This content covers how a device acquires an IPv6 address when first connected to a network, including DHCP discovery, router solicitation and advertisement, and duplicate address detection. Wireshark packet captures are used to trace each step of the process in real time.
IPv6 Address Configuration
We're going to take a look at that whole process of a laptop being plugged into a network, getting its address, and how it starts communicating on that network. Let's go over SLAAC and some of the other processes around plugging a laptop into a network.
Now, one of the problems is that I've already plugged this laptop into the network and it's already got some configuration set up on it, and it's going to hold on to that configuration, and we're not going to be able to see the whole interaction. I want to be able to see the whole interaction, so what I'm going to do is show you first of all how to clear this laptop from some of the information that's stored on it.
The first step in this is that I need to open up a command prompt, and because of some of the commands I'm going to use, I have to open it up as an administrator. So what I'm going to do is click the Windows button here, type in cmd, right click on the command prompt here and say run as administrator. It's going to ask me for the UAC, the user account control, and I'll say yes. And I'm just going to shrink this window just a tad so that way we have a little better view into this.
Next, what I want to do is show you the interface that we're going to be working with. So I'm going to type in ipconfig, we'll hit enter here, and I'll scroll up. This is the ethernet interface that we're working with, ethernet, not ethernet 2. This ethernet media is disconnected right here for right now, because I'm going to clear the settings and then we're going to turn it up for the first time, or essentially it will be the first time on this network.
Next, I want to show you the information that I'm going to delete. The information I'm going to delete I can see by the netsh interface IPv6 show address command, so I'm going to type that in there. The information I want to see is this public address right here. It's still good for 6 days, so this would stay in here for quite some time. I actually already deleted the temporary address, so that's out of there at this point in time, but I need to delete this public address.
So what I'm going to do is take this command, and instead we're going to do netsh interface IP version 6, and we want to delete an address from ethernet, from the ethernet interface. And just so I make sure I can get this right, I'm just going to copy this and I'll paste it here and hit enter. And now if I show address here, I can see that on this ethernet interface we don't have that in there anymore.
The next step is I want to start capturing the data on there, so I'm going to bring up Wireshark here and I'm going to monitor the ethernet adapter. I'm going to use this one right here, and there shouldn't be anything coming across it right now, because essentially I've got this unplugged, or really the interface is turned off. So what I want to do now is just bring that interface up so communication can start happening. You can ignore this part of it, but I'm just going to jump onto the switch here and say no shut on that interface, and then we should start collecting data for that interface.
Now that we've collected some data with this, let's take a look at some of the information within here. First of all, I want to point out that we see one of the things that's happening is it's trying to reach out to a DHCP version 6 server here. So it's coming from this link local address, and if we do an ipconfig we can see that this fe80 ends in 6874. So 6874 we've got right here. So it's coming from this link local address and going to ff02:1:2.
So if we take a look, I've got a Chrome browser here up to Wikipedia and I just wanted to take a look at this multicast group and what it's going to, and it's going to all DHCPv6 servers. So it's going to the DHCPv6 servers, and so it's trying to reach out to a DHCP version 6 server there.
The next interesting thing that I see on here is this packet number seven. This packet number seven here is coming from something that's undefined to this multicast address right here, and this multicast address is associated with the link local address here. So if you notice, this is 6a74 and this is 6a74. So we see this neighbor solicitation. When we see that going to that multicast address of itself, essentially we can think this is duplicate address detection. So it just wants to verify that it can continue to use this link local address that it's assigned to itself.
The next thing we see in here is packet number eight. Packet number eight here is once again coming from the link local address, and it's going to ff2:2. So I can take a look at what that belongs to, and it is the all routers node. So this is a router solicitation. In fact, it even says router solicitation here. So now it's trying to reach out to the routers on the network and get information from the routers.
I think at this point in time what I'm going to do is, with this selected, I'm going to sort by protocol, because I'm really only interested in this ICMP version 6, the router solicitation and the router response, the router advertisement that happens right here. So now we see that the router starts advertising back to this device, or actually it's going to everything. So it's going from the router, so this is the link local from the router, and it's going to the ff02::1. We can pull up Chrome to take a look at Chrome, and we see that that's the all nodes. So now it's being broadcasted out. These router advertisements are being broadcasted out to all of the devices so everyone can update their information if need be.
If I want to dig further into this packet, I'm going to expand this out a little bit more and take a little deeper dive into what this router advertisement looks like. If I open this up, we have some options that are available in here. So for instance, the prefix length is in here, so prefix length is 64, so it's getting information about the network there. It also has the 00110.
So what this essentially means is now it knows what network it's on. It knows the prefix of this as well as the prefix length, and so now it understands what network it's on and it can come up with the host bits to create a unique address on the network.
So at this point in time, that's when we can open this up and do an ipconfig and see that it's come up with these two addresses, this one ending in b96b and this one ending in cbb2. But it does need to make sure that no other device on the network has these as well.
So one of the last steps here that happens, that we're going to take a look at, is these neighbor solicitations right here. And this is DAD at work again, this duplicate address detection at work again, going from this undefined :: to the multicast addresses associated with those two IP version 6 addresses. So it's looking out there and saying, hey, does anybody belong to these two devices right here?
And by doing so, what happens is that we can see that up until now it's really only using its link local addresses for any kind of communication, and then after this point it can start using those for communicating. So we start seeing right here the first times that we'll actually use those two IP version 6 addresses for communicating on the network, now that it's verified that the duplicate address detection has worked and it's verified that there is no duplicate.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →