What is NDP and what are its message types?
Show the answer
Say this first
Neighbor Discovery Protocol (RFC 4861) does the jobs ARP, ICMP router discovery and ICMP redirect did in IPv4. It runs inside ICMPv6 with five messages: Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136) and Redirect (137). It handles address resolution, router and prefix discovery, duplicate address detection and neighbor reachability.
Go deeper
The five messages
| Type | Message | Sent by | Usually to | Job |
|---|---|---|---|---|
| 133 | Router Solicitation (RS) | host | ff02::2 | ask routers for an RA now |
| 134 | Router Advertisement (RA) | router | ff02::1, or the host that asked | prefixes, flags, default router, MTU, hop limit |
| 135 | Neighbor Solicitation (NS) | any node | solicited-node group, or unicast | resolve a MAC, DAD, check reachability |
| 136 | Neighbor Advertisement (NA) | any node | the asker, or ff02::1 if unsolicited | give a MAC, announce a change |
| 137 | Redirect | router | host | a better first hop, or "this destination is on-link" |
Useful details
- Hop limit 255. Every NDP message is sent with hop limit 255 and receivers drop any with less. A packet that crossed a router would have 254 or lower, so this proves the sender is on the link.
- NA flags. R says the sender is a router, S says the NA answers a solicitation, O says "override your cached MAC for me".
- Options. Source and target link-layer address, Prefix Information, MTU, Route Information, and RDNSS for DNS servers (RFC 8106).
Why this matters for filtering
NDP is ICMPv6. An ACL or firewall that drops all ICMPv6 drops address resolution with it and the link stops working. Cisco IPv6 ACLs carry implicit permits for NS and NA for this reason.
They will ask next
Is NDP secured?
Not by default. SEND (RFC 3971) adds signatures but almost nobody deployed it. Networks protect NDP with first hop security on the switch instead: RA Guard, ND inspection and device tracking.
When does a router send a redirect?
When it forwards a packet back out the interface it came in on, toward a next hop on the same link. It tells the host to send directly next time. Many teams disable redirects on routers with
no ipv6 redirectsbecause they add CPU work and can be abused.
Traps
- Saying NDP runs over UDP or directly over Ethernet. It is ICMPv6, IP next header 58.
- Forgetting Redirect, the fifth message.