Neighbor Discovery Protocol (NDP) enables IPv6 devices to obtain network configuration automatically through Router Solicitation and Router Advertisement messages exchanged between hosts and routers.
NDP Router Solicitation & Advertisement
When we're talking about router solicitation and router advertisements, we're talking about ICMP packets that get sent out, and those are the type 133 and 134. It's something that we've discussed before, so I won't get real in depth into it. Just know that we are talking about the router solicitation and router advertisements.
Another concept that we've talked about before in the past is this idea of multicasting and the different addresses that come up with multicasting. The one that we're going to be talking about with this is the FF02::2. This is going out to all routers, so the routers will subscribe to this group. When something gets sent out to this FF02::2, then it's being sent to all of the routers on the network. In this case this IPv6 address has to have an associated MAC address with it, so when it actually goes out, the MAC layer is the 33-33002. So that's the associated MAC address that is associated with this layer 3 IPv6 address.
When a device connects to the network, we're going to use this desktop as an example, we already know that it has a MAC address and that it will create a link local address to communicate onto the network. From there it can derive a solicited node multicast address and an associated layer 2 MAC address with that, and so this is what's going to be generated. The same thing is going to hold true for routers that join a network; it's going to create very similar sets of information with that as well.
Here's a little scenario where we have this computer set up with this MAC address, link local address, the solicited node multicast address and layer 2 multicast address, and then this router is set up right here with this information right here. But what needs to happen is, if this device wants to communicate out to the rest of the world, it's going to need a global unicast address, a GUA. So it's got to somehow come up with this. We've already talked about how it can automatically create the interface part of that GUA, the last four hextets on that address, but it needs to somehow create or come up with, or it needs to know, what the first four hextets of the address are going to be. One way it can do that is through neighbor discovery protocol.
What it's going to do is send out a router solicitation. As we mentioned, it's an ICMP type 133 that's going to be sent out. Let's talk about the addresses, both the layer 2 addresses and the layer 3 addresses, that it's going to be sent out on. The layer 2 source is going to be the MAC address from the device sending out the router solicitation, so from a layer 2 perspective this will be the source right here. Then the source layer 3 is going to be the link local address right here.
The destination is going to be that multicast that we talked about that the router will join. When this device was connected into the switch, it let the switch know that it is a router and it wants to join the 33:33 — or 33, colons or dashes — 0 0 0 0 0 0 0 2. So then whatever comes into this switch that's destined for that MAC address will be sent to this router. That is the destination layer 2 address, and the associated layer 3 address will be in the destination layer 3, so that will be FF02::2. That will be the layer 3 destination right there. So that is the router solicitation packet or frame that gets sent out from this machine.
What the router does is it has a reply back, and that is going to be a router advertisement that's going to be sent back, and that's going to be on an ICMP packet type 134. So that's the type of ICMP packet that's sent back.
Let's take a look at the addresses that are going to be sent out from this router, what the layer 2 and layer 3 source and destination addresses are going to be. The layer 2 source MAC address is going to be its own MAC address right there, so that's going to be sent out. Then the layer 3 address that this router will send out is the layer 3 link local address. Those are the sources right there.
From a destination standpoint it's going to be a multicast. The multicast that it's going to send out is going to be 33 0 0 0 0 0 0 0 2 — excuse me, not 2, it's going to be 1. If you recall, that multicast address right there is something that all nodes are going to be a subscriber to. So this is going to go out to all of the nodes; when it hits the switch it's going to go to all of the destinations. From a layer 3 standpoint it's ::1 that's going to be sent out. All devices are going to get this, so all devices are actually going to hear that information, and that way they can refresh that information if they need to.
So what kind of information goes out on this type 134? There are several options that you can have. Certain options might include the prefix information, so that's the information we first discussed that this machine is trying to get: that information at the beginning of the address of what network it's located on, the first four hextets.
Another thing that it could be asking for or needing is the DNS server, so this router right here will send information out on what DNS server to use.
Another thing that could be sent out is something like the MTU, or the maximum transmission unit, so devices on the network know about how big the packets are supposed to be, or the maximum size of those packets that it cannot go beyond.
It will also, if there's some sort of route information that needs to be sent out, send out route information, things like the default gateway of where, if you're going to this route, you're going to need to go to this gateway to get out to those routes. The default route would be an example of that.
So there's a lot of different information that can be sent out on these router advertisements, and it's just whatever you have set up the router to send out as options on these router advertisements.
The idea behind IPv6 is everything needs to be dynamic and things are dynamically changing, so things can constantly update and adjust. Part of this is that there are going to be periodic updates that are going to be sent out. Every once in a while there's a router advertisement that's just going to go out every now and then and update all of the devices so they have the most current information. That is one reason why, if any device on the network asks for the information, it will not just send it to that one device but it will send it out to all of the other devices, because it needs to send out a periodic update anyway. So that's exactly what it does: it sends out these periodic updates.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →