TechKnowSurge
Cisco CCNA 1.9 Cisco CCNA 1.8 CompTIA Network+ 3.4 Cisco CCST Networking 2.3 Cisco CCST Networking 5.2 CompTIA Network+ 5.5 CompTIA Network+ 1.1
TechKnowSurge Catalog Videos DEMO: Wireshark, Duplicate Address Discovery (DAD)
VideoNetworkFree

DEMO: Wireshark, Duplicate Address Discovery (DAD)

Duplicate Address Detection (DAD) is an IPv6 process that uses the Neighbor Discovery Protocol to verify that a newly generated address is unique before a device begins using it. This topic is examined through live Wireshark packet captures showing exactly how DAD operates at both Layer 2 and Layer 3.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Duplicate Address Detection (DAD) is a built-in IPv6 process that prevents address conflicts by verifying that a candidate address is not already in use on the network before a device adopts it. It relies on the Neighbor Discovery Protocol (NDP) and is triggered automatically whenever a device generates a new IPv6 address, whether that address is a link-local address derived from the interface identifier or a statically assigned address. A live Wireshark capture demonstrates the full sequence of events from the moment a network interface is connected and begins generating addresses. The capture reveals two Neighbor Solicitation packets — one for each candidate address on the interface — appearing among the very first frames exchanged on the link. At Layer 3, the source address in each Neighbor Solicitation is the unspecified address, represented as a double colon, because the device cannot use the candidate address as a source until DAD confirms it is available. The destination is the solicited-node multicast address corresponding to each candidate, formed by combining the well-known ff02::1:ff prefix with the last 24 bits of the target address. At Layer 2, the source MAC address belongs to the sending device, while the destination MAC follows the 33:33:ff pattern that maps to solicited-node multicast addresses, with the final bytes aligning with both the target IPv6 address and the solicited-node multicast address. Because no other device on the network responds to either solicitation, the sending device concludes that neither address is in use and begins sourcing traffic from both addresses in the packets that immediately follow.

What you'll learn

What's covered

Duplicate Address Detection

Aligned to

Cisco CCNA
1.9 Describe IPv6 address types
1.8 Configure and verify IPv6 addressing and prefix
CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
Cisco CCST Networking
2.3 Identify IPv6 addresses and prefix formats
5.2 Perform a packet capture with Wireshark and save it to a file

Key terms

Duplicate Address Detection
DAD
An IPv6 mechanism that verifies a newly assigned address is unique on the link before it is used for communication. A device sends a Neighbor Solicitation for its tentative address; if no response is received, the address is confirmed unique and assigned.
Neighbor Solicitation
NS
An ICMPv6 message used in IPv6 Neighbor Discovery to request the MAC address corresponding to a specific IPv6 address or to verify that a neighbor is still reachable. Neighbor Solicitation is also used during Duplicate Address Detection to check that a new IPv6 address is unique.
Solicited-Node Multicast Address
A special IPv6 multicast address in the FF02::1:FF00:0/104 range that is derived from the last 24 bits of a device's IPv6 address, used by Neighbor Discovery to efficiently perform address resolution without broadcasting to all hosts. Instead of flooding all devices the way ARP does in IPv4, NDP sends solicitations only to the small group of devices sharing those same 24 bits.
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
Layer 2
The Data Link layer of the OSI model, responsible for MAC addressing and frame delivery on a local network.
Layer 3
The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.

Topics

Ipv6 Duplicate Address Detection Neighbor Discovery Protocol Wireshark Packet Analysis Networking

Transcript

We're going to talk about duplicate address detection, and take a look at Wireshark to see what duplicate address detection looks like with these packets that go back and forth. It uses a neighbor discovery protocol to discover if there is a duplicate address out there on the network. It needs this because your machine will come up with a random IPv6 address, but it does need to be unique, and it can't be a duplicate of some other device that's on the network. So let's look at this process and see how it comes up with an address and then verifies that there are no other devices out there on the network that have that same address.

Capturing the traffic

I'm going to start out by taking Wireshark and monitoring the Ethernet connection. This Ethernet connection doesn't have any traffic across it because it's not live right now. What I'm going to do is plug this in, and then we will see the traffic that goes across this interface. Then we'll take a look at it and see how it detects whether there is another device on the network that has the same address. It's come up with a random link local address on this machine, and now it needs to test to see if any other devices have that same link local address.

Now that this device has been plugged in, we've got some traffic. I'm going to go ahead and stop the capture. It's probably going to be much further up here, going to be one of the first things that comes up with this communication.

The neighbor solicitations

So we scroll up and we see right here, the fifth packet that comes from this is the neighbor solicitation. We see two different neighbor solicitations here when we look at this. We see one that's for this interface, that's fe80, that's the link local address, and then one for this fc00:1::14, which is the static address that we assigned to them.

If I wanted to verify that information, I could pull up a command prompt and type the ipconfig and see that, when I look at the Ethernet connection, it does in fact have this statically assigned address to it, and this fe80 address to it, and 3 4 f a. And if we take a look at this one right here, that ends in the same one. So these two addresses are the same. It's doing a neighbor solicitation for these devices right here, one for this device and one for this device. The idea is that if it sends it out there and does a neighbor solicitation for these two devices, if it doesn't get a response back, it probably is not taken, right? And if it does get a response back, then it's going to need to choose something different.

Inside the packets

So let's take a look at these packets that we have here. First of all, we see that the source layer 3 address is colon colon. That's because it can't accept the address yet, it needs to show that the address is not taken, so it's unspecified. This is the unspecified address right here.

And then where it's heading to is going to be the solicited node multicast address that's associated with each one of these interfaces. They both start with ff02::1:ff. They both start with those because they're both the solicited node multicast address. Now, the last part of these, you can see that they line up very nicely with the actual IPv6 addresses that they're associated with, and it's that same process that we've already talked about to configure the solicited node multicast address.

The other thing we could do is take a look at each one of these and take a look at the layer two. So we've taken a look at the layer three addresses. What do the layer two addresses have in them? The source is the MAC address of the Dell laptop, my demo laptop, so that makes sense right there. And then the destination is the MAC address that's associated with the solicited node multicast address. So 3333 ff: immediately we think that's associated with that solicited node multicast address. And then the last digits, d734 fa, line up with the MAC address, or the solicited node multicast address, and in fact it also lines up with the actual IPv6 addresses of those.

No response means the address is free

So it's reaching out there, and then we can scroll through and see that there are no other devices with those IP addresses, so there's no response, and then it starts taking on those responses. You see the fe8 4 900, so there it is, it's actually using it at this point in time. So packets five and six: it's requesting to see if anybody responds out there, and then it assumes, once it doesn't get a response, then it starts using it. As long as there are no responses, then it can start using those IP addresses. So that's duplicate address detection.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →