What is duplicate address detection and how does it work?
Show the answer
Say this first
Before using any unicast address, a node marks it tentative, joins its solicited-node group and sends a
Neighbor Solicitation for it from the unspecified address ::. If another node answers with an NA, or is
doing DAD for the same address at the same time, the address is a duplicate and is not used. If nothing
comes back within about a second, the address becomes usable. It runs for link-local, SLAAC, DHCPv6 and
static addresses alike.
Go deeper
The packet
NS src :: (no address yet)
dst ff02::1:ff3c:4d5e (solicited-node of the tentative address)
target 2001:db8:acad:10:21a:2bff:fe3c:4d5eUsing :: as source means nobody caches a mapping for an address that may turn out to be someone else's.
Timing and knobs
- One NS by default (DupAddrDetectTransmits = 1), then wait RetransTimer, 1 second.
- IOS:
ipv6 nd dad attempts 1is the default;0disables DAD on the interface. - Optimistic DAD (RFC 4429) lets a host use the address while DAD runs, with restrictions, to save time.
- Anycast addresses skip DAD.
When it fails on a router
IOS logs %IPV6_ND-4-DUPLICATE and marks the address [DUP] in show ipv6 interface. The address is not
used. If the duplicate is a link-local built from the hardware address, RFC 4862 says IPv6 on that
interface should be disabled, because the MAC itself is probably duplicated.
Common real causes
- Two routers configured with the same static address, or the same
fe80::1on one link. - Copy-pasted VM templates with static addresses.
- A looped port, where the node hears its own NS. RFC 7527 adds a nonce so a node can recognize its own message.
They will ask next
Does DAD guarantee there is no duplicate?
No. It only checks at the moment the address is configured, and only for nodes on the link at that moment. A host that was powered off during DAD will clash later. NUD and logs then show the conflict.
Can an attacker abuse DAD?
Yes. A node that answers every DAD NS stops all new hosts from getting addresses. First hop security features such as ND inspection on the switch limit this.
Traps
- Saying DAD is sourced from the address being tested. It uses
::. - Saying DAD only runs for SLAAC addresses.