TechKnowSurge
Cisco CCNA 1.9 Cisco CCNA 1.8 CompTIA Network+ 3.4 Cisco CCST Networking 2.3
TechKnowSurge Catalog Videos DEMO: Wireshark, NDP - Routers
VideoNetworkFree

DEMO: Wireshark, NDP - Routers

Router Solicitation and Router Advertisement are the IPv6 mechanisms by which a device discovers routers on its local network and receives prefix and configuration information. This content uses a live Wireshark capture to show how these ICMPv6 messages work in practice.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Router Solicitation and Router Advertisement are two ICMPv6 message types that form the foundation of stateless address autoconfiguration in IPv6 networks. When a device comes online, it uses its link-local address to send a Router Solicitation to the all-routers multicast group at ff02::2, essentially asking any available router to identify itself and supply network configuration data. Routers that receive this solicitation respond with a Router Advertisement addressed to ff02::1, the all-nodes multicast group, ensuring every device on the segment receives the information. The Router Advertisement carries critical configuration details including the network prefix, prefix length, and the valid lifetime of the address. In a typical IPv6 deployment, the prefix length is 64 bits, and the prefix itself represents the network portion of the address, such as fc00:1::. Together, these values give a host everything it needs to construct a global or unique local IPv6 address without relying on a DHCP server. A live Wireshark capture is used throughout to show both the solicitation and the advertisement as they appear in actual network traffic, connecting the conceptual exchange to real packet-level detail.

What you'll learn

What's covered

Router Solicitation & Advertisement

Aligned to

Cisco CCNA
1.9 Describe IPv6 address types
1.8 Configure and verify IPv6 addressing and prefix
CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services
Cisco CCST Networking
2.3 Identify IPv6 addresses and prefix formats

Key terms

Router
A network device that forwards data packets between networks based on IP addresses.
Multicast
A transmission type in which data is sent from one source to a specific group of devices that have subscribed to a multicast group address, rather than to all devices or just one. This differs from broadcast (all devices) and unicast (one device).
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
Router Solicitation
RS
An ICMPv6 message sent by an IPv6 host when it initializes to prompt routers on the link to send a Router Advertisement immediately, rather than waiting for the next periodic RA interval. Router Solicitation speeds up IPv6 address autoconfiguration on newly connected devices.
Router Advertisement
RA
An ICMPv6 message periodically broadcast by IPv6-enabled routers to announce their presence, advertise network prefixes, and provide default gateway information for SLAAC. Hosts also request RAs immediately on startup by sending a Router Solicitation.
Neighbor Discovery
ND
The IPv6 protocol suite defined in RFC 4861 that uses ICMPv6 messages to perform address resolution, router discovery, prefix advertisement, and neighbor reachability detection. ND replaces the ARP, ICMP router discovery, and ICMP redirect functions used in IPv4.

Topics

Wireshark Ipv6 Neighbor Discovery Protocol Icmpv6 Router Solicitation Packet Analysis Networking

Transcript

Let's take a look at that router solicitation and the router advertisement. The router solicitation is the device reaching out and saying, who belongs to the router group, and what information can you give me? Then the response comes back in the form of a router advertisement.

The router solicitation

We can see right here I've already made a capture using Wireshark, and we can see right here that this is coming from the fe8, so this is a link local address, and it ends in 6a74. If I were to bring this up in ipconfig, we can see that that's the link local address of this machine.

So it's sending this out, and it's sending it to the ff02::2 group, and this is the all routers group. So it sends it out to the all routers group, and it's a router solicitation, so it's asking for information from the routers.

The router advertisement

Then in response we see this router advertisement that happens, and it's going from the link local address of that router - so if we were to jump on that router we would see this link local address on there - and it's going to ff02:1, so it's going to all nodes and gets sent to all devices on the network.

Within there we can actually see some information. We see information such as the prefix length is 64, we can see how long the lifetime should be of it, and the prefix for this. The prefix essentially is the network address, which is fc00:1:

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →