation, its own MAC address and its link local address, this machine now has that information, so it will use that as the destination layer 2 and layer 3 destination addresses.

So this is just a straight unicast that is coming back to it. That unicast comes back and this device gets it. It could derive some of the information from the packet because it's being sent with this information, but really what happens in this scenario is that within the type 136 there are options down below of information that's being sent with it, and within those options it will then verify the link local address and the MAC address that's associated with it. So now this machine right here can store that information.

Duplicate Address Detection

Throughout the last few videos I've mentioned duplicate address detection multiple times, so let's get into the details of that now.

Duplicate address detection uses neighbor solicitation — that is the ICMP type 135 that we've been talking about. It's the one that gets sent out to ask other devices what is your MAC address. We're going to use that same packet, that same ICMP packet, but we're going to do a couple of things that are a little different with it this time.

We use duplicate address detection when a device creates its own link local address. When it creates its own link local address, it needs to make sure no other devices on the network have that same link local address. What it's going to do is essentially ask out there — it's going to query for itself, it's going to ask out there, hey, does anybody belong to this link local address?

The way it's going to do it is kind of interesting. When it sends out this ICMP packet type 135, it's going to send it out with its MAC address — that's not going to change, it's not a big deal, so it's just going to add that. So for the layer 2 it's going to be its own MAC address. For the layer 3 it's going to be colon colon. We looked at some special addresses a few videos ago where the colon colon represents an unspecified address. So that is going to be the source layer 3 address coming out with this packet — it's going to be colon colon, meaning that it's unspecified. So there's the layer 2 source and there's the layer 3 source.

Then what is it going to be for the destination? The destination is going to be its solicited node multicast address. That's going to be the destination of this neighbor solicitation packet that it's sending out. And what is the layer two MAC address that it's going to send out? It's going to be the MAC address that's associated with this.

So what it will do is it will send it out to the switch. If there is another device that has already established a connection with that group on the switch, then it will send out to that device, and that device can let this device know, oh, actually you don't want to take that address, that is a link local address that has already been used, so you probably shouldn't take that.

However, if it doesn't get any response — if there's no other devices that respond to this address, or to this packet that's going to the solicited node multicast group — if there's no other devices that respond to it, then this device knows that this is a unique address that it has, and so therefore the link local address is unique. If the link local address is unique, then it can take that for its own. There's no duplicate address that's on the network, and now it's just verified through this neighbor solicitation that in fact it is a unique address and can take ownership of that address.

Recap

There you go — we really are digging into the weeds now of how this stuff works and what addresses are being entered into these different packets that are going back and forth.

We started talking about NDP and the multicasting, we got into neighbor solicitation and talked about neighbor solicitation, and then we started digging in even deeper. We talked about how it figures out its own solicited node multicast address, and based off of that solicited node multicast address we can then do neighbor solicitations and figure out things like what is the MAC address associated with a certain IP address. It also figures out duplicate address detection, to figure out if there's duplicate addresses that are on the network as well.

So there's quite a bit of power with this. Once again, this is why those link local addresses and why this process is so critical to IPv6 — it's a pretty core part of how IPv6 operates.