Walk me through how a host finds the MAC address of a neighbor in IPv6, and the neighbor cache states.
Show the answer
Say this first
The host checks the destination is on-link, then looks in its neighbor cache. On a miss it creates an INCOMPLETE entry and sends an NS to the target's solicited-node group, carrying its own MAC. The target answers with a unicast NA carrying its MAC, and the entry becomes REACHABLE. After about 30 seconds without confirmation it drops to STALE. When the host uses a STALE entry it goes to DELAY for 5 seconds, then PROBE with unicast NSs, and the entry is removed if nobody answers.
Go deeper
The exchange
PC1 2001:db8:acad:10::10 wants PC2 2001:db8:acad:10::20
NS src 2001:db8:acad:10::10 dst ff02::1:ff00:20
target 2001:db8:acad:10::20, source link-layer option = PC1's MAC
NA src 2001:db8:acad:10::20 dst 2001:db8:acad:10::10
flags S=1 O=1, target link-layer option = PC2's MACPC2 also learns PC1's MAC from the NS, so it can answer without asking back.
Neighbor cache states
| State | Meaning |
|---|---|
| INCOMPLETE | NS sent, no answer yet |
| REACHABLE | confirmed recently, within ReachableTime (30 s base, randomized 15 to 45 s) |
| STALE | not confirmed lately; still used, no traffic sent to check |
| DELAY | a packet was sent to a STALE entry; wait 5 s for an upper-layer hint |
| PROBE | send up to 3 unicast NSs, 1 s apart; delete the entry if none is answered |
Neighbor Unreachability Detection
Reachability is confirmed two ways: an NA in reply to a unicast NS, or a hint from the upper layer, such as TCP seeing its data acknowledged. The DELAY state exists to give TCP that chance before sending a probe.
What you see
R1# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface
2001:DB8:ACAD:10::20 0 0050.56aa.bb20 REACH Gi0/0/0
FE80::250:56FF:FEAA:BB20 3 0050.56aa.bb20 STALE Gi0/0/0$ ip -6 neigh show dev eth0
fe80::1 lladdr a0:b4:3c:11:0a:01 router STALE
2001:db8:acad:10::20 lladdr 00:50:56:aa:bb:20 REACHABLEThey will ask next
How does the host decide the destination is on-link?
From Prefix Information Options in RAs with the L (on-link) flag set. A destination outside every on-link prefix goes to the default router, even if it happens to sit on the same wire.
Why is a STALE entry not a problem?
STALE does not mean wrong, only unconfirmed. The host keeps using it and verifies lazily, which keeps NDP traffic low.
Traps
- Saying the NS goes to
ff02::1. Address resolution uses the solicited-node group; reachability probes are unicast. - Treating STALE as a failure when reading a neighbor table.