17. Neighbor Discovery, SLAAC, and DHCPv6
17.1 ICMPv6 Neighbor Discovery (NDP) replaces ARP + ICMP redirects + more
NDP (RFC 4861) runs over ICMPv6 and uses multicast instead of broadcast:
| Message | Type | Role |
|---|---|---|
| Router Solicitation (RS) | 133 | Host boot: "any routers here?" (to ff02::2) |
| Router Advertisement (RA) | 134 | Router announces prefix(es), MTU, flags, its own presence; sent periodically to ff02::1 and on demand |
| Neighbor Solicitation (NS) | 135 | "Who has 2001:db8::5?" (to the solicited-node multicast ff02::1:ff00:0005) — the ARP-request equivalent, plus DAD |
| Neighbor Advertisement (NA) | 136 | "That's me, at MAC …" — the ARP-reply equivalent |
| Redirect | 137 | "Use a better first hop" |
Because NDP is ICMPv6, blocking ICMPv6 breaks IPv6 entirely — no address resolution, no router discovery.
17.2 SLAAC — StateLess Address AutoConfiguration
The default way IPv6 hosts get addresses; no server, no state:
- Host creates a tentative link-local
fe80::<interface-id>. - DAD: sends an NS for its own tentative address; if an NA comes back, there's a conflict → give up that address.
- Host sends RS; router replies RA containing a
/64prefix + flags. - Host forms a GUA = prefix + interface ID (random privacy ID + a stable one), runs DAD on each.
- Default route = the RA's source link-local address.
RA flags decide what else is needed:
| Flag | Meaning |
|---|---|
| A (autonomous) | Use this prefix for SLAAC |
| M (managed) | Get your address from DHCPv6 (stateful) instead/also |
| O (other config) | Use DHCPv6 only for other info (DNS, NTP) — "stateless DHCPv6" |
| L (on-link) | Hosts on this prefix are directly reachable |
Also: RDNSS/DNSSL options in the RA can carry DNS servers directly (RFC 8106), so pure SLAAC networks can work with no DHCPv6 at all — if the client supports RDNSS (Android historically did not, forcing RA+RDNSS or... arguments).
17.3 DHCPv6
- Stateful (M=1): server hands out specific addresses + options over
UDP
546(client)/547(server), using multicastff02::1:2. Clients are keyed by DUID (not MAC), which trips up MAC-based reservations. - Stateless (O=1): address via SLAAC, but DNS/NTP/domain via DHCPv6.
- Prefix Delegation (DHCPv6-PD): ISP delegates e.g. a
/56to your router, which then sub-allocates/64s to your LANs via RA. This is how a home router gets routable space for every device without NAT.
17.4 No NAT, but still a firewall
IPv6 hosts usually have globally routable addresses. Security comes from a stateful firewall (default-deny inbound, allow established/related), not from address hiding. Home routers do this by default. Privacy addresses limit tracking.
17.5 Rogue RA — the IPv6 equivalent of a rogue DHCP server
Any device can send RAs. A misconfigured host (Windows Internet Connection
Sharing, a hypervisor, a phone) advertising itself as a router will black-hole a
whole LAN's IPv6. Defenses: RA Guard on switches, and
net.ipv6.conf.*.accept_ra = 0 on servers that shouldn't listen.
17.6 War story
After enabling IPv6 on a corporate LAN, random Windows laptops lost internet for minutes at a time. A developer's VM was periodically emitting RAs with a bogus prefix and a high priority. Hosts preferred it, installed a default route to nowhere, and only recovered when that RA aged out. Enabling RA Guard on the access switches ended it. Lesson: treat RAs like DHCP — exactly one authorized source, enforced at the switch.
Try it yourself
sudo tcpdump -i eth0 -n 'icmp6 && ip6[40] >= 133 && ip6[40] <= 137' # NDP/RA/RS
ip -6 neigh # the IPv6 neighbor cache (ARP equivalent)
rdisc6 eth0 # actively solicit and print RAs
sysctl net.ipv6.conf.eth0.accept_ra
radvdump # decode received RAs in detail