RFC 4861
Neighbor Discovery for IP version 6 (IPv6)
Neighbor Discovery for IP version 6 (IPv6) 🎀
okay bestie, so this one is RFC 4861, a Standards Track doc from the Network Working Group 🧚 It's dated September 2007 and it's written by a squad of four: T. Narten (IBM), E. Nordmark (Sun Microsystems), W. Simpson (Daydreamer) and H. Soliman (Elevate Technologies) 💖 It obsoletes RFC 2461, so 4861 is the new and improved version of that one. It doesn't update anything else. ✨
Status of This Memo 📜
okay so this doc specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 If you want the official standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). And distribution of this memo is unlimited, so share away 🦋
Abstract 🌸
this document specifies the Neighbor Discovery protocol for IP Version 6 💅 IPv6 nodes on the same link use ND to find out each other's presence, figure out each other's link-layer addresses, find routers, and keep track of reachability info about the paths to active neighbors. it's so iconic 🔥
Table of Contents 🍓
1. Introduction ....................................................4
2. Terminology .....................................................4
2.1. General ....................................................4
2.2. Link Types .................................................8
2.3. Addresses ..................................................9
2.4. Requirements ..............................................10
3. Protocol Overview ..............................................10
3.1. Comparison with IPv4 ......................................14
3.2. Supported Link Types ......................................16
3.3. Securing Neighbor Discovery Messages ......................18
4. Message Formats ................................................18
4.1. Router Solicitation Message Format ........................18
4.2. Router Advertisement Message Format .......................19
4.3. Neighbor Solicitation Message Format ......................22
4.4. Neighbor Advertisement Message Format .....................23
4.5. Redirect Message Format ...................................26
4.6. Option Formats ............................................28
4.6.1. Source/Target Link-layer Address ...................28
4.6.2. Prefix Information .................................29
4.6.3. Redirected Header ..................................31
4.6.4. MTU ................................................32
5. Conceptual Model of a Host .....................................33
5.1. Conceptual Data Structures ................................33
5.2. Conceptual Sending Algorithm ..............................36
5.3. Garbage Collection and Timeout Requirements ...............37
6. Router and Prefix Discovery ....................................38
6.1. Message Validation ........................................39
6.1.1. Validation of Router Solicitation Messages .........39
6.1.2. Validation of Router Advertisement Messages ........39
6.2. Router Specification ......................................40
6.2.1. Router Configuration Variables .....................40
6.2.2. Becoming an Advertising Interface ..................45
6.2.3. Router Advertisement Message Content ...............45
6.2.4. Sending Unsolicited Router Advertisements ..........47
6.2.5. Ceasing To Be an Advertising Interface .............47
6.2.6. Processing Router Solicitations ....................48
6.2.7. Router Advertisement Consistency ...................50
6.2.8. Link-local Address Change ..........................50
6.3. Host Specification ........................................51
6.3.1. Host Configuration Variables .......................51
6.3.2. Host Variables .....................................51
6.3.3. Interface Initialization ...........................52
6.3.4. Processing Received Router Advertisements ..........53
6.3.5. Timing out Prefixes and Default Routers ............56
6.3.6. Default Router Selection ...........................56
6.3.7. Sending Router Solicitations .......................57
7. Address Resolution and Neighbor Unreachability Detection .......59
7.1. Message Validation ........................................59
7.1.1. Validation of Neighbor Solicitations ...............59
7.1.2. Validation of Neighbor Advertisements ..............60
7.2. Address Resolution ........................................60
7.2.1. Interface Initialization ...........................61
7.2.2. Sending Neighbor Solicitations .....................61
7.2.3. Receipt of Neighbor Solicitations ..................62
7.2.4. Sending Solicited Neighbor Advertisements ..........63
7.2.5. Receipt of Neighbor Advertisements .................64
7.2.6. Sending Unsolicited Neighbor Advertisements ........66
7.2.7. Anycast Neighbor Advertisements ....................67
7.2.8. Proxy Neighbor Advertisements ......................68
7.3. Neighbor Unreachability Detection .........................68
7.3.1. Reachability Confirmation ..........................69
7.3.2. Neighbor Cache Entry States ........................70
7.3.3. Node Behavior ......................................71
8. Redirect Function ..............................................73
8.1. Validation of Redirect Messages ...........................74
8.2. Router Specification ......................................75
8.3. Host Specification ........................................76
9. Extensibility - Option Processing ..............................76
10. Protocol Constants ............................................78
11. Security Considerations .......................................79
11.1. Threat Analysis ..........................................79
11.2. Securing Neighbor Discovery Messages .....................81
12. Renumbering Considerations ....................................81
13. IANA Considerations ...........................................83
14. References ....................................................84
14.1. Normative References .....................................84
14.2. Informative References ...................................84
Appendix A: Multihomed Hosts ......................................87
Appendix B: Future Extensions .....................................88
Appendix C: State Machine for the Reachability State ..............89
Appendix D: Summary of IsRouter Rules .............................91
Appendix E: Implementation Issues .................................92
Appendix F: Changes from RFC 2461 .................................94
Acknowledgments ...................................................951. Introduction ✨
okay so this spec defines the Neighbor Discovery (ND) protocol for Internet Protocol Version 6 (IPv6) 💜 Nodes (that's hosts and routers) use ND to figure out the link-layer addresses of neighbors that live on attached links, and to quickly purge cached values that have gone stale 🧹 Hosts also use ND to find neighboring routers that are willing to forward packets on their behalf 🚀 And nodes use the protocol to actively keep track of which neighbors are reachable and which aren't, and to detect changed link-layer addresses 👀 When a router (or the path to a router) fails, a host goes hunting for functioning alternates. main character energy 👑
Unless a document covering operating IP over a particular link type says otherwise, this document applies to all link types 🌈 BUT, because ND uses link-layer multicast for some of its services, it's possible that on some link types (for example, Non-Broadcast Multi-Access (NBMA) links), alternative protocols or mechanisms to implement those services will be specified. Those will live in the appropriate document covering IP over that particular link type 🧚 The services in this document that aren't directly dependent on multicast, like Redirects, Next-hop determination, Neighbor Unreachability Detection, etc., are expected to be provided as specified in this document 💅 The details of how you use ND on NBMA links are covered in [IPv6-NBMA]. And [IPv6-3GPP] and [IPv6-CELL] talk about using this protocol over some cellular links, which are examples of NBMA links 📱
2. Terminology 🦋
2.1. General ✨
okay bestie, this is the glossary section and it's lowkey the foundation for everything after it 🧚 so we gotta be precise. let's go!
IP 💖 means Internet Protocol Version 6. the terms IPv4 and IPv6 only show up where they're needed to avoid confusion.
ICMP 🦋 means Internet Control Message Protocol for the Internet Protocol Version 6. same deal: ICMPv4 and ICMPv6 only get used when it's needed to avoid ambiguity.
node 🌸 is any device that implements IP.
router 👑 is a node that forwards IP packets that aren't explicitly addressed to itself. main character energy, fr.
host 🫶 is any node that is not a router. ngl it's the simple one.
upper layer 🌈 is a protocol layer sitting right above IP. the examples are transport protocols like TCP and UDP, control protocols like ICMP, and routing protocols like OSPF. it also covers Internet-layer (or lower-layer) protocols that get "tunneled" over IP, meaning encapsulated in it. so think Internetwork Packet Exchange (IPX), AppleTalk, or IP itself 🤯
link 🍓 is a communication facility or medium that nodes can talk over at the link layer, which is the layer right below IP. examples are Ethernets (simple or bridged), PPP links, X.25, Frame Relay, or ATM networks. it also counts as a link when it's an Internet-layer (or higher-layer) "tunnel", like a tunnel running over IPv4 or IPv6 itself 💅
interface 💜 is a node's attachment to a link.
neighbors 🎀 are nodes attached to the same link. they're besties on the same wire 😭
address 🔥 is an IP-layer identifier for an interface or a set of interfaces.
anycast address ✨ is an identifier for a set of interfaces, usually belonging to different nodes. a packet sent to an anycast address gets delivered to one of the interfaces that address identifies. it's the "nearest" one, according to the routing protocol's measure of distance. see [ADDR-ARCH].
this one is sooo sneaky: an anycast address looks exactly the same as a unicast address, syntactically speaking. so nodes sending packets to anycast addresses usually have no idea an anycast address is being used 🙈 for the rest of this document, anywhere we talk about unicast addresses, that also applies to anycast addresses in cases where the node doesn't know the unicast address is really an anycast one.
prefix 🦋 is a bit string made of some number of the initial bits of an address.
link-layer address 🌸 is a link-layer identifier for an interface. for example, IEEE 802 addresses on Ethernet links.
on-link 💖 describes an address that's assigned to an interface on a specified link. a node considers an address to be on-link if any of these are true:
- it's covered by one of the link's prefixes (for example, as indicated by the on-link flag in the Prefix Information option), or
- a neighboring router specifies the address as the target of a Redirect message, or
- a Neighbor Advertisement message is received for the (target) address, or
- any Neighbor Discovery message is received from the address.
off-link 🙅♀️ is the opposite of "on-link": an address that isn't assigned to any interfaces on the specified link.
longest prefix match 🧠 is the process of figuring out which prefix (if any) in a set of prefixes covers a target address. a target address is covered by a prefix if all the bits in that prefix match the left-most bits of the target address. when multiple prefixes cover an address, the longest prefix is the one that matches. it's giving precision 💅
reachability 🛤️ is whether or not the one-way "forward" path to a neighbor is working properly. specifically, it's about whether packets sent to a neighbor are reaching the IP layer on the neighboring machine and getting processed properly by that receiving IP layer. for neighboring routers, reachability means packets sent by a node's IP layer get delivered to the router's IP layer, and the router is actually forwarding packets (so it's configured as a router, not a host). for hosts, reachability means packets sent by a node's IP layer get delivered to the neighbor host's IP layer ✨
packet 📦 is an IP header plus payload.
link MTU 📏 is the maximum transmission unit, meaning the maximum packet size in octets that can be conveyed in one transmission unit over a link.
target 🎯 is an address that address resolution information is being sought for, or an address that's the new first hop when a node is being redirected.
proxy 🧚 is a node that responds to Neighbor Discovery query messages on behalf of another node. a router acting for a mobile node that has moved off-link could potentially act as a proxy for that mobile node 🥹
ICMP destination unreachable indication 🚫 is an error indication sent back to the original sender of a packet that can't be delivered, for the reasons outlined in [ICMPv6]. if the error happens on a node other than the one that originated the packet, an ICMP error message gets generated. if the error happens on the originating node, an implementation is not required to actually create and send an ICMP error packet to the source, as long as the upper-layer sender gets notified through an appropriate mechanism (for example, a return value from a procedure call). but heads up, an implementation may find it convenient in some cases to return errors to the sender by taking the offending packet, generating an ICMP error message, and then delivering it locally through the generic error-handling routines 🤓
random delay 🎲 is when sending out messages, where it's sometimes necessary to delay a transmission for a random amount of time. the reasons are to stop multiple nodes from transmitting at exactly the same time, or to stop long-range periodic transmissions from syncing up with each other [SYNC]. when a random component is needed, a node works out the actual delay so that the computed delay is a uniformly distributed random value falling between the specified minimum and maximum delay times. the implementor must take care to make sure the granularity of the calculated random component and the resolution of the timer used are both high enough, so the chance of multiple nodes delaying the same amount of time stays small 🫧
random delay seed 🌱 is about pseudo-random number generators. if one is used in calculating a random delay component, the generator should be initialized with a unique seed before it's used. it's not enough to use the interface identifier alone as the seed, because interface identifiers won't always be unique 😬 to lower the chance that duplicate interface identifiers cause the same seed to get used, the seed should be calculated from a variety of input sources (for example, machine components) that are likely to differ even on identical "boxes". for instance, the seed could be formed by combining the CPU's serial number with an interface identifier. more info on randomness and random number generation can be found in [RAND] 🎀
2.2. Link Types 🌈
different link layers have different properties, and these are the ones that matter for Neighbor Discovery:
multicast capable 📣 is a link that supports a native mechanism at the link layer for sending packets to all neighbors (that's broadcast) or to a subset of them.
point-to-point 💞 is a link that connects exactly two interfaces. a point-to-point link is assumed to have multicast capability and a link-local address.
non-broadcast multi-access (NBMA) 🛰️ is a link that more than two interfaces can attach to, but that doesn't support a native form of multicast or broadcast (for example, X.25, ATM, frame relay, etc.). all link types, NBMA included, are expected to provide multicast service for applications that need it (for example, using multicast servers). however, it's still an open question for further study whether ND should use those facilities or an alternate mechanism that gives the equivalent multicast capability for ND 🤔
shared media 🏙️ is a link that allows direct communication among a number of nodes, but the attached nodes are configured so they don't have complete prefix information for all on-link destinations. at the IP level, nodes on the same link might not know they're neighbors, so by default they communicate through a router. examples are large (switched) public data networks like Switched Multimegabit Data Service (SMDS) and Broadband Integrated Services Digital Network (B-ISDN). these are also called "large clouds". see [SH-MEDIA] ☁️
variable MTU 📐 is a link that doesn't have a well-defined MTU, like IEEE 802.5 token rings. lots of links, like Ethernet, have a standard MTU defined by the link-layer protocol or by the specific document describing how to run IP over that link layer.
asymmetric reachability 📡 is a link where non-reflexive and/or non-transitive reachability is part of normal operation. (non-reflexive reachability means packets from A reach B, but packets from B don't reach A. non-transitive reachability means packets from A reach B and packets from B reach C, but packets from A don't reach C.) lots of radio links show these properties 💀✨
2.3. Addresses ✨
okay so Neighbor Discovery is literally a whole squad of addresses, and they're all defined over in [ADDR-ARCH] 💅 here's the lineup:
- all-nodes multicast address: the link-local scope address that reaches every node on the link,
FF02::1🫶 - all-routers multicast address: the link-local scope address that reaches every router,
FF02::2👑 - solicited-node multicast address: a link-local scope multicast address that gets computed from the solicited target's address. The math is in [ADDR-ARCH] 🧚 and it's giving clever, because addresses that only differ in their most significant bits (like when you've got multiple prefixes from different providers) end up mapping to the same solicited-node address. That means a node has fewer multicast addresses to join at the link layer. Lowkey genius 🦋
- link-local address: a unicast address with link-only scope, used to reach neighbors. All interfaces on routers MUST have a link-local address. Also, [ADDRCONF] requires that interfaces on hosts have a link-local address 🌸
- unspecified address: a reserved value that means "no address" (like when the address is unknown). It is never used as a destination address 🙈, but a sender that doesn't know its own address yet can use it as a source address. That's a thing that happens while checking whether an address is unused during stateless address autoconfiguration [ADDRCONF] 🍓 The unspecified address is
0:0:0:0:0:0:0:0💜
Also, heads up bestie: this spec doesn't strictly follow the consistency requirements in [ADDR-SEL] for the scopes of source and destination addresses. In some cases a host can use a source address with a bigger scope than the destination address in the IPv6 header 👀✨
2.4. Requirements 🎀
the BCP 14 keywords (MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL) mean what [KEYWORDS] says they mean whenever they show up in this document 🔥
this doc also talks about internal conceptual variables, which are used to describe how the protocol behaves, and external variables that an implementation must let system administrators change 🌈 The exact variable names, how their values change, and how their settings affect protocol behavior are only there to demonstrate the behavior. An implementation doesn't have to use the exact same form as described here, as long as its external behavior stays consistent with this document 💖
3. Protocol Overview ✨
okay so this protocol is basically the group chat for nodes sitting on the same link 💬, and it fixes a bunch of problems about how they talk to each other. it defines mechanisms for solving each of these:
- Router Discovery 🧭: how hosts locate the routers that reside on an attached link.
- Prefix Discovery 🗺️: how hosts discover the set of address prefixes that define which destinations are on-link for an attached link. (nodes use prefixes to tell destinations that reside on-link apart from those only reachable through a router.)
- Parameter Discovery 🎛️: how a node learns link parameters (such as the link MTU) or Internet parameters (such as the hop limit value) to place in outgoing packets.
- Address Autoconfiguration 🪄: introduces the mechanisms needed to let nodes configure an address for an interface in a stateless manner. stateless address autoconfiguration is specified in [ADDRCONF].
- Address resolution 🔍: how nodes determine the link-layer address of an on-link destination (e.g., a neighbor) when all they have is the destination's IP address.
- Next-hop determination 👣: the algorithm for mapping an IP destination address into the IP address of the neighbor to which traffic for the destination should be sent. the next-hop can be a router or the destination itself.
- Neighbor Unreachability Detection 👻: how nodes determine that a neighbor is no longer reachable. for neighbors used as routers, alternate default routers can be tried. for both routers and hosts, address resolution can be performed again.
- Duplicate Address Detection 👯: how a node determines whether or not an address it wishes to use is already in use by another node.
- Redirect 🚦: how a router informs a host of a better first-hop node to reach a particular destination.
neighbor discovery defines five different ICMP packet types 📦. there's a pair of Router Solicitation and Router Advertisement messages, a pair of Neighbor Solicitation and Neighbor Advertisement messages, and a Redirect message. here's what each one does:
- Router Solicitation 🙋: when an interface becomes enabled, hosts may send out Router Solicitations that request routers to generate Router Advertisements immediately rather than at their next scheduled time.
- Router Advertisement 📣: routers advertise their presence together with various link and Internet parameters, either periodically or in response to a Router Solicitation message. Router Advertisements contain prefixes that are used for determining whether another address shares the same link (on-link determination) and/or address configuration, a suggested hop limit value, etc.
- Neighbor Solicitation 🫣: sent by a node to determine the link-layer address of a neighbor, or to verify that a neighbor is still reachable via a cached link-layer address. Neighbor Solicitations are also used for Duplicate Address Detection.
- Neighbor Advertisement 💌: a response to a Neighbor Solicitation message. a node may also send unsolicited Neighbor Advertisements to announce a link-layer address change.
- Redirect 🚦: used by routers to inform hosts of a better first hop for a destination.
on multicast-capable links, each router periodically multicasts a Router Advertisement packet announcing that it's around 📡. a host receives Router Advertisements from all routers and builds a list of default routers. routers generate Router Advertisements often enough that hosts learn of their presence within a few minutes, but not so often that hosts can rely on the absence of advertisements to detect router failure. a separate Neighbor Unreachability Detection algorithm handles failure detection, so that's the one doing the detective work 🕵️♀️.
Router Advertisements contain a list of prefixes used for on-link determination and/or autonomous address configuration. flags attached to the prefixes specify the intended uses of each particular prefix 🏳️. hosts use the advertised on-link prefixes to build and maintain a list, and that list is what they check when deciding whether a packet's destination is on-link or beyond a router. ngl this is the part people miss: a destination can be on-link even if no advertised on-link prefix covers it. in that case, a router can send a Redirect to let the sender know the destination is a neighbor 🤝.
Router Advertisements (and their per-prefix flags) let routers tell hosts how to perform Address Autoconfiguration 🎀. for example, routers can specify whether hosts should use DHCPv6 and/or autonomous (stateless) address configuration.
Router Advertisement messages also carry Internet parameters, such as the hop limit that hosts should use in outgoing packets. they can optionally carry link parameters too, like the link MTU. this makes centralized administration of critical parameters possible, since they can be set on routers and automatically propagated to all attached hosts 👑.
nodes do address resolution by multicasting a Neighbor Solicitation that asks the target node to return its link-layer address 📮. Neighbor Solicitation messages are multicast to the solicited-node multicast address of the target address. the target returns its link-layer address in a unicast Neighbor Advertisement message. a single request-response pair of packets is enough for both the initiator and the target to resolve each other's link-layer addresses, because the initiator includes its own link-layer address in the Neighbor Solicitation 🫶.
Neighbor Solicitation messages can also be used to determine whether more than one node has been assigned the same unicast address 👯. the use of Neighbor Solicitation messages for Duplicate Address Detection is specified in [ADDRCONF].
Neighbor Unreachability Detection detects the failure of a neighbor, or the failure of the forward path to the neighbor 💀. doing so requires positive confirmation that packets sent to a neighbor are actually reaching that neighbor and being processed properly by its IP layer. it uses confirmation from two sources. when possible, upper-layer protocols provide positive confirmation that a connection is making "forward progress", meaning previously sent data is known to have been delivered correctly (e.g., new acknowledgments were received recently) ✅. when positive confirmation isn't forthcoming through such "hints", a node sends unicast Neighbor Solicitation messages that solicit Neighbor Advertisements as reachability confirmation from the next hop. to cut down on unnecessary network traffic, probe messages are only sent to neighbors that the node is actively sending packets to 🧹.
okay and beyond the general problems above, neighbor discovery also handles the following situations 🌈:
- Link-layer address change 🏠: a node that knows its link-layer address has changed can multicast a few (unsolicited) Neighbor Advertisement packets to all nodes, to quickly update cached link-layer addresses that have become invalid. the sending of unsolicited advertisements is a performance enhancement only (e.g., unreliable). the Neighbor Unreachability Detection algorithm ensures that all nodes will reliably discover the new address, though the delay may be somewhat longer ⏳.
- Inbound load balancing ⚖️: nodes with replicated interfaces may want to load balance the reception of incoming packets across multiple network interfaces on the same link. such nodes have multiple link-layer addresses assigned to the same interface. for example, a single network driver could represent multiple network interface cards as a single logical interface with multiple link-layer addresses.
neighbor discovery lets a router load balance traffic addressed to itself by allowing routers to omit the source link-layer address from Router Advertisement packets. that forces neighbors to use Neighbor Solicitation messages to learn the link-layer addresses of routers. the returned Neighbor Advertisement messages can then contain link-layer addresses that differ depending on, e.g., who issued the solicitation. this specification does not define a mechanism that lets hosts Load-balance incoming packets. see [LD-SHRE] 🔗.
- Anycast addresses 📍: anycast addresses identify one of a set of nodes providing an equivalent service, and multiple nodes on the same link may be configured to recognize the same anycast address. neighbor discovery handles anycasts by having nodes expect to receive multiple Neighbor Advertisements for the same target. all advertisements for anycast addresses are tagged as non-Override advertisements. a non-Override advertisement is one that does not update or replace the information sent by another advertisement. these advertisements are discussed later, in the context of Neighbor Advertisement messages. this invokes specific rules to determine which of the potentially multiple advertisements should be used 🧠.
- Proxy advertisements 🦸: a node willing to accept packets on behalf of a target address that is unable to respond to Neighbor Solicitations can issue non-Override Neighbor Advertisements. Proxy advertisements are used by Mobile IPv6 Home Agents to defend mobile nodes' addresses when they move off-link 🏡. however, it is not intended as a general mechanism to handle nodes that, e.g., do not implement this protocol 🙅♀️.
3.1. Comparison with IPv4 🦋
okay so IPv6 Neighbor Discovery is basically the IPv4 squad of ARP [ARP], ICMP Router Discovery [RDISC], and ICMP Redirect [ICMPv4] all merged into one super-protocol 💅 In IPv4 there's no generally agreed-upon mechanism for Neighbor Unreachability Detection, though the Hosts Requirements document [HR-CL] does describe some possible algorithms for Dead Gateway Detection (which is a subset of what Neighbor Unreachability Detection tackles) 🙈
The Neighbor Discovery protocol gives you a whole buffet of upgrades over the IPv4 set:
- Router Discovery is in the base protocol set. Hosts don't have to "snoop" the routing protocols 👀
- Router Advertisements carry link-layer addresses. No extra packet exchange is needed to resolve the router's link-layer address ✨
- Router Advertisements carry prefixes for a link. There's no need for a separate mechanism to configure the "netmask" 🎀
- Router Advertisements enable Address Autoconfiguration. 🧚
- Routers can advertise an MTU for hosts to use on the link. This makes sure all nodes use the same MTU value on links that don't have a well-defined MTU 📏
- Address resolution multicasts are "spread" over 16 million (2^24) multicast addresses. This greatly cuts down on address-resolution-related interrupts on nodes other than the target. Moreover, non-IPv6 machines should not be interrupted at all 🙌
- Redirects contain the link-layer address of the new first hop. Separate address resolution isn't needed when you receive a redirect 🦋
- Multiple prefixes can be associated with the same link. By default, hosts learn all on-link prefixes from Router Advertisements. However, routers may be configured to omit some or all prefixes. In that case, hosts assume destinations are off-link and send traffic to routers. A router can then issue redirects as appropriate 🌸
- Unlike IPv4, the recipient of an IPv6 redirect assumes the new next-hop is on-link. In IPv4, a host ignores redirects that specify a next-hop that isn't on-link according to the link's network mask. The IPv6 redirect mechanism is analogous to the XRedirect facility specified in [SH-MEDIA]. It's expected to be useful on non-broadcast and shared media links, where it's undesirable or impossible for nodes to know all prefixes for on-link destinations 🤯
- Neighbor Unreachability Detection is part of the base. It significantly improves the robustness of packet delivery when routers are failing, links are partially failing or partitioned, or nodes change their link-layer addresses. For instance, mobile nodes can move off-link without losing any connectivity due to stale ARP caches 🏃♀️
- Unlike ARP, Neighbor Discovery detects half-link failures (using Neighbor Unreachability Detection) and avoids sending traffic to neighbors with which two-way connectivity is absent 💅
- Unlike IPv4 Router Discovery, Router Advertisement messages do not contain a preference field. The preference field isn't needed to handle routers of different "stability." Neighbor Unreachability Detection will detect dead routers and switch to a working one 💀
- Link-local addresses uniquely identify routers (for Router Advertisement and Redirect messages). This makes it possible for hosts to maintain router associations when a site renumbers to use new global prefixes 🔥
- Setting the Hop Limit to 255 makes Neighbor Discovery immune to off-link senders that accidentally or intentionally send ND messages. In IPv4, off-link senders can send both ICMP Redirects and Router Advertisement messages 🛡️
- Placing address resolution at the ICMP layer makes the protocol more media-independent than ARP. It also makes it possible to use generic IP-layer authentication and security mechanisms as appropriate 🫶
3.2. Supported Link Types 🌈
Neighbor Discovery supports links with different properties. When certain properties are present, only a subset of the ND protocol mechanisms are fully specified in this document:
- point-to-point: Neighbor Discovery handles these links just like multicast links. (Multicast can be trivially provided on point-to-point links, and interfaces can be assigned link-local addresses.) 🧃
- multicast: Neighbor Discovery operates over multicast-capable links as described in this document. 📡
- non-broadcast multiple access (NBMA): Redirect, Neighbor Unreachability Detection, and next-hop determination should be implemented as described in this document. Address resolution, and the mechanism for delivering Router Solicitations and Advertisements on NBMA links, are not specified in this document. Also, if hosts support manual configuration of a list of default routers, hosts can dynamically acquire the link-layer addresses for their neighbors from Redirect messages 🌸
- shared media: The Redirect message is modeled after the XRedirect message in [SH-MEDIA] to simplify using the protocol on shared media links.
- This specification does not address shared media issues that only relate to routers, such as:
- How routers exchange reachability information on a shared media link.
- How a router determines the link-layer address of a host, which it needs in order to send redirect messages to that host.
- How a router determines that it is the first-hop router for a received packet.
- The protocol is extensible (through the definition of new options), so other solutions might be possible in the future 🔮
- This specification does not address shared media issues that only relate to routers, such as:
- variable MTU: Neighbor Discovery allows routers to specify an MTU for the link, which all nodes then use. All nodes on a link must use the same MTU (or Maximum Receive Unit) in order for multicast to work properly. Otherwise, when multicasting, a sender, which can't know which nodes will receive the packet, could not determine a minimum packet size that all receivers can process (or Maximum Receive Unit) 😵💫
- asymmetric reachability: Neighbor Discovery detects the absence of symmetric reachability. A node avoids paths to a neighbor with which it doesn't have symmetric connectivity.
- Neighbor Unreachability Detection will typically identify such half-links, and the node will refrain from using them.
- The protocol can presumably be extended in the future to find viable paths in environments that lack reflexive and transitive connectivity 🧩
3.3. Securing Neighbor Discovery Messages 🔐
Neighbor Discovery messages are needed for a bunch of different functions. Several of those functions let hosts figure out who owns an address, or how a link-layer address maps to an IP-layer address. Vulnerabilities related to Neighbor Discovery are discussed in Section 11.1. A general solution for securing Neighbor Discovery is outside the scope of this specification and is discussed in [SEND]. However, Section 11.2 explains how, and under which constraints, IPsec Authentication Header (AH) or Encapsulating Security Payload (ESP) can be used to secure Neighbor Discovery 🛡️
4. Message Formats ✨
This section introduces the message formats for all messages used in this specification 📋
4.1. Router Solicitation Message Format 🎀
Hosts send Router Solicitations in order to prompt routers to generate Router Advertisements quickly ⚡
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options ...
+-+-+-+-+-+-+-+-+-+-+-+-IP Fields:
- Source Address: An IP address assigned to the sending interface, or the unspecified address if no address is assigned to the sending interface.
- Destination Address: Typically the all-routers multicast address.
- Hop Limit:
255
ICMP Fields:
- Type:
133 - Code:
0 - Checksum: The ICMP checksum. See [ICMPv6].
- Reserved: This field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. 🫧
Valid Options:
- Source link-layer address: The link-layer address of the sender, if known. MUST NOT be included if the Source Address is the unspecified address. Otherwise, it SHOULD be included on link layers that have addresses. 🔗
Future versions of this protocol may define new option types. Receivers MUST silently ignore any options they do not recognize and continue processing the message. 💖
4.2. Router Advertisement Message Format 📡✨
okay so routers send out Router Advertisement messages periodically, or whenever a Router Solicitation comes in asking for one 🫶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cur Hop Limit |M|O| Reserved | Router Lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reachable Time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Retrans Timer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options ...
+-+-+-+-+-+-+-+-+-+-+-+-IP Fields 🎀
Source Address: this one MUST be the link-local address assigned to the interface the message gets sent from 💅Destination Address: typically the Source Address of the Router Solicitation that invoked this, or the all-nodes multicast address 🦋Hop Limit: 255
ICMP Fields 🌸
Type: 134Code: 0Checksum: the ICMP checksum. See [ICMPv6].Cur Hop Limit: an 8-bit unsigned integer. This is the default value that should be placed in the Hop Count field of the IP header for outgoing IP packets. A value of zero means unspecified (by this router) 🍓M: a 1-bit "Managed address configuration" flag. When it's set, addresses are available via Dynamic Host Configuration Protocol [DHCPv6] 🧚- If the M flag is set, the O flag is redundant and can be ignored, because DHCPv6 will return all the available configuration info anyway 💖
O: a 1-bit "Other configuration" flag. When it's set, other configuration info is available via DHCPv6. Examples are DNS-related info or info on other servers within the network 🌈- Note: If neither M nor O flags are set, this means no information is available via DHCPv6 👀
Reserved: a 6-bit unused field. It MUST be initialized to zero by the sender and MUST be ignored by the receiver 🙈Router Lifetime: a 16-bit unsigned integer. This is the lifetime associated with the default router, in seconds. The field can hold values up to 65535, and receivers should handle any value, while the sending rules in Section 6 limit the lifetime to 9000 seconds. A Lifetime of 0 means the router is not a default router and SHOULD NOT appear on the default router list 💀 The Router Lifetime only applies to the router's usefulness as a default router. It does not apply to info in other message fields or options. Options that need time limits for their info include their own lifetime fields ⭐Reachable Time: a 32-bit unsigned integer. This is the time, in milliseconds, that a node assumes a neighbor is reachable after getting a reachability confirmation. It's used by the Neighbor Unreachability Detection algorithm (see Section 7.3). A value of zero means unspecified (by this router) ✨Retrans Timer: a 32-bit unsigned integer. This is the time, in milliseconds, between retransmitted Neighbor Solicitation messages. It's used by address resolution and the Neighbor Unreachability Detection algorithm (see Sections 7.2 and 7.3). A value of zero means unspecified (by this router) 🔥
Possible options 💜
Source link-layer address: the link-layer address of the interface the Router Advertisement is sent from. It's only used on link layers that have addresses. A router MAY omit this option in order to enable inbound load sharing across multiple link-layer addresses 🦋MTU: SHOULD be sent on links that have a variable MTU (as specified in the document that describes how to run IP over that particular link type). MAY be sent on other links 🫧Prefix Information: these options specify the prefixes that are on-link and/or used for stateless address autoconfiguration. A router SHOULD include all its on-link prefixes (except the link-local prefix), so multihomed hosts have complete prefix info about on-link destinations for the links they attach to. If that complete info is lacking, a host with multiple interfaces may not be able to pick the correct outgoing interface when sending traffic to its neighbors 😭
Future versions of this protocol may define new option types. Receivers MUST silently ignore any options they do not recognize and continue processing the message 🫶
4.3. Neighbor Solicitation Message Format 🧚
okay this one is so iconic 👑 Nodes send Neighbor Solicitations to ask for the link-layer address of a target node, while also giving their own link-layer address to the target. They're multicast when a node needs to resolve an address, and unicast when a node wants to check that a neighbor is still reachable 💅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Target Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options ...
+-+-+-+-+-+-+-+-+-+-+-+-IP Fields 🎀
Source Address: either an address assigned to the interface the message is sent from, or (if Duplicate Address Detection is in progress [ADDRCONF]) the unspecified address 🌸Destination Address: either the solicited-node multicast address that corresponds to the target address, or the target address 🍓Hop Limit: 255
ICMP Fields 🌈
Type: 135Code: 0Checksum: the ICMP checksum. See [ICMPv6].Reserved: this field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver 🙈Target Address: the IP address of the target of the solicitation. It MUST NOT be a multicast address 🔥
Possible options 💜
Source link-layer address: the link-layer address of the sender. It MUST NOT be included when the source IP address is the unspecified address. Otherwise, on link layers that have addresses, this option MUST be included in multicast solicitations and SHOULD be included in unicast solicitations ✨
Future versions of this protocol may define new option types. Receivers MUST silently ignore any options they do not recognize and continue processing the message 🦋
4.4. Neighbor Advertisement Message Format ✨
okay so nodes send Neighbor Advertisements as replies to Neighbor Solicitations 💌, and they also send unsolicited ones to (unreliably) spread new info super fast 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R|S|O| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Target Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options ...
+-+-+-+-+-+-+-+-+-+-+-+-IP Fields 🌸
- Source Address: an address assigned to the interface the advertisement is sent from 📮
- Destination Address: for solicited advertisements, it's the Source Address of the Neighbor Solicitation that invoked it or, if that solicitation's Source Address is the unspecified address, the all-nodes multicast address. For unsolicited advertisements, it's typically the all-nodes multicast address 📣
- Hop Limit:
255
ICMP Fields 💅
- Type:
136 - Code:
0 - Checksum: the ICMP checksum. See [ICMPv6].
- R (Router flag): when set, the R-bit says the sender is a router 🏰. Neighbor Unreachability Detection uses it to catch a router that turns into a host 👀
- S (Solicited flag): when set, the S-bit says the advertisement was sent in response to a Neighbor Solicitation from the Destination address 💘. It's used as a reachability confirmation for Neighbor Unreachability Detection. It MUST NOT be set in multicast advertisements or in unsolicited unicast advertisements 🙅♀️
- O (Override flag): when set, the O-bit says the advertisement should override an existing cache entry and update the cached link-layer address 🔄. When it's not set, the advertisement won't update a cached link-layer address, though it will update an existing Neighbor Cache entry where no link-layer address is known 🧠. It SHOULD NOT be set in solicited advertisements for anycast addresses and in solicited proxy advertisements. It SHOULD be set in other solicited advertisements and in unsolicited advertisements ✨
- Reserved: a 29-bit unused field 🫧. It MUST be initialized to zero by the sender and MUST be ignored by the receiver.
- Target Address: for solicited advertisements, it's the Target Address field from the Neighbor Solicitation message that prompted this one 🎯. For an unsolicited advertisement, it's the address whose link-layer address has changed 🔁. The Target Address MUST NOT be a multicast address 🚫
Possible options 🎀
- Target link-layer address: the link-layer address for the target, meaning the sender of the advertisement 📬. This option MUST be included on link layers that have addresses when responding to multicast solicitations. When responding to a unicast Neighbor Solicitation, this option SHOULD be included.
The option MUST be included for multicast solicitations so we don't get stuck in infinite Neighbor Solicitation "recursion" 🌀 when the peer node doesn't have a cache entry to return a Neighbor Advertisements message. When responding to unicast solicitations, the option can be left out, since the sender of the solicitation already has the correct link-layer address (otherwise it couldn't have sent the unicast solicitation in the first place) 🤷♀️. Including it anyway adds very little overhead, though, and it kills a possible race condition where the sender deletes the cached link-layer address before it gets a response to an earlier solicitation 🏃♀️💨
Future versions of this protocol may define new option types 🔮. Receivers MUST silently ignore any options they do not recognize and continue processing the message 🫶
4.5. Redirect Message Format 🦋
routers send Redirect packets to tell a host about a better first-hop node on the path to a destination 🛣️. Hosts can be redirected to a better first-hop router, but a redirect can also tell them the destination is actually a neighbor 👯. That second case happens by setting the ICMP Target Address equal to the ICMP Destination Address.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Target Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Destination Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options ...
+-+-+-+-+-+-+-+-+-+-+-+-IP Fields 🌷
- Source Address: MUST be the link-local address assigned to the interface this message is sent from 🔗
- Destination Address: the Source Address of the packet that triggered the redirect 🎯
- Hop Limit:
255
ICMP Fields 💜
- Type:
137 - Code:
0 - Checksum: the ICMP checksum. See [ICMPv6].
- Reserved: this field is unused 🫧. It MUST be initialized to zero by the sender and MUST be ignored by the receiver.
- Target Address: an IP address that's a better first hop to use for the ICMP Destination Address 🧭. When the target is the actual endpoint of communication (so the destination is a neighbor), the Target Address field MUST contain the same value as the ICMP Destination Address field. Otherwise, the target is a better first-hop router, and the Target Address MUST be the router's link-local address so hosts can uniquely identify routers 🪪
- Destination Address: the IP address of the destination that gets redirected to the target 🏁
Possible options 🍓
- Target link-layer address: the link-layer address for the target 📇. It SHOULD be included (if known). Heads up, though: on NBMA links, hosts may rely on the presence of the Target Link-Layer Address option in Redirect messages to work out the link-layer addresses of neighbors 🕵️♀️. In those cases, the option MUST be included in Redirect messages.
- Redirected Header: as much as possible of the IP packet that triggered the Redirect, without making the redirect packet exceed the minimum MTU specified in [IPv6] 📦
4.6. Option Formats 🧚
Neighbor Discovery messages include zero or more options 🎁, and some of them may show up multiple times in the same message. Options should be padded when necessary so they end on their natural 64-bit boundaries. All options look like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ ... ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Fields 🫶
- Type: an 8-bit identifier for the type of option 🏷️. The options defined in this document are:
Option Name Type
Source Link-Layer Address 1
Target Link-Layer Address 2
Prefix Information 3
Redirected Header 4
MTU 5- Length: an 8-bit unsigned integer 🔢. It's the length of the option (including the type and length fields) in units of 8 octets. The value
0is invalid. Nodes MUST silently discard an ND packet that contains an option with length zero 🗑️
4.6.1. Source/Target Link-layer Address 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Link-Layer Address ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+okay so this option is the link-layer address slot, and it comes in two flavours 💖
Type:1means it's the Source Link-layer Address, and2means it's the Target Link-layer Address 🎀Length: the length of the option (type and length fields included) in units of 8 octets. For example, the length for IEEE 802 addresses is1[IPv6-ETHER]. ✨Link-Layer Address: the variable length link-layer address. Its content and format (including byte and bit ordering) is expected to be spelled out in specific documents that describe how IPv6 operates over different link layers. For instance, [IPv6-ETHER]. 🧚
Now the vibes: the Source one carries the sender's link-layer address, and it shows up in Neighbor Solicitation, Router Solicitation and Router Advertisement packets 🌸. The Target one carries the target's link-layer address, and it shows up in Neighbor Advertisement and Redirect packets 💜.
These options MUST be silently ignored for other Neighbor Discovery messages. 🙈
4.6.2. Prefix Information 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Prefix Length |L|A| Reserved1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Valid Lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Preferred Lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Prefix +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+this one is the big main-character option 👑 Here are the fields:
Type:3Length:4Prefix Length: an 8-bit unsigned integer. It's the number of leading bits in the Prefix that are valid, and the value ranges from0to128. This field gives the info needed for on-link determination (when combined with theLflag in the prefix information option). It also helps with address autoconfiguration as specified in [ADDRCONF], which may have more restrictions on the prefix length. 🦋L: a 1-bit on-link flag. When set, it means this prefix can be used for on-link determination. When it's not set, the advertisement makes no statement about the on-link or off-link properties of the prefix. Basically, if theLflag is not set, a host MUST NOT conclude that an address derived from the prefix is off-link. That is, it MUST NOT update a previous indication that the address is on-link. 🙅♀️A: a 1-bit autonomous address-configuration flag. When set, it means this prefix can be used for stateless address configuration as specified in [ADDRCONF]. ✨Reserved1: a 6-bit unused field. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. 🌸Valid Lifetime: a 32-bit unsigned integer. It's the length of time in seconds (relative to when the packet is sent) that the prefix is valid for on-link determination. The value of all one bits (0xffffffff) means infinity. The Valid Lifetime is also used by [ADDRCONF]. ⭐Preferred Lifetime: a 32-bit unsigned integer. It's the length of time in seconds (relative to when the packet is sent) that addresses generated from the prefix via stateless address autoconfiguration stay preferred [ADDRCONF]. The value of all one bits (0xffffffff) means infinity. See [ADDRCONF]. 💅
Note that the value of this field MUST NOT exceed the Valid Lifetime field, so we don't end up preferring addresses that are no longer valid. 🙈
Reserved2: this field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. 💜Prefix: an IP address or a prefix of an IP address. The Prefix Length field says how many leading bits are valid. The bits after the prefix length are reserved and MUST be initialized to zero by the sender and ignored by the receiver. A router SHOULD NOT send a prefix option for the link-local prefix, and a host SHOULD ignore such a prefix option. 🧚
The Prefix Information option gives hosts their on-link prefixes and the prefixes used for Address Autoconfiguration. It shows up in Router Advertisement packets and MUST be silently ignored for other messages. 🎀
4.6.3. Redirected Header 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ IP header + data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Fields, bestie:
Type:4Length: the length of the option in units of 8 octets.Reserved: these fields are unused. They MUST be initialized to zero by the sender and MUST be ignored by the receiver. 🌷IP header + data: the original packet, truncated so the size of the redirect message doesn't exceed the minimum MTU required to support IPv6 as specified in [IPv6]. 🫶
So this option is used in Redirect messages and carries all or part of the packet being redirected 🦋.
This option MUST be silently ignored for other Neighbor Discovery messages. 🙈
4.6.4. MTU 💖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MTU |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Fields:
Type:5Length:1Reserved: this field is unused. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. 💅MTU: a 32-bit unsigned integer. It's the recommended MTU for the link. 🌸
The MTU option is used in Router Advertisement messages so that all nodes on a link use the same MTU value, in cases where the link MTU isn't well known. ✨
This option MUST be silently ignored for other Neighbor Discovery messages. 🙈
Okay bestie, this next bit is the real tea. When heterogeneous technologies get bridged together, the maximum supported MTU can differ from one segment to another. If the bridges don't generate ICMP Packet Too Big messages, communicating nodes can't use Path MTU to figure out the right MTU on a per-neighbor basis. In that situation, routers can be configured to use the MTU option to specify the maximum MTU value that's supported by all segments. 🔥
5. Conceptual Model of a Host 🌈
This section describes a conceptual model of one possible data structure organization that hosts (and, to some extent, routers) maintain when they interact with neighboring nodes 🧚. The organization is provided to make it easier to explain how the Neighbor Discovery protocol should behave. This document does not mandate that implementations adhere to this model, as long as their external behavior is consistent with what's described in this document. 🫶
This model only cares about the parts of host behavior that are directly related to Neighbor Discovery. In particular, it doesn't get into things like source address selection, or choosing an outgoing interface on a multihomed host 💅.
5.1. Conceptual Data Structures ✨
okay so every host needs to keep track of a few things for each interface 🫶 here's the lineup:
- Neighbor Cache 💖: a set of entries about individual neighbors that traffic has been sent to recently. Entries are keyed on the neighbor's on-link unicast IP address and hold stuff like its link-layer address, a flag saying whether the neighbor is a router or a host (called
IsRouterin this document), a pointer to any queued packets waiting for address resolution to complete, etc. A Neighbor Cache entry also holds info for the Neighbor Unreachability Detection algorithm: the reachability state, the number of unanswered probes, and the time the next Neighbor Unreachability Detection event is scheduled to take place. - Destination Cache 🦋: a set of entries about destinations that traffic has been sent to recently. It covers both on-link and off-link destinations and acts as a level of indirection into the Neighbor Cache, mapping a destination IP address to the IP address of the next-hop neighbor. This cache gets updated with info learned from Redirect messages. Implementations may find it convenient to stash extra stuff that isn't directly about Neighbor Discovery in Destination Cache entries, like the Path MTU (PMTU) and the round-trip timers maintained by transport protocols 🧚
- Prefix List 🌸: a list of the prefixes that define a set of addresses that are on-link. Prefix List entries are created from info received in Router Advertisements. Each entry has an invalidation timer value (pulled from the advertisement) that expires the prefix when it becomes invalid. A special "infinity" timer value means a prefix stays valid forever, unless a new (finite) value shows up in a later advertisement.
The link-local prefix is considered to be on the prefix list with an infinite invalidation timer, regardless of whether routers are advertising a prefix for it. Received Router Advertisements SHOULD NOT modify the invalidation timer for the link-local prefix 🙈 this one is a big deal, so don't touch it!
- Default Router List 👑: a list of routers that packets may be sent to. Router list entries point to entries in the Neighbor Cache, and the algorithm for picking a default router favors routers known to be reachable over ones whose reachability is suspect. Each entry also has an invalidation timer value (pulled from Router Advertisements) that deletes entries that are no longer advertised.
Note that these conceptual data structures can be implemented using a variety of techniques. One possible approach is a single longest-match routing table for all of the above. No matter how you implement it, it is absolutely critical that the Neighbor Cache entry for a router is shared by all Destination Cache entries using that router, so you don't end up sending redundant Neighbor Unreachability Detection probes 😭
Also, other protocols (e.g., Mobile IPv6) might add extra conceptual data structures. An implementation is at liberty to do those however it pleases. For example, an implementation could merge all the conceptual data structures into one routing table 💅
The Neighbor Cache holds the info maintained by the Neighbor Unreachability Detection algorithm. The key piece is a neighbor's reachability state, which is one of five possible values. These definitions are informal; the precise ones live in Section 7.3.2 🎀
INCOMPLETE: address resolution is in progress and the neighbor's link-layer address hasn't been determined yet.REACHABLE: roughly speaking, the neighbor was known to be reachable recently (within tens of seconds ago).STALE: the neighbor is no longer known to be reachable, but until traffic is sent to it, no attempt should be made to verify its reachability.DELAY: the neighbor is no longer known to be reachable, and traffic has recently been sent to it. Rather than probing right away, probes are delayed for a short while to give upper-layer protocols a chance to provide reachability confirmation.PROBE: the neighbor is no longer known to be reachable, and unicast Neighbor Solicitation probes are being sent to verify reachability.
5.2. Conceptual Sending Algorithm 🚀
when a node sends a packet to a destination, it combines the Destination Cache, the Prefix List, and the Default Router List to figure out the IP address of the right next hop. This is called "next-hop determination" 💫 Once the next hop's IP address is known, the Neighbor Cache gets checked for link-layer info about that neighbor.
Here's how next-hop determination works for a given unicast destination. The sender does a longest prefix match against the Prefix List to decide whether the packet's destination is on-link or off-link. If it's on-link, the next-hop address is the same as the packet's destination address. Otherwise, the sender picks a router from the Default Router List (following the rules described in Section 6.3.6) 🦋
Next-hop determination isn't run on every single packet, because that would be wasteful 🙅♀️ Instead, the results get saved in the Destination Cache (which also picks up updates from Redirect messages). When a node has a packet to send, it checks the Destination Cache first. If there's no entry for the destination, next-hop determination gets invoked to create one.
Once the next-hop IP address is known, the sender looks in the Neighbor Cache for link-layer info. If there's no entry, the sender creates one, sets its state to INCOMPLETE, starts Address Resolution, and queues the data packet until address resolution is done. For multicast-capable interfaces, Address Resolution means sending a Neighbor Solicitation message and waiting for a Neighbor Advertisement. When a Neighbor Advertisement comes back, the link-layer address goes into the Neighbor Cache entry and the queued packet gets transmitted ✨ The address resolution mechanism is described in detail in Section 7.2.
For multicast packets, the next hop is always the (multicast) destination address, and it's considered to be on-link. How to find the link-layer address for a given IP multicast address is covered in a separate document that deals with running IP over a particular link type (e.g., [IPv6-ETHER]) 🧚
Every time a Neighbor Cache entry is accessed while transmitting a unicast packet, the sender checks the Neighbor Unreachability Detection info according to that algorithm (Section 7.3). This check might result in the sender transmitting a unicast Neighbor Solicitation to make sure the neighbor is still reachable 🔥
Next-hop determination is done the first time traffic is sent to a destination. As long as later communication to that destination keeps succeeding, the Destination Cache entry keeps getting used. If communication stops working, as decided by the Neighbor Unreachability Detection algorithm, next-hop determination may need to be performed again. For example, traffic going through a failed router should be switched to a working router. Likewise, it may be possible to reroute traffic destined for a mobile node to a "mobility agent" 💜
Note that when a node redoes next-hop determination, there's no need to throw away the whole Destination Cache entry. In fact, it's generally beneficial to keep the cached stuff like the PMTU and round-trip timer values that may also live in that entry 🍓
Routers and multihomed hosts have multiple interfaces. For the rest of this document, it's assumed that all sent and received Neighbor Discovery messages refer to the interface of the appropriate context. For example, when responding to a Router Solicitation, the matching Router Advertisement goes out the interface the solicitation came in on 🌈
5.3. Garbage Collection and Timeout Requirements 🧹
the conceptual data structures we just covered use different mechanisms for tossing out info that might be stale or unused.
From a correctness point of view, there's no need to periodically purge Destination and Neighbor Cache entries. Stale info can technically hang around in the cache forever, but the Neighbor Unreachability Detection algorithm makes sure stale info gets purged quickly if it's actually being used 💅
To limit the storage needed for the Destination and Neighbor Caches, a node may need to garbage-collect old entries. But care must be taken to make sure there's always enough space to hold the working set of active entries. A small cache can cause an excessive number of Neighbor Discovery messages if entries keep getting discarded and rebuilt in quick succession 😭 Any Least Recently Used (LRU)-based policy that only reclaims entries that haven't been used in some time (e.g., ten minutes or more) should be adequate for garbage-collecting unused entries.
A node should retain entries in the Default Router List and the Prefix List until their lifetimes expire. However, a node may garbage-collect entries early if it's low on memory. If not all routers are kept on the Default Router List, a node should retain at least two entries in it (and preferably more) to keep connectivity for off-link destinations robust 🫶
When removing an entry from the Prefix List, there's no need to purge any entries from the Destination or Neighbor Caches. Neighbor Unreachability Detection will efficiently clean up any entries in those caches that have become invalid ✨ When removing an entry from the Default Router List, though, any Destination Cache entries that go through that router must perform next-hop determination again to select a new default router 💀
6. Router and Prefix Discovery ✨
okay so this section is all about how routers and hosts behave during Router Discovery 🧭. That's the part of Neighbor Discovery that helps hosts find neighboring routers and also learn prefixes and config params for stateless address autoconfiguration 💖
Prefix Discovery is how hosts figure out which ranges of IP addresses are on-link 🦋. Those are the ones they can reach directly without going through a router ✨. Routers send Router Advertisements to say whether they're willing to be a default router 👑. Those advertisements also carry Prefix Information options that list the prefixes identifying on-link IP addresses 🎀.
SLAAC needs subnet prefixes too 🌸. The prefixes used for autoconfig are logically different from the on-link ones, but autoconfig info gets piggybacked onto Router Discovery messages to cut down on network traffic 🫶. And honestly, the same prefixes can be advertised for both on-link determination and autoconfiguration, as long as you set the right flags in the Prefix Information options 💅. For the full story on how autoconfig info is processed, check [ADDRCONF] 📚.
6.1. Message Validation 🔍
6.1.1. Validation of Router Solicitation Messages
Hosts MUST silently discard any received Router Solicitation Messages 🙈.
A router MUST silently discard any received Router Solicitation messages that don't pass all of these validity checks:
- The
IP Hop Limitfield has a value of255, i.e., the packet could not possibly have been forwarded by a router. ICMP Checksumis valid.ICMP Codeis0.ICMP length(derived from the IP length) is8or more octets.- All included options have a length that is greater than zero.
- If the IP source address is the unspecified address, there is no
Source Link-Layer Addressoption in the message.
The contents of the Reserved field, and of any unrecognized options, MUST be ignored 🫧. Future, backward-compatible changes to the protocol may specify what the Reserved field holds or add new options. Backward-incompatible changes may use different Code values instead 🔮.
The contents of any defined options that aren't specified for use with Router Solicitation messages MUST be ignored, and the packet gets processed as normal 💫. The only defined option that may appear is the Source Link-Layer Address option 🎀.
A solicitation that passes the validity checks is called a "valid solicitation" ✅.
6.1.2. Validation of Router Advertisement Messages
A node MUST silently discard any received Router Advertisement messages that don't pass all of these validity checks 🙅♀️:
- IP Source Address is a link-local address. Routers must use their link-local address as the source for Router Advertisement and Redirect messages so that hosts can uniquely identify routers 🆔.
- The
IP Hop Limitfield has a value of255, i.e., the packet could not possibly have been forwarded by a router. ICMP Checksumis valid.ICMP Codeis0.ICMP length(derived from the IP length) is16or more octets.- All included options have a length that is greater than zero.
The contents of the Reserved field, and of any unrecognized options, MUST be ignored 🫧. Future, backward-compatible changes may specify the Reserved field contents or add new options, and backward-incompatible changes may use different Code values 🔮.
The contents of any defined options that aren't specified for use with Router Advertisement messages MUST be ignored, and the packet gets processed as normal 💫. The only defined options that may appear are the Source Link-Layer Address, Prefix Information and MTU options 🌈.
An advertisement that passes the validity checks is called a "valid advertisement" 💌.
6.2. Router Specification 🧭
6.2.1. Router Configuration Variables ✨
okay so first things first, bestie: a router MUST allow for the following conceptual variables to be configured by system management 🔧. The names are only there for demonstration, so an implementation doesn't have to literally have them, as long as what it does from the outside matches what this doc describes 💅. Defaults are listed to make config easy in the common cases 🌸.
The defaults for some of these can get overridden by specific docs that explain how IPv6 runs over different link layers 🦋. That keeps Neighbor Discovery setup simple on link types with wildly different performance, and it's so iconic 🙌
For each interface:
- IsRouter: a flag for whether routing is turned on for this interface. Turning it on means a router can forward packets to or from the interface 🛣️
- Default: FALSE
- AdvSendAdvertisements: a flag for whether the router sends periodic Router Advertisements and answers Router Solicitations 📣
- Default: FALSE
- Note that AdvSendAdvertisements MUST be FALSE by default. That way a node won't accidentally start acting as a router unless system management explicitly configures it to send Router Advertisements 🙈
- MaxRtrAdvInterval: the maximum time allowed between unsolicited multicast Router Advertisements sent from the interface, in seconds ⏰. It MUST be no less than 4 seconds and no greater than 1800 seconds.
- Default: 600 seconds
- MinRtrAdvInterval: the minimum time allowed between unsolicited multicast Router Advertisements sent from the interface, in seconds ⏱️. It MUST be no less than 3 seconds and no greater than
.75 * MaxRtrAdvInterval.- Default:
0.33 * MaxRtrAdvIntervalIfMaxRtrAdvInterval >= 9 seconds; otherwise, the Default isMaxRtrAdvInterval.
- Default:
- AdvManagedFlag: the TRUE/FALSE value that goes in the "Managed address configuration" flag field of the Router Advertisement. Check out [ADDRCONF] 📖
- Default: FALSE
- AdvOtherConfigFlag: the TRUE/FALSE value that goes in the "Other configuration" flag field of the Router Advertisement. See [ADDRCONF] 📖
- Default: FALSE
- AdvLinkMTU: the value that goes in MTU options the router sends 📦. A value of zero means no MTU options get sent.
- Default: 0
- AdvReachableTime: the value that goes in the Reachable Time field of the Router Advertisements the router sends ⌛. Zero means unspecified (by this router). It MUST be no greater than 3,600,000 milliseconds (1 hour).
- Default: 0
- AdvRetransTimer: the value that goes in the Retrans Timer field of the Router Advertisements the router sends 🔁. Zero means unspecified (by this router).
- Default: 0
- AdvCurHopLimit: the default value that goes in the Cur Hop Limit field of the Router Advertisements the router sends 🦘. The value should be set to the current diameter of the Internet. Zero means unspecified (by this router).
- Default: The value specified in the "Assigned Numbers" [ASSIGNED] that was in effect at the time of implementation.
- AdvDefaultLifetime: the value that goes in the Router Lifetime field of Router Advertisements sent from the interface, in seconds ⏳. It MUST be either zero or between MaxRtrAdvInterval and 9000 seconds. Zero means the router is not to be used as a default router. These limits may be overridden by specific docs that describe how IPv6 runs over different link layers. For example, on a point-to-point link the peers may already know enough about the number and status of devices at the other end, so advertisements are needed less often 🤝
- Default:
3 * MaxRtrAdvInterval
- Default:
- AdvPrefixList: a list of prefixes to be placed in Prefix Information options in Router Advertisements sent from the interface 🗂️
- Default: all prefixes that the router advertises via routing protocols as being on-link for the interface the advertisement is sent from. The link-local prefix SHOULD NOT be included in the list of advertised prefixes.
- Each prefix has an associated:
- AdvValidLifetime: the value that goes in the Valid Lifetime of the Prefix Information option, in seconds. The designated value of all 1's (
0xffffffff) represents infinity ♾️ Implementations MAY allow AdvValidLifetime to be specified in two ways:- a time that counts down in real time, so it hits a Lifetime of zero at the specified time in the future, or
- a fixed time that stays the same across consecutive advertisements.
- Default: 2592000 seconds (30 days), fixed (i.e., stays the same in consecutive advertisements).
- AdvOnLinkFlag: the value that goes in the on-link flag ("L-bit") field of the Prefix Information option 🔗
- Default: TRUE
- AdvValidLifetime: the value that goes in the Valid Lifetime of the Prefix Information option, in seconds. The designated value of all 1's (
- [ADDRCONF] defines some extra info that goes with each prefix too 👀
- AdvPreferredLifetime: the value that goes in the Preferred Lifetime of the Prefix Information option, in seconds. The designated value of all 1's (
0xffffffff) represents infinity. See [ADDRCONF] for details on how this value gets used. Implementations MAY allow AdvPreferredLifetime to be specified in two ways:- a time that counts down in real time, so it hits a Lifetime of zero at a specified time in the future, or
- a fixed time that stays the same across consecutive advertisements.
- Default: 604800 seconds (7 days), fixed (i.e., stays the same in consecutive advertisements). This value MUST NOT be larger than AdvValidLifetime.
- AdvAutonomousFlag: the value that goes in the Autonomous Flag field of the Prefix Information option. See [ADDRCONF] 📖
- Default: TRUE
- AdvPreferredLifetime: the value that goes in the Preferred Lifetime of the Prefix Information option, in seconds. The designated value of all 1's (
The variables above hold the info that goes into outgoing Router Advertisement messages. Hosts take the info they receive and use it to set up a matching set of variables that control their own external behavior (see Section 6.3.2) 🫶. Some of those host variables, like CurHopLimit, RetransTimer, and ReachableTime, apply to every node, routers included. In practice these variables might not actually exist on routers, since their contents can be worked out from the variables above 🧠. Even so, external router behavior MUST be the same as host behavior for these variables. That includes the occasional randomization of the ReachableTime value described in Section 6.3.2 🎲
Protocol constants are defined in Section 10 📚
6.2.2. Becoming an Advertising Interface 🦋
The term "advertising interface" refers to any functioning, enabled interface that has at least one unicast IP address assigned to it and whose AdvSendAdvertisements flag is TRUE 📣. A router MUST NOT send Router Advertisements out any interface that isn't an advertising interface 🚫
An interface can become an advertising interface at other times too, not just at system startup. For example:
- changing the AdvSendAdvertisements flag on an enabled interface from FALSE to TRUE, or
- administratively enabling the interface, if it had been administratively disabled, and its AdvSendAdvertisements flag is TRUE, or
- enabling IP forwarding capability (i.e., changing the system from being a host to being a router), when the interface's AdvSendAdvertisements flag is TRUE 🔀
A router MUST join the all-routers multicast address on an advertising interface 🌐 Routers answer Router Solicitations sent to the all-routers address, and they check that the Router Advertisements from neighboring routers are consistent 🔍 💖
6.2.3. Router Advertisement Message Content ✨
okay bestie so routers send periodic AND solicited Router Advertisements out of their advertising interfaces 📣💖 every outgoing one gets filled with these values, matching the message format in Section 4.2:
- In the
Router Lifetimefield: the interface's configuredAdvDefaultLifetime. - In the
MandOflags: the interface's configuredAdvManagedFlagandAdvOtherConfigFlag, respectively. - In the
Cur Hop Limitfield: the interface's configuredCurHopLimit. - In the
Reachable Timefield: the interface's configuredAdvReachableTime. - In the
Retrans Timerfield: the interface's configuredAdvRetransTimer. - In the options:
- Source Link-Layer Address option: link-layer address of the sending interface. This option MAY be omitted to facilitate in-bound load balancing over replicated interfaces. 🫶
- MTU option: the interface's configured
AdvLinkMTUvalue if the value is non-zero. IfAdvLinkMTUis zero, the MTU option is not sent. - Prefix Information options: one Prefix Information option for each prefix listed in
AdvPrefixList, with the option fields set from the information in theAdvPrefixListentry as follows:- In the "on-link" flag: the entry's
AdvOnLinkFlag. - In the
Valid Lifetimefield: the entry'sAdvValidLifetime. - In the "Autonomous address configuration" flag: the entry's
AdvAutonomousFlag. - In the
Preferred Lifetimefield: the entry'sAdvPreferredLifetime.
- In the "on-link" flag: the entry's
A router might want to send Router Advertisements without advertising itself as a default router 🙈 like, a router might advertise prefixes for stateless address autoconfiguration while not wanting to forward packets. Such a router sets the Router Lifetime field in outgoing advertisements to zero.
A router MAY choose not to include some or all options when sending unsolicited Router Advertisements. For example, if prefix lifetimes are much longer than AdvDefaultLifetime, including them every few advertisements may be sufficient. However, when responding to a Router Solicitation or while sending the first few initial unsolicited advertisements, a router SHOULD include all options so that all information (e.g., prefixes) is propagated quickly during system initialization. 🚀
If including all options causes the size of an advertisement to exceed the link MTU, multiple advertisements can be sent, each containing a subset of the options. 🧚
6.2.4. Sending Unsolicited Router Advertisements 📮
A host MUST NOT send Router Advertisement messages at any time. 🚫
Unsolicited Router Advertisements are not strictly periodic. The interval between transmissions gets randomized to reduce the probability of synchronization with the advertisements from other routers on the same link [SYNC]. Each advertising interface has its own timer. Whenever a multicast advertisement is sent from an interface, the timer is reset to a uniformly distributed random value between the interface's configured MinRtrAdvInterval and MaxRtrAdvInterval. Expiration of the timer causes the next advertisement to be sent and a new random value to be chosen. ⏰
For the first few advertisements (up to MAX_INITIAL_RTR_ADVERTISEMENTS) sent from an interface when it becomes an advertising interface, if the randomly chosen interval is greater than MAX_INITIAL_RTR_ADVERT_INTERVAL, the timer SHOULD be set to MAX_INITIAL_RTR_ADVERT_INTERVAL instead. Using a smaller interval for the initial advertisements increases the likelihood of a router being discovered quickly when it first becomes available, in the presence of possible packet loss. 🦋
The information in Router Advertisements may change through actions of system management. For instance, the lifetime of advertised prefixes may change, new prefixes could be added, or a router could cease to be a router (i.e., switch from being a router to being a host), etc. In such cases, the router MAY transmit up to MAX_INITIAL_RTR_ADVERTISEMENTS unsolicited advertisements, using the same rules as when an interface becomes an advertising interface. 💅
6.2.5. Ceasing To Be an Advertising Interface 🌸
An interface may cease to be an advertising interface through actions of system management, such as:
- changing the
AdvSendAdvertisementsflag of an enabled interface fromTRUEtoFALSE, or - administratively disabling the interface, or
- shutting down the system.
In such cases, the router SHOULD transmit one or more (but not more than MAX_FINAL_RTR_ADVERTISEMENTS) final multicast Router Advertisements on the interface with a Router Lifetime field of zero. In the case of a router becoming a host, the system SHOULD also depart from the all-routers IP multicast group on all interfaces on which the router supports IP multicast (whether or not they had been advertising interfaces). In addition, the host MUST ensure that subsequent Neighbor Advertisement messages sent from the interface have the Router flag set to zero. 👑
Note that system management may disable a router's IP forwarding capability (i.e., change the system from being a router to being a host). That step does not necessarily imply that the router's interfaces stop being advertising interfaces. In such cases, subsequent Router Advertisements MUST set the Router Lifetime field to zero. 😭
6.2.6. Processing Router Solicitations 🎀
A host MUST silently discard any received Router Solicitation messages. 🙅♀️
In addition to sending periodic, unsolicited advertisements, a router sends advertisements in response to valid solicitations received on an advertising interface. A router MAY choose to unicast the response directly to the soliciting host's address (if the solicitation's source address is not the unspecified address), but the usual case is to multicast the response to the all-nodes group. In the latter case, the interface's interval timer is reset to a new random value, as if an unsolicited advertisement had just been sent (see Section 6.2.4). 🔁
In all cases, Router Advertisements sent in response to a Router Solicitation MUST be delayed by a random time between 0 and MAX_RA_DELAY_TIME seconds. (If a single advertisement is sent in response to multiple solicitations, the delay is relative to the first solicitation.) In addition, consecutive Router Advertisements sent to the all-nodes multicast address MUST be rate limited to no more than one advertisement every MIN_DELAY_BETWEEN_RAS seconds. 🚦
A router might process Router Solicitations as follows:
- Upon receipt of a Router Solicitation, compute a random delay within the range 0 through
MAX_RA_DELAY_TIME. If the computed value corresponds to a time later than the time the next multicast Router Advertisement is scheduled to be sent, ignore the random delay and send the advertisement at the already-scheduled time. - If the router sent a multicast Router Advertisement (solicited or unsolicited) within the last
MIN_DELAY_BETWEEN_RASseconds, schedule the advertisement to be sent at a time corresponding toMIN_DELAY_BETWEEN_RASplus the random value after the previous advertisement was sent. This ensures that the multicast Router Advertisements are rate limited. - Otherwise, schedule the sending of a Router Advertisement at the time given by the random value.
Note that a router is permitted to send multicast Router Advertisements more frequently than indicated by the MinRtrAdvInterval configuration variable, so long as the more frequent advertisements are responses to Router Solicitations. In all cases, however, unsolicited multicast advertisements MUST NOT be sent more frequently than indicated by MinRtrAdvInterval. ⚡
Router Solicitations in which the Source Address is the unspecified address MUST NOT update the router's Neighbor Cache. Solicitations with a proper source address update the Neighbor Cache as follows. If the router already has a Neighbor Cache entry for the solicitation's sender, the solicitation contains a Source Link-Layer Address option, and the received link-layer address differs from the one already in the cache, then the link-layer address SHOULD be updated in the appropriate Neighbor Cache entry, and its reachability state MUST also be set to STALE. If there is no existing Neighbor Cache entry for the solicitation's sender, the router creates one, installs the link-layer address, and sets its reachability state to STALE as specified in Section 7.3.3. If there is no existing Neighbor Cache entry and no Source Link-Layer Address option was present in the solicitation, the router may respond with either a multicast or a unicast router advertisement. Whether or not a Source Link-Layer Address option is provided, if a Neighbor Cache entry for the solicitation's sender exists (or is created), the entry's IsRouter flag MUST be set to FALSE. 🧠
6.2.7. Router Advertisement Consistency 🔍
Routers SHOULD inspect valid Router Advertisements sent by other routers and verify that the routers are advertising consistent information on a link. Detected inconsistencies indicate that one or more routers might be misconfigured, and they SHOULD be logged to system or network management. The minimum set of information to check includes:
Cur Hop Limitvalues (except for the unspecified value of zero other inconsistencies SHOULD be logged to system network management).- Values of the
MorOflags. Reachable Timevalues (except for the unspecified value of zero).Retrans Timervalues (except for the unspecified value of zero).- Values in the MTU options.
- Preferred and Valid Lifetimes for the same prefix. If
AdvPreferredLifetimeand/orAdvValidLifetimedecrement in real time as specified in Section 6.2.1, then the comparison of the lifetimes cannot compare the content of the fields in the Router Advertisement, but must instead compare the time at which the prefix will become deprecated and invalidated, respectively. Due to link propagation delays and potentially poorly synchronized clocks between the routers, such comparison SHOULD allow some time skew. ⏳
Note that it is not an error for different routers to advertise different sets of prefixes. Also, some routers might leave some fields as unspecified (i.e., with the value zero) while other routers specify values. The logging of errors SHOULD be restricted to conflicting information that causes hosts to switch from one value to another with each received advertisement. 💫
Any other action on reception of Router Advertisement messages by a router is beyond the scope of this document. 🌈
6.2.8. Link-local Address Change ✨
okay so the link-local address on a router should rarely change, if ever 🙈 Nodes that get Neighbor Discovery messages use the source address to figure out who sent them. If packets from the same router show up with different source addresses, nodes think they're coming from different routers, and that gets messy fr 💀 For example, a node will ignore Redirect messages that it believes came from some router other than its current first-hop router. So the source address used in Router Advertisements from a particular router must be identical to the target address in a Redirect message when redirecting to that router. no exceptions bestie 💅
Using the link-local address to uniquely identify routers on the link is lowkey iconic, because the address a router is known by should not change when a site renumbers 🦋
If a router changes the link-local address on one of its interfaces, it SHOULD inform hosts about it 📣 The router SHOULD multicast a few Router Advertisements from the old link-local address with the Router Lifetime field set to zero, and also multicast a few Router Advertisements from the new link-local address. The overall vibe should match what happens when one interface stops being an advertising interface and a different one starts being one 🎀
6.3. Host Specification 🌸
6.3.1. Host Configuration Variables
None. Hosts have nothing to configure here, so no drama 🧚
6.3.2. Host Variables
okay so a host keeps some Neighbor-Discovery-related variables on top of the data structures from Section 5.1 🧠 The variable names are just for demonstration, so an implementation doesn't need to have them, as long as its external behavior matches what this document describes 🫶
These variables have default values, and Router Advertisement messages can override them. The defaults get used when there's no router on the link, or when every Router Advertisement received left a particular value unspecified 💜
The default values in this specification can be overridden by specific documents that explain how IP works over different link layers. That's what lets Neighbor Discovery run over links with wildly different performance characteristics ✨
For each interface:
LinkMTU: the MTU of the link.- Default: the value defined in the specific document that describes how IPv6 operates over the particular link layer (e.g., [IPv6-ETHER]).
CurHopLimit: the default hop limit to be used when sending IP packets.- Default: the value specified in the "Assigned Numbers" [ASSIGNED] that was in effect at the time of implementation.
BaseReachableTime: a base value used for computing the randomReachableTimevalue.- Default:
REACHABLE_TIMEmilliseconds.
- Default:
ReachableTime: the time a neighbor is considered reachable after receiving a reachability confirmation.- This value should be a uniformly distributed random value between
MIN_RANDOM_FACTORandMAX_RANDOM_FACTORtimesBaseReachableTimemilliseconds. A new random value should be calculated whenBaseReachableTimechanges (due to Router Advertisements) or at least every few hours even if no Router Advertisements are received.
- This value should be a uniformly distributed random value between
RetransTimer: the time between retransmissions of Neighbor Solicitation messages to a neighbor when resolving the address or when probing the reachability of a neighbor.- Default:
RETRANS_TIMERmilliseconds.
- Default:
6.3.3. Interface Initialization
The host joins the all-nodes multicast address on all multicast-capable interfaces 🌈 Done and dusted, periodt 💅
6.3.4. Processing Received Router Advertisements ✨
okay so when there are multiple routers on the link 🛣️, all of them together can advertise a superset of what a single Router Advertisement holds 🫶. Info can also come in through other dynamic means, like DHCPv6 🧚. So hosts accept the union of everything they've received 💅. Getting a new RA MUST NOT wipe out what you got from an earlier one or from some other source. No deleting the group chat history, bestie 😭.
Now, if a specific parameter (like Link MTU) or option (like the Lifetime on a certain Prefix) shows up with a different value than before, and that thing can only have one value, then the most recently received info is the authoritative one 👑.
A Router Advertisement field (like Cur Hop Limit, Reachable Time, and Retrans Timer) can contain a value that means "unspecified" 🙈. In that case, the parameter should be ignored and the host keeps using whatever value it's already using. And here's the iconic part: a host MUST NOT read the unspecified value as "go back to the default value we had before the first RA arrived" 🚫. This stops hosts from constantly flip-flopping an internal variable just because one router says a specific value while others say "unspecified" 💖.
On receipt of a valid Router Advertisement, a host grabs the source address of the packet and does the following:
- If the address is not already in the host's
Default Router List, and the advertisement'sRouter Lifetimeis non-zero, create a new entry in the list and set its invalidation timer from the advertisement'sRouter Lifetimefield 🌸. - If the address is already in the
Default Router Listbecause of a previously received advertisement, reset its invalidation timer to theRouter Lifetimevalue in the newly received advertisement ⏰. - If the address is already in the
Default Router Listand the receivedRouter Lifetimevalue is zero, immediately time-out the entry as specified in Section 6.3.5 💀.
To keep the storage for the Default Router List in check, a host MAY choose not to store every router address it discovers through advertisements 🍓. But a host MUST retain at least two router addresses, and SHOULD retain more ✨. Default router selections happen whenever communication to a destination appears to be failing 😬. So the more routers on the list, the more likely a working alternative can be found quickly, like without waiting for the next advertisement to show up 🦋.
If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to that received value 🎀.
If the received Reachable Time value is non-zero, the host SHOULD set its BaseReachableTime variable to the received value 🌈. If the new value differs from the previous one, the host SHOULD re-compute a new random ReachableTime value 🔄. ReachableTime is a uniformly distributed random value between MIN_RANDOM_FACTOR and MAX_RANDOM_FACTOR times the BaseReachableTime. That random part is what stops Neighbor Unreachability Detection messages from syncing up with each other, which is so clever 🧠✨.
In most cases, the advertised Reachable Time stays the same across consecutive Router Advertisements, and a host's BaseReachableTime rarely changes 🫠. So in those cases, an implementation SHOULD make sure a new random value gets re-computed at least once every few hours ⏳.
The RetransTimer variable SHOULD be copied from the Retrans Timer field, as long as the received value is non-zero 🍭.
After pulling info out of the fixed part of the Router Advertisement message, the advertisement gets scanned for valid options 🔍. If it has a Source Link-Layer Address option, the link-layer address SHOULD be recorded in the Neighbor Cache entry for the router (creating the entry if needed), and the IsRouter flag in that entry MUST be set to TRUE 💜. If there's no Source Link-Layer Address but a matching Neighbor Cache entry already exists, its IsRouter flag MUST be set to TRUE too 💅. The IsRouter flag is what Neighbor Unreachability Detection uses to tell when a router turns into a host (aka no longer able to forward packets) 👀. If a Neighbor Cache entry gets created for the router, its reachability state MUST be set to STALE as specified in Section 7.3.3 🥀. And if an existing cache entry gets updated with a different link-layer address, the reachability state MUST also be set to STALE 🙃.
If the MTU option is present, hosts SHOULD copy its value into LinkMTU, as long as the value is greater than or equal to the minimum link MTU [IPv6] and doesn't exceed the maximum LinkMTU value specified in the link-type-specific document (e.g., [IPv6-ETHER]) 📏.
Prefix Information options with the on-link (L) flag set are indicating a prefix that identifies a range of addresses which should be considered on-link 🔗. But heads up, bestie: a Prefix Information option with the on-link flag set to zero conveys no info about on-link determination, and it MUST NOT be interpreted to mean the addresses under that prefix are off-link 🚫🙅♀️. The only way to cancel an earlier on-link indication is to advertise that prefix with the L-bit set and the Lifetime set to zero 🧹. The default behavior (see Section 5.2) when sending a packet to an address with no known on-link status is to forward it to a default router, and receiving a Prefix Information option with the on-link flag set to zero does not change that 🚀. The reasons an address is treated as on-link are spelled out in the definition of "on-link" in Section 2.1 📖. Prefixes with the on-link flag set to zero would normally have the autonomous flag set and be used by [ADDRCONF] 🧩.
For each Prefix Information option with the on-link flag set, a host does the following:
- If the prefix is the link-local prefix, silently ignore the Prefix Information option 🙈.
- If the prefix is not already in the
Prefix List, and the Prefix Information option'sValid Lifetimefield is non-zero, create a new entry for the prefix and set its invalidation timer to theValid Lifetimevalue in the option 🌷. - If the prefix is already in the host's
Prefix Listbecause of a previously received advertisement, reset its invalidation timer to theValid Lifetimevalue in the Prefix Information option. If the new Lifetime value is zero, time-out the prefix immediately (see Section 6.3.5) ⏳💀. - If the Prefix Information option's
Valid Lifetimefield is zero, and the prefix is not in the host'sPrefix List, silently ignore the option 🫧.
Stateless address autoconfiguration [ADDRCONF] may, in some circumstances, use a larger Valid Lifetime for a prefix or ignore it completely, in order to prevent a particular denial-of-service attack 🛡️. But the same denial of service aimed at the on-link prefix list isn't catastrophic. Hosts would just send packets to a default router and get a redirect instead of sending directly to a neighbor 😌. So the Neighbor Discovery protocol doesn't impose that check on prefix lifetime values 🙌. Similarly, [ADDRCONF] may impose restrictions on the prefix length for address configuration purposes, so the prefix might be rejected by an [ADDRCONF] implementation in the host 🙅♀️. Even so, the prefix length is still valid for on-link determination when combined with other flags in the prefix option 🔍.
Note: Implementations can choose to process the on-link aspects of the prefixes separately from the stateless address autoconfiguration aspects of the prefixes by, e.g., passing a copy of each valid Router Advertisement message to both an "on-link" and an "addrconf" function. Each function can then operate independently on the prefixes that have the appropriate flag set. 🧚✨
---
6.3.5. Timing out Prefixes and Default Routers ⏰
Whenever the invalidation timer expires for a Prefix List entry, that entry gets discarded 🗑️. No existing Destination Cache entries need to be updated, though 🤷♀️. If a reachability problem shows up with an existing Neighbor Cache entry, Neighbor Unreachability Detection will handle any recovery that's needed 🦸♀️.
Whenever the Lifetime of an entry in the Default Router List expires, that entry is discarded 👋. And when removing a router from the Default Router List, the node MUST update the Destination Cache so that all entries using that router perform next-hop determination again, rather than keep sending traffic to the (deleted) router 🚫📡. No ghosting allowed, periodt 💅.
6.3.6. Default Router Selection 👑
The algorithm for picking a router depends partly on whether a router is known to be reachable 🎯. The exact details of how a node tracks a neighbor's reachability state are covered in Section 7.3 🧐. The default router selection algorithm gets invoked during next-hop determination when there's no Destination Cache entry for an off-link destination, or when communication through an existing router appears to be failing 🚨. Under normal conditions, a router would be selected the first time traffic goes to a destination, and later traffic for that destination uses the same router as shown in the Destination Cache, modulo any changes made by Redirect messages 🔁.
The policy for selecting routers from the Default Router List goes like this:
- Routers that are reachable or probably reachable (i.e., in any state other than
INCOMPLETE) SHOULD be preferred over routers whose reachability is unknown or suspect (i.e., in theINCOMPLETEstate, or for which no Neighbor Cache entry exists). Further implementation hints on default router selection when multiple equivalent routers are available are discussed in [LD-SHRE] 💖. - When no routers on the list are known to be reachable or probably reachable, routers SHOULD be selected in a round-robin fashion, so that subsequent requests for a default router do not return the same router until all other routers have been selected 🔄🌈.
Cycling through the router list in this case makes sure all the available routers are actively probed by the Neighbor Unreachability Detection algorithm 🔍. A request for a default router is made together with sending a packet to a router, and the selected router gets probed for reachability as a side effect 🧪✨.
6.3.7. Sending Router Solicitations ✨
Okay so bestie, when an interface wakes up, a host might not wanna sit around waiting for the next unsolicited Router Advertisement just to find its default routers or learn prefixes 🥺. So to get Router Advertisements fast, a host SHOULD transmit up to MAX_RTR_SOLICITATIONS Router Solicitation messages, each one separated by at least RTR_SOLICITATION_INTERVAL seconds 🚀. Router Solicitations may be sent after any of these events:
- The interface is initialized at system startup time.
- The interface is reinitialized after a temporary interface failure or after being temporarily disabled by system management.
- The system changes from being a router to being a host, by having its IP forwarding capability turned off by system management.
- The host attaches to a link for the first time.
- The host re-attaches to a link after being detached for some time.
A host sends Router Solicitations to the all-routers multicast address 📣. The IP source address gets set to either one of the interface's unicast addresses or the unspecified address. The Source Link-Layer Address option SHOULD be set to the host's link-layer address, but only if the IP source address is not the unspecified address 🫶.
Before a host sends its initial solicitation, it SHOULD delay the transmission for a random amount of time between 0 and MAX_RTR_SOLICITATION_DELAY 🎲. This is giving congestion prevention 🙌, because when a bunch of hosts start up on a link at the same time (like after recovering from a power failure), everyone would otherwise slam the link at once 💀. If a host has already done a random delay since the interface became (re)enabled (for example, as part of Duplicate Address Detection [ADDRCONF]), there's no need to delay again before sending the first Router Solicitation message ✨.
In some cases, the random delay MAY be omitted if necessary 🦋. For instance, a mobile node using [MIPv6] that is moving to a new link needs to notice that movement as soon as possible, so it doesn't lose a bunch of packets because of the topology change 🏃♀️. Router Solicitations are a useful tool for movement detection in Mobile IPv6, since they let mobile nodes figure out that they've moved to a new link 🗺️. So if a mobile node gets link-layer information indicating that movement might have happened, it MAY send a Router Solicitation immediately, without random delays. How strong those indications are should be assessed by the mobile node's implementation, based on how certain the link-layer hints are, and that's outside the scope of this specification 🤷♀️. Heads up though: using this mechanism inappropriately (say, based on weak or transient indications) may cause Router Solicitation storms 🌪️😭. And if a large number of mobile nodes that use this mechanism all move at once, a huge pile of solicitations could get sent at the same time 💀.
Once the host sends a Router Solicitation and receives a valid Router Advertisement with a non-zero Router Lifetime, the host MUST stop sending more solicitations on that interface until the next time one of the events above happens 🛑. Also, a host SHOULD send at least one solicitation in the case where an advertisement arrives before it has sent a solicitation 💜. Responses to solicited advertisements may contain more information than unsolicited advertisements 🎁.
If a host sends MAX_RTR_SOLICITATIONS solicitations and gets no Router Advertisements after waiting MAX_RTR_SOLICITATION_DELAY seconds after the last solicitation, it concludes there are no routers on the link for the purpose of [ADDRCONF] 🙅♀️. But it keeps receiving and processing Router Advertisement messages in case routers show up on the link later 👀.
7. Address Resolution and Neighbor Unreachability Detection 💜
This section covers the stuff related to Neighbor Solicitation and Neighbor Advertisement messages. It includes descriptions of address resolution and the Neighbor Unreachability Detection algorithm 🧠.
Neighbor Solicitation and Advertisement messages are also used for Duplicate Address Detection as specified by [ADDRCONF] 🔍. Specifically, Duplicate Address Detection sends Neighbor Solicitation messages with an unspecified source address, targeting its own "tentative" address. Any nodes already using that address respond with a multicast Neighbor Advertisement saying the address is in use. Iconic behaviour, honestly 🫣.
7.1. Message Validation 🎀
7.1.1. Validation of Neighbor Solicitations
A node MUST silently discard any received Neighbor Solicitation messages that do not satisfy all of the following validity checks 🚫:
- The
IP Hop Limitfield has a value of255, i.e., the packet could not possibly have been forwarded by a router. ICMP Checksumis valid.ICMP Codeis0.ICMP length(derived from the IP length) is24or more octets.Target Addressis not a multicast address.- All included options have a length that is greater than zero.
- If the IP source address is the unspecified address, the IP destination address is a solicited-node multicast address.
- If the IP source address is the unspecified address, there is no source link-layer address option in the message.
The contents of the Reserved field, and of any unrecognized options, MUST be ignored 🙈. Future, backward-compatible changes to the protocol may specify the contents of the Reserved field or add new options. Backward-incompatible changes may use different Code values 🔮.
The contents of any defined options that are not specified to be used with Neighbor Solicitation messages MUST be ignored, and the packet gets processed as normal 🫠. The only defined option that may appear is the Source Link-Layer Address option.
A Neighbor Solicitation that passes the validity checks is called a "valid solicitation" ✅.
7.1.2. Validation of Neighbor Advertisements
A node MUST silently discard any received Neighbor Advertisement messages that do not satisfy all of the following validity checks 🚫:
- The
IP Hop Limitfield has a value of255, i.e., the packet could not possibly have been forwarded by a router. ICMP Checksumis valid.ICMP Codeis0.ICMP length(derived from the IP length) is24or more octets.Target Addressis not a multicast address.- If the IP Destination Address is a multicast address, the
Solicitedflag is zero. - All included options have a length that is greater than zero.
The contents of the Reserved field, and of any unrecognized options, MUST be ignored 🙈. Future, backward-compatible changes to the protocol may specify the contents of the Reserved field or add new options. Backward-incompatible changes may use different Code values 🔮.
The contents of any defined options that are not specified to be used with Neighbor Advertisement messages MUST be ignored, and the packet gets processed as normal 🫠. The only defined option that may appear is the Target Link-Layer Address option.
A Neighbor Advertisement that passes the validity checks is called a "valid advertisement" ✅.
7.2. Address Resolution 🌸
Address resolution is the process where a node figures out the link-layer address of a neighbor, given only its IP address 🔎. It's only performed on addresses that are determined to be on-link, and where the sender doesn't already know the corresponding link-layer address (see Section 5.2). Address resolution is never performed on multicast addresses 🙅♀️.
A host might receive a solicitation, a router advertisement, or a Redirect message without a link-layer address option included. These messages MUST NOT create or update neighbor cache entries, except with respect to the IsRouter flag as specified in Sections 6.3.4 and 7.2.5 ⚠️. If a Neighbor Cache entry doesn't exist for the source of such a message, Address Resolution will be required before unicast communications with that address can begin. This is especially relevant for unicast responses to solicitations, since an extra packet exchange is needed for the advertisement to get delivered 📬.
7.2.1. Interface Initialization
When a multicast-capable interface becomes enabled, the node MUST join the all-nodes multicast address on that interface, as well as the solicited-node multicast address for each of the IP addresses assigned to the interface 🎉.
The set of addresses assigned to an interface can change over time. New addresses might get added and old ones might get removed [ADDRCONF] 🔄. In those cases, the node MUST join and leave the solicited-node multicast addresses for the new and old addresses, respectively. Joining the solicited-node multicast address is done using a Multicast Listener Discovery protocol such as [MLD] or [MLDv2] 🛰️. Also, multiple unicast addresses can map into the same solicited-node multicast address, so a node MUST NOT leave the solicited-node multicast group until all assigned addresses that correspond to that multicast address have been removed 🫶💅.
7.2.2. Sending Neighbor Solicitations 💅
okay so when a node has a unicast packet for a neighbor but doesn't know their link-layer address yet, it does address resolution 🦋 on multicast-capable interfaces, that means making a Neighbor Cache entry in the INCOMPLETE state and sending a Neighbor Solicitation aimed at the neighbor. The solicitation goes to the solicited-node multicast address that matches the target address ✨
If the source address of the packet that kicked this off is the same as one of the addresses on the outgoing interface, that address SHOULD go in the IP Source Address of the outgoing solicitation. Otherwise, any one of the addresses assigned to the interface should be used 🌸 Using the prompting packet's source address when possible is iconic, because it makes sure the recipient saves the IP address that's most likely to show up in the return traffic for that same "connection" 🫶
If the solicitation is going to a solicited-node multicast address, the sender MUST include its link-layer address (if it has one) as a Source Link-Layer Address option. Otherwise, the sender SHOULD include its link-layer address (if it has one) as a Source Link-Layer Address option. Including it in a multicast solicitation is required, because that's how the target gets an address to send its Neighbor Advertisement back to 💖 On unicast solicitations, an implementation MAY omit the Source Link-Layer Address option. The reasoning is that if the sender already has the peer's link-layer address cached, the peer will probably have the sender cached too, so there's no need to send it 🧚
While address resolution is in progress, the sender MUST, for each neighbor, keep a small queue of packets waiting for resolution to finish 🎀 The queue MUST hold at least one packet, and MAY hold more. The number of queued packets per neighbor SHOULD be capped at some small value 🍓 When a queue overflows, the new arrival SHOULD replace the oldest entry. Once resolution completes, the node sends whatever's in the queue 👑
While it's waiting for a response, the sender SHOULD retransmit Neighbor Solicitation messages approximately every RetransTimer milliseconds, even if there's no other traffic to that neighbor 🔥 Retransmissions MUST be rate-limited to at most one solicitation per neighbor every RetransTimer milliseconds. Don't spam, bestie 🙈
If no Neighbor Advertisement shows up after MAX_MULTICAST_SOLICIT solicitations, address resolution has failed 💀 In that case the sender MUST return ICMP destination unreachable indications with code 3 (Address Unreachable) for each packet queued while waiting for resolution. Rip to those packets 😭
7.2.3. Receipt of Neighbor Solicitations 🌈
A valid Neighbor Solicitation that doesn't meet any of the following requirements MUST be silently discarded:
- The Target Address is a "valid" unicast or anycast address assigned to the receiving interface [ADDRCONF],
- The Target Address is a unicast or anycast address for which the node is offering proxy service, or
- The Target Address is a "tentative" address on which Duplicate Address Detection is being performed [ADDRCONF].
If the Target Address is tentative, the Neighbor Solicitation should be processed as described in [ADDRCONF] 🧐 Otherwise, here's the tea. If the Source Address is not the unspecified address and, on link layers that have addresses, the solicitation includes a Source Link-Layer Address option, then the recipient SHOULD create or update the Neighbor Cache entry for the IP Source Address of the solicitation ✨ If no entry exists yet, the node SHOULD create a new one and set its reachability state to STALE as specified in Section 7.3.3. If an entry already exists and the cached link-layer address is different from the one in the received Source Link-Layer Address option, the cached address should be replaced by the received address, and the entry's reachability state MUST be set to STALE 🦋
If a Neighbor Cache entry is created, the IsRouter flag SHOULD be set to FALSE 🎀 This is the case even when the Neighbor Solicitation comes from a router, because Neighbor Solicitation messages don't say whether the sender is a router. If the sender really is a router, later Neighbor Advertisement or Router Advertisement messages will set the correct IsRouter value 👑 If a Neighbor Cache entry already exists, its IsRouter flag MUST NOT be modified. Hands off, it's not your flag to change 🙅♀️
If the Source Address is the unspecified address, the node MUST NOT create or update the Neighbor Cache entry 💅
After any updates to the Neighbor Cache, the node sends a Neighbor Advertisement response, which we get into in the next section 🫶
7.2.4. Sending Solicited Neighbor Advertisements 🧚
A node sends a Neighbor Advertisement in response to a valid Neighbor Solicitation that targets one of the node's assigned addresses ✨ The Target Address of the advertisement is copied from the Target Address of the solicitation. If the solicitation's IP Destination Address is not a multicast address, the Target Link-Layer Address option MAY be left out, since the neighbor's cached value must already be current for the solicitation to have arrived at all 🌸 If the solicitation's IP Destination Address is a multicast address, the Target Link-Layer option MUST be included in the advertisement. Also, if the node is a router, it MUST set the Router flag to one. Otherwise, it MUST set the flag to zero 👑
If the Target Address is an anycast address, or a unicast address the node is proxying for, or the Target Link-Layer Address option isn't included, the Override flag SHOULD be set to zero. Otherwise, the Override flag SHOULD be set to one 🔥 This setup makes sure nodes prefer non-proxy advertisements, even when those arrive after proxy ones, and also makes sure the first advertisement for an anycast address "wins" 🏆
If the solicitation's source is the unspecified address, the node MUST set the Solicited flag to zero and multicast the advertisement to the all-nodes address 📣 Otherwise, the node MUST set the Solicited flag to one and unicast the advertisement to the Source Address of the solicitation 💖
If the Target Address is an anycast address, the sender SHOULD delay sending its response for a random time between 0 and MAX_ANYCAST_DELAY_TIME seconds 🎀
Last bit, and it's a big one 🥺 Unicast Neighbor Solicitations aren't required to include a Source Link-Layer Address, so a node sending a solicited Neighbor Advertisement might not have the link-layer address for that neighbor in its Neighbor Cache. When that happens, the node first has to use Neighbor Discovery to find the neighbor's link-layer address, which means sending out a multicast Neighbor Solicitation 🌈 Main character energy, no cap 💅✨
7.2.5. Receipt of Neighbor Advertisements ✨
Okay so when a valid Neighbor Advertisement shows up (solicited or unsolicited, it doesn't matter 💅), you go digging through the Neighbor Cache for the target's entry. No entry? The advertisement SHOULD be silently discarded 🙈. You don't need to make one, because the recipient clearly never started any convo with that target.
Once you've found the right Neighbor Cache entry, what you do next depends on three things: the state of that entry, the flags in the advertisement, and the actual link-layer address that was supplied. It's giving detective energy 🕵️♀️
If the target's Neighbor Cache entry is in the INCOMPLETE state when the advertisement arrives, one of two things happens. If the link layer has addresses but no Target Link-Layer Address option is included, the receiving node SHOULD silently discard the received advertisement. Otherwise, the receiving node does the following steps:
- It records the link-layer address in the Neighbor Cache entry.
- If the advertisement's Solicited flag is set, the state of the entry is set to
REACHABLE. Otherwise, it is set toSTALE. - It sets the IsRouter flag in the cache entry based on the Router flag in the received advertisement.
- It sends any packets queued for the neighbor that were waiting on address resolution. 🚀
Note that the Override flag is ignored if the entry is in the INCOMPLETE state. Mind the vibes 🤫
If the target's Neighbor Cache entry is in any state other than INCOMPLETE when the advertisement arrives, the following actions take place:
I. If the Override flag is clear and the supplied link-layer address differs from the one in the cache, then one of two actions takes place: a. If the state of the entry is REACHABLE, set it to STALE, but do not update the entry in any other way. b. Otherwise, the received advertisement should be ignored and MUST NOT update the cache. Not me being a gatekeeper, but that's the rule 💅
II. If the Override flag is set, or the supplied link-layer address is the same as the one in the cache, or no Target Link-Layer Address option was supplied, the received advertisement MUST update the Neighbor Cache entry as follows:
- The link-layer address in the Target Link-Layer Address option MUST be inserted in the cache (if one is supplied and differs from the already recorded address).
- If the Solicited flag is set, the state of the entry MUST be set to
REACHABLE. If the Solicited flag is zero and the link-layer address was updated with a different address, the state MUST be set toSTALE. Otherwise, the entry's state remains unchanged. 🌸
An advertisement's Solicited flag should only be set if the advertisement is a response to a Neighbor Solicitation. Because Neighbor Unreachability Detection Solicitations are sent to the cached link-layer address, receiving a solicited advertisement means the forward path is working, so it's giving "we're good bestie" 🫶. Receiving an unsolicited advertisement, though, may mean a neighbor has urgent news to share (like a changed link-layer address 👀). If that urgent news is a change from what a node is currently using, the node should verify the reachability of the (new) path when it sends the next packet. There's no need to update the state for unsolicited advertisements that don't change the contents of the cache.
- The IsRouter flag in the cache entry MUST be set based on the Router flag in the received advertisement. In the cases where the IsRouter flag changes from TRUE to FALSE as a result of this update, the node MUST remove that router from the Default Router List and update the Destination Cache entries for all destinations using that neighbor as a router, as specified in Section 7.3.3. This is needed to detect when a node that is used as a router stops forwarding packets because it has been configured as a host. Plot twist, but it's a super important one 😭
The above rules make sure the cache gets updated either when the Neighbor Advertisement takes precedence (the Override flag is set) or when it refers to the same link-layer address already recorded in the cache. If none of the above apply, the advertisement prompts future Neighbor Unreachability Detection (if it isn't already in progress) by changing the state in the cache entry. Main character energy, the state change does the work 🦋
7.2.6. Sending Unsolicited Neighbor Advertisements 📣
Sometimes a node can tell that its link-layer address has changed (like when someone hot-swaps an interface card 🔧), and it might want to let its neighbors know the new address ASAP. In that case, a node MAY send up to MAX_NEIGHBOR_ADVERTISEMENT unsolicited Neighbor Advertisement messages to the all-nodes multicast address. These advertisements MUST be separated by at least RetransTimer seconds. Spacing it out is iconic 🎀
The Target Address field in the unsolicited advertisement is set to an IP address of the interface, and the Target Link-Layer Address option is filled with the new link-layer address. The Solicited flag MUST be set to zero, so the Neighbor Unreachability Detection algorithm doesn't get confused 🙃. If the node is a router, it MUST set the Router flag to one. Otherwise, it MUST set it to zero. The Override flag MAY be set to either zero or one. Either way, neighboring nodes will immediately change the state of their Neighbor Cache entries for the Target Address to STALE, which prompts them to verify the path for reachability. If the Override flag is set to one, neighboring nodes will install the new link-layer address in their caches. Otherwise, they'll ignore the new link-layer address and probe the cached address instead. It's a whole plot 📖
A node that has multiple IP addresses assigned to an interface MAY multicast a separate Neighbor Advertisement for each address. In that case, the node SHOULD introduce a small delay between sending each advertisement, to reduce the chance of the advertisements getting lost to congestion 🚦.
A proxy MAY multicast Neighbor Advertisements when its link-layer address changes, or when it is configured (by system management or other mechanisms) to proxy for an address. If there are multiple nodes providing proxy services for the same set of addresses, the proxies should provide a mechanism that prevents multiple proxies from multicasting advertisements for any one address, to cut down on the risk of excessive multicast traffic. This is a requirement on other protocols that need to use proxies for Neighbor Advertisements. An example of a node that does proxy advertisements is the Home Agent specified in [MIPv6]. 🏠
Also, a node belonging to an anycast address MAY multicast unsolicited Neighbor Advertisements for the anycast address when the node's link-layer address changes. 🌐
Note that because unsolicited Neighbor Advertisements don't reliably update caches in every node (some nodes might not receive them), they should only be viewed as a performance optimization that quickly updates the caches in most neighbors. The Neighbor Unreachability Detection algorithm ensures that all nodes end up with a reachable link-layer address, though the delay may be slightly longer. Slow and steady wins the race 🐢
7.2.7. Anycast Neighbor Advertisements 🧲
From the perspective of Neighbor Discovery, anycast addresses are treated just like unicast addresses in most cases. Because an anycast address is syntactically the same as a unicast address, nodes doing address resolution or Neighbor Unreachability Detection on an anycast address treat it as if it were unicast. No special processing happens. Iconic and simple 💅
Nodes that have an anycast address assigned to an interface treat it exactly the same as a unicast address, with two exceptions. First, Neighbor Advertisements sent in response to a Neighbor Solicitation SHOULD be delayed by a random time between 0 and MAX_ANYCAST_DELAY_TIME to reduce the chance of network congestion 🌊. Second, the Override flag in Neighbor Advertisements SHOULD be set to 0, so that when multiple advertisements are received, the first one received is used rather than the most recently received one. First come, first served, periodt 👑
As with unicast addresses, Neighbor Unreachability Detection makes sure a node quickly notices when the current binding for an anycast address stops being valid. ⭐
7.2.8. Proxy Neighbor Advertisements 🫥
Under limited circumstances, a router MAY proxy for one or more other nodes. That means it uses Neighbor Advertisements to say it's willing to accept packets that aren't explicitly addressed to itself. For example, a router might accept packets on behalf of a mobile node that has moved off-link 🧳. The mechanisms proxying uses are basically the same ones used with anycast addresses.
A proxy MUST join the solicited-node multicast address(es) that correspond to the IP address(es) assigned to the node it's proxying for. This SHOULD be done using a multicast listener discovery protocol such as [MLD] or [MLDv2]. 📻
All solicited proxy Neighbor Advertisement messages MUST have the Override flag set to zero. This makes sure that if the node itself is present on the link, its own Neighbor Advertisement (with the Override flag set to one) takes precedence over any advertisement received from a proxy. A proxy MAY send unsolicited advertisements with the Override flag set to one, as specified in Section 7.2.6, but doing so may cause the proxy advertisement to override a valid entry the node created itself. Oops, not the vibe 🙈
Finally, when sending a proxy advertisement in response to a Neighbor Solicitation, the sender should delay its response by a random time between 0 and MAX_ANYCAST_DELAY_TIME seconds, so it doesn't collide with the responses from several other proxies. However, in some cases (for example, Mobile IPv6), where only one proxy is present, that delay isn't necessary. 🧚
7.3. Neighbor Unreachability Detection 🔍
Communication to or through a neighbor can fail for lots of reasons at any time, including hardware failure, hot-swapping an interface card, and so on 💥. If the destination itself has failed, no recovery is possible and communication fails. But if it's the path that has failed, recovery may be possible. So a node actively tracks the reachability "state" of the neighbors it's sending packets to. Watching the vibes closely 👀
Neighbor Unreachability Detection is used for all paths between hosts and neighboring nodes, including host-to-host, host-to-router, and router-to-host communication. It may also be used between routers, but it is not required if an equivalent mechanism is available, for example as part of the routing protocols. 🛤️
When a path to a neighbor appears to be failing, the specific recovery procedure depends on how that neighbor is being used. If the neighbor is the ultimate destination, address resolution should be performed again, for example. If the neighbor is a router, though, switching to another router would be the right move 🔀. The specific recovery is covered under next-hop determination. Neighbor Unreachability Detection signals the need for next-hop determination by deleting a Neighbor Cache entry. Delete, reset, serve 💅
Neighbor Unreachability Detection is performed only for neighbors that unicast packets are sent to. It is not used when sending to multicast addresses. Multicast is a no-go zone for this one 🚫
7.3.1. Reachability Confirmation 💖
okay so a neighbor counts as reachable if the node has recently gotten confirmation that packets it sent to that neighbor were received by its IP layer 🦋. There are two ways to get positive confirmation. One is hints from upper-layer protocols saying a connection is making "forward progress" 🚀. The other is getting a Neighbor Advertisement that answers a Neighbor Solicitation 🫶.
A connection makes "forward progress" when the packets arriving from a remote peer can only be arriving because recent packets sent to that peer actually got there 🧠. TCP is the classic example: getting a (new) acknowledgment means the data you sent earlier reached the peer 🎀. And when new (non-duplicate) data shows up, that means earlier acknowledgments are being delivered to the remote peer 💅. If packets are reaching the peer, they must also be reaching the sender's next-hop neighbor, so forward progress is basically proof that the next-hop neighbor is reachable 👑. For off-link destinations, forward progress implies the first-hop router is reachable ✨. When this upper-layer info is available, it SHOULD be used 🙌.
Sometimes upper-layer protocols can't give you that info, like UDP-based protocols and routers forwarding packets to hosts 🙈. When there are no hints and a node is sending packets to a neighbor, the node actively probes the neighbor with unicast Neighbor Solicitation messages to check that the forward path is still working 🔍.
Getting a solicited Neighbor Advertisement counts as reachability confirmation, because advertisements with the Solicited flag set to one only get sent in response to a Neighbor Solicitation 🎯.
Now the important bit 🚨: getting other Neighbor Discovery messages, like Router Advertisements and Neighbor Advertisements with the Solicited flag set to zero, MUST NOT be treated as reachability confirmation 🙅♀️. Unsolicited messages only confirm the one-way path from the sender to the recipient node 🛤️. Neighbor Unreachability Detection needs a node to track the reachability of the forward path to a neighbor from its own perspective, not the neighbor's perspective 🪞. A solicited advertisement is extra special because it shows a path is working in both directions 🔁: the solicitation had to reach the neighbor so it could generate an advertisement. Getting an advertisement also shows the path from the sender to the recipient is working, but only the recipient knows that. The advertisement's sender has no direct way of knowing its advertisement actually reached a neighbor 🥺. From the point of view of Neighbor Unreachability Detection, only the forward path matters 💜.
7.3.2. Neighbor Cache Entry States 🌈
A Neighbor Cache entry can be in one of five states 🧚:
INCOMPLETE Address resolution is being performed on the entry.
Specifically, a Neighbor Solicitation has been sent to
the solicited-node multicast address of the target,
but the corresponding Neighbor Advertisement has not
yet been received.
REACHABLE Positive confirmation was received within the last
ReachableTime milliseconds that the forward path to
the neighbor was functioning properly. While
REACHABLE, no special action takes place as packets
are sent.
STALE More than ReachableTime milliseconds have elapsed
since the last positive confirmation was received that
the forward path was functioning properly. While
stale, no action takes place until a packet is sent.
The STALE state is entered upon receiving an
unsolicited Neighbor Discovery message that updates
the cached link-layer address. Receipt of such a
message does not confirm reachability, and entering
the STALE state ensures reachability is verified
quickly if the entry is actually being used. However,
reachability is not actually verified until the entry
is actually used.
DELAY More than ReachableTime milliseconds have elapsed
since the last positive confirmation was received that
the forward path was functioning properly, and a
packet was sent within the last DELAY_FIRST_PROBE_TIME
seconds. If no reachability confirmation is received
within DELAY_FIRST_PROBE_TIME seconds of entering the
DELAY state, send a Neighbor Solicitation and change
the state to PROBE.
The DELAY state is an optimization that gives upper-
layer protocols additional time to provide
reachability confirmation in those cases where
ReachableTime milliseconds have passed since the last
confirmation due to lack of recent traffic. Without
this optimization, the opening of a TCP connection
after a traffic lull would initiate probes even though
the subsequent three-way handshake would provide a
reachability confirmation almost immediately.
PROBE A reachability confirmation is actively sought by
retransmitting Neighbor Solicitations every
RetransTimer milliseconds until a reachability
confirmation is received.Here's the breakdown 🫧:
- INCOMPLETE 🔎: address resolution is happening on the entry. A Neighbor Solicitation went to the target's solicited-node multicast address, but there's no Neighbor Advertisement back yet.
- REACHABLE ✅: positive confirmation came in within the last
ReachableTimemilliseconds, so the forward path is working. Nothing special happens while packets are being sent. - STALE 🕰️: it's been more than
ReachableTimemilliseconds since the last positive confirmation. Nothing happens until a packet is sent. This state also gets entered when an unsolicited Neighbor Discovery message updates the cached link-layer address. Receiving that message doesn't confirm reachability, but going STALE makes sure reachability gets verified fast if the entry is actually used. And it's not verified until the entry is actually used 👀. - DELAY 🥱: it's been more than
ReachableTimemilliseconds since the last confirmation, and a packet went out within the lastDELAY_FIRST_PROBE_TIMEseconds. If no confirmation shows up withinDELAY_FIRST_PROBE_TIMEseconds of entering DELAY, send a Neighbor Solicitation and switch to PROBE. This state is an optimization 🧠 that gives upper-layer protocols extra time to confirm reachability when there's been a traffic lull. Without it, opening a TCP connection after a lull would kick off probes, even though the three-way handshake would confirm reachability almost right away 🤝. - PROBE 🔁: reachability is actively sought by retransmitting Neighbor Solicitations every
RetransTimermilliseconds until a confirmation comes in 📣.
7.3.3. Node Behavior 🎀
Neighbor Unreachability Detection runs in parallel with sending packets to a neighbor 🏃♀️. While reasserting a neighbor's reachability, a node keeps sending packets to that neighbor using the cached link-layer address. If no traffic is going to a neighbor, no probes get sent 😌.
When a node needs address resolution on a neighboring address, it creates an entry in the INCOMPLETE state and starts address resolution as described in Section 7.2 🗺️. If address resolution fails, the entry SHOULD be deleted, so that later traffic to that neighbor runs the next-hop determination procedure again. That's how alternate default routers get tried 🔄.
When a reachability confirmation comes in (through upper-layer advice or a solicited Neighbor Advertisement), the entry's state changes to REACHABLE 🥳. The one exception: upper-layer advice does nothing for entries in the INCOMPLETE state, where no link-layer address is cached yet 🙅♀️.
When ReachableTime milliseconds have passed since the last reachability confirmation for a neighbor, the Neighbor Cache entry goes from REACHABLE to STALE ⏳.
Note: An implementation may actually defer changing the state from REACHABLE to STALE until a packet is sent to the neighbor. In other words, there doesn't need to be an explicit timeout event tied to ReachableTime expiring 🫠.
The first time a node sends a packet to a neighbor whose entry is STALE, the sender switches the state to DELAY and sets a timer for DELAY_FIRST_PROBE_TIME seconds. If the entry is still in DELAY when the timer runs out, the state changes to PROBE. If a reachability confirmation comes in, the state changes to REACHABLE 🎉.
When an entry enters the PROBE state, the node sends a unicast Neighbor Solicitation to the neighbor using the cached link-layer address 📨. While in PROBE, the node keeps retransmitting Neighbor Solicitations every RetransTimer milliseconds until it gets reachability confirmation. Probes get retransmitted even if no other packets go to the neighbor 📬. If no response comes back after waiting RetransTimer milliseconds following the MAX_UNICAST_SOLICIT solicitations, the retransmissions stop and the entry SHOULD be deleted. Traffic to that neighbor later will recreate the entry and do address resolution again 🪄.
All Neighbor Solicitations are rate-limited per neighbor 🚦. A node MUST NOT send Neighbor Solicitations to the same neighbor more often than once every RetransTimer milliseconds 🛑.
A Neighbor Cache entry goes into the STALE state when it's created because of receiving packets other than solicited Neighbor Advertisements (so Router Solicitations, Router Advertisements, Redirects, and Neighbor Solicitations) 📦. These packets carry the link-layer address of either the sender or, for a Redirect, the redirection target. But receiving those addresses doesn't confirm reachability of the forward path to that node 🙃. Putting a newly created entry whose link-layer address is known into STALE means path failures get caught quickly ⚡. Also, if a cached link-layer address gets changed because one of those messages came in, the state SHOULD also be set to STALE, so the path to the new link-layer address gets verified promptly 💨.
To catch the case where a router turns into a host (say, its IP forwarding gets switched off by system management) 🔌, a node MUST compare the Router flag field in every received Neighbor Advertisement with the IsRouter flag stored in the Neighbor Cache entry 🕵️♀️. When a node spots a neighbor that went from router to host, it MUST remove that router from the Default Router List and update the Destination Cache as described in Section 6.3.5 💅. Heads up: a router might not be on the Default Router List even though a Destination Cache entry is using it (for example, a host got redirected to it). In that case, every Destination Cache entry referencing the (former) router must perform next-hop determination again before it's used 🔁.
Sometimes link-specific info says a path to a neighbor has failed (like a virtual circuit getting reset) ⚠️. Then that info can be used to purge Neighbor Cache entries before Neighbor Unreachability Detection would do it. But link-specific information MUST NOT be used to confirm a neighbor's reachability 🚫, because it doesn't give end-to-end confirmation between the neighboring IP layers 🙅♀️.
8. Redirect Function 🦋
This section covers the functions for sending and processing Redirect messages 💌.
Routers send Redirect messages to point a host at a better first-hop router for a specific destination, or to tell hosts that a destination is actually a neighbor (that is, on-link) 🗺️. That second one happens when the ICMP Target Address is equal to the ICMP Destination Address 🎯.
A router MUST be able to figure out the link-local address of each of its neighboring routers 🔗, so the target address in a Redirect message identifies the neighbor router by its link-local address. For static routing, this means the next-hop router's address should be specified using that router's link-local address 📌. For dynamic routing, it means all IPv6 routing protocols must somehow exchange the link-local addresses of neighboring routers 🧩.
8.1. Validation of Redirect Messages 💌
okay so, a host MUST silently discard any received Redirect message that does not satisfy ALL of these validity checks (no skipping, bestie 🙅♀️):
IP Source Addressis a link-local address. Routers must use their link-local address as the source for Router Advertisement and Redirect messages so that hosts can uniquely identify routers. 🔍- The
IP Hop Limitfield has a value of 255, i.e., the packet could not possibly have been forwarded by a router. 🧚 ICMP Checksumis valid. ✅ICMP Codeis 0. 🎀- ICMP length (derived from the IP length) is 40 or more octets. 📏
- The IP source address of the Redirect is the same as the current first-hop router for the specified
ICMP Destination Address. 🚪 - The
ICMP Destination Addressfield in the redirect message does not contain a multicast address. 🙅 - The
ICMP Target Addressis either a link-local address (when redirected to a router) or the same as theICMP Destination Address(when redirected to the on-link destination). 🦋 - All included options have a length that is greater than zero. 💅
the contents of the Reserved field, and of any unrecognized options, MUST be ignored. 🫶 future backward-compatible changes may specify what Reserved holds or add new options, and backward-incompatible changes may use different Code values. the vibe is "future-proof, no drama" 🌸
the contents of any defined options that are not specified to be used with Redirect messages MUST be ignored, and the packet gets processed as normal. the only defined options that may appear are the Target Link-Layer Address option and the Redirected Header option. ✨
A host MUST NOT consider a redirect invalid just because the Target Address of the redirect is not covered under one of the link's prefixes. Part of the semantics of the Redirect message is that the Target Address is on-link. this is SO important, don't mix it up 🙈
a redirect that passes the validity checks is called a "valid redirect". iconic naming, no notes 👑
8.2. Router Specification 🏠
A router SHOULD send a redirect message, subject to rate limiting, whenever it forwards a packet that is not explicitly addressed to itself (i.e., a packet that is not source routed through the router) in which:
- the Source Address field of the packet identifies a neighbor, and
- the router determines (by means outside the scope of this specification) that a better first-hop node resides on the same link as the sending node for the Destination Address of the packet being forwarded, and
- the Destination Address of the packet is not a multicast address.
the transmitted redirect packet contains, consistent with the message format given in Section 4.5: 📦
- In the Target Address field: the address to which subsequent packets for the destination should be sent. If the target is a router, that router's link-local address MUST be used. If the target is a host, the target address field MUST be set to the same value as the Destination Address field. 🎯
- In the Destination Address field: the destination address of the invoking IP packet. 💌
- In the options:
- Target Link-Layer Address option: link-layer address of the target, if known. 🔗
- Redirected Header: as much of the forwarded packet as can fit without the redirect packet exceeding the minimum MTU required to support IPv6 as specified in [IPv6]. 📐
A router MUST limit the rate at which Redirect messages are sent, in order to limit the bandwidth and processing costs incurred by the Redirect messages when the source does not correctly respond to the Redirects, or the source chooses to ignore unauthenticated Redirect messages. More details on the rate-limiting of ICMP error messages can be found in [ICMPv6]. 🚦
A router MUST NOT update its routing tables upon receipt of a Redirect. routers hands off, don't touch the routing table 🙅♀️💅
8.3. Host Specification 🖥️
A host receiving a valid redirect SHOULD update its Destination Cache accordingly so that subsequent traffic goes to the specified target. If no Destination Cache entry exists for the destination, an implementation SHOULD create such an entry. 🗂️
If the redirect contains a Target Link-Layer Address option, the host either creates or updates the Neighbor Cache entry for the target. In both cases, the cached link-layer address is copied from the Target Link-Layer Address option. If a Neighbor Cache entry is created for the target, its reachability state MUST be set to STALE as specified in Section 7.3.3. If a cache entry already existed and it is updated with a different link-layer address, its reachability state MUST also be set to STALE. If the link-layer address is the same as that already in the cache, the cache entry's state remains unchanged. 🧠
If the Target and Destination Addresses are the same, the host MUST treat the Target as on-link. If the Target Address is not the same as the Destination Address, the host MUST set IsRouter to TRUE for the target. If the Target and Destination Addresses are the same, however, one cannot reliably determine whether the Target Address is a router. Consequently, newly created Neighbor Cache entries should set the IsRouter flag to FALSE, while existing cache entries should leave the flag unchanged. If the Target is a router, subsequent Neighbor Advertisement or Router Advertisement messages will update IsRouter accordingly. 🎭
Redirect messages apply to all flows that are being sent to a given destination. That is, upon receipt of a Redirect for a Destination Address, all Destination Cache entries to that address should be updated to use the specified next-hop, regardless of the contents of the Flow Label field that appears in the Redirected Header option. 🌊
A host MUST NOT send Redirect messages. 🙅♀️ hosts don't do the redirecting, that's a router thing 🙃
9. Extensibility - Option Processing 🧩
Options provide a mechanism for encoding variable length fields, fields that may appear multiple times in the same packet, or information that may not appear in all packets. Options can also be used to add additional functionality to future versions of ND. the glow-up potential is unreal 💖
In order to ensure that future extensions properly coexist with current implementations, all nodes MUST silently ignore any options they do not recognize in received ND packets and continue processing the packet. All options specified in this document MUST be recognized. A node MUST NOT ignore valid options just because the ND message contains unrecognized ones. 🫶
The current set of options is defined in such a way that receivers can process multiple options in the same packet independently of each other. In order to maintain these properties, future options SHOULD follow the simple rule:
The option MUST NOT depend on the presence or absence of any other options. The semantics of an option should depend only on the information in the fixed part of the ND packet and on the information contained in the option itself.
Adhering to the above rule has the following benefits:
- Receivers can process options independently of one another. For example, an implementation can choose to process the Prefix Information option contained in a Router Advertisement message in a user-space process while the link-layer address option in the same message is processed by routines in the kernel. 🧵
- Should the number of options cause a packet to exceed a link's MTU, multiple packets can carry subsets of the options without any change in semantics. 📬
- Senders MAY send a subset of options in different packets. For instance, if a prefix's Valid and Preferred Lifetime are high enough, it might not be necessary to include the Prefix Information option in every Router Advertisement. In addition, different routers might send different sets of options. Thus, a receiver MUST NOT associate any action with the absence of an option in a particular packet. This protocol specifies that receivers should only act on the expiration of timers and on the information that is received in the packets. ⏰
Options in Neighbor Discovery packets can appear in any order; receivers MUST be prepared to process them independently of their order. There can also be multiple instances of the same option in a message (e.g., Prefix Information options). 🔁
If the number of included options in a Router Advertisement causes the advertisement's size to exceed the link MTU, the router can send multiple separate advertisements, each containing a subset of the options. 📨
The amount of data to include in the Redirected Header option MUST be limited so that the entire redirect packet does not exceed the minimum MTU required to support IPv6 as specified in [IPv6]. 📏
All options are a multiple of 8 octets of length, ensuring appropriate alignment without any "pad" options. The fields in the options (as well as the fields in ND packets) are defined to align on their natural boundaries (e.g., a 16-bit field is aligned on a 16-bit boundary) with the exception of the 128-bit IP addresses/prefixes, which are aligned on a 64-bit boundary. The link-layer address field contains an uninterpreted octet string; it is aligned on an 8-bit boundary. 🧱
The size of an ND packet including the IP header is limited to the link MTU. When adding options to an ND packet, a node MUST NOT exceed the link MTU. 🚫
Future versions of this protocol may define new option types. Receivers MUST silently ignore any options they do not recognize and continue processing the message. 🌈
10. Protocol Constants 🔢
Here are the constants, bestie. Copy them exactly 📝
Router constants:
MAX_INITIAL_RTR_ADVERT_INTERVAL 16 seconds
MAX_INITIAL_RTR_ADVERTISEMENTS 3 transmissions
MAX_FINAL_RTR_ADVERTISEMENTS 3 transmissions
MIN_DELAY_BETWEEN_RAS 3 seconds
MAX_RA_DELAY_TIME .5 seconds
Host constants:
MAX_RTR_SOLICITATION_DELAY 1 second
RTR_SOLICITATION_INTERVAL 4 seconds
MAX_RTR_SOLICITATIONS 3 transmissions
Node constants:
MAX_MULTICAST_SOLICIT 3 transmissions
MAX_UNICAST_SOLICIT 3 transmissions
MAX_ANYCAST_DELAY_TIME 1 second
MAX_NEIGHBOR_ADVERTISEMENT 3 transmissions
REACHABLE_TIME 30,000 milliseconds
RETRANS_TIMER 1,000 milliseconds
DELAY_FIRST_PROBE_TIME 5 seconds
MIN_RANDOM_FACTOR .5
MAX_RANDOM_FACTOR 1.5additional protocol constants are defined with the message formats in Section 4. ✨
all protocol constants are subject to change in future revisions of the protocol. 🔄
the constants in this specification may be overridden by specific documents that describe how IPv6 operates over different link layers. this rule lets Neighbor Discovery work over links with wildly different performance, which is honestly so smart 🧠💜
11. Security Considerations 🚨
okay bestie, this one is SERIOUS 😭 Neighbor Discovery is subject to attacks that cause IP packets to flow to unexpected places. Such attacks can be used to cause denial of service, but they also allow nodes to intercept and optionally modify packets destined for other nodes. 💀 This section deals with the main threats related to Neighbor Discovery messages and possible security mechanisms that can mitigate these threats. 🛡️
11.1. Threat Analysis 💀
Okay bestie, this section is the drama 😭 It covers the main threats to Neighbor Discovery. A deeper dive is in [PSREQ]. The protocol's big vulnerabilities fall into three buckets:
- Denial-of-Service (DoS) attacks. 🙅♀️
- Address spoofing attacks. 🎭
- Router spoofing attacks. 👑
So picture this 🙈 a node on the link that can send packets with any IP source address it wants can do two sneaky things. It can advertise itself as a default router, and it can send "forged" Router Advertisement messages that instantly time out every other default router and all the on-link prefixes. The intruder pulls this off by sending out several Router Advertisements, one for each legitimate router. Each one uses the address of another router as its source, has the Router Lifetime field set to zero, and has the Preferred and Valid lifetimes set to zero for all the prefixes. 😱 Now all packets, for both on-link and off-link destinations, end up at the rogue router. That router can then selectively examine, modify, or drop everything sent on the link. Main character villain behavior, honestly 💅
Here's the lowkey scary part: Neighbor Unreachability Detection (NUD) won't catch this black hole, as long as the rogue router politely answers the NUD probes with a Neighbor Advertisement that has the R-bit set. 🫠
It's also possible for any host to launch a DoS attack on another host, by stopping it from configuring an address using [ADDRCONF]. And the protocol doesn't let hosts verify whether the sender of a Neighbor Advertisement is the real owner of the IP address in that message. Not it 🙃
Redirect attacks can be pulled off by any host too, to flood a victim or steal its traffic. A host can send a Neighbor Advertisement (in response to a solicitation) that has its own IP address paired with a victim's link-layer address, which floods the victim with unwanted traffic. Or the host can send a Neighbor Advertisement with a victim's IP address and its own link-layer address, which overwrites an existing entry in the sender's destination cache. That forces the sender to forward all of the victim's traffic to the attacker. Iconic villain arc 🦹♀️
The trust model for redirects is the same as in IPv4. A redirect is accepted only if it comes from the same router currently being used for that destination. ✨ If a host has been redirected to another node (i.e., the destination is on-link), there's no way to stop the target from issuing another redirect to some other destination. Still, this exposure is no worse than it was before the redirect. The target host, once subverted, could always act as a hidden router to forward traffic elsewhere anyway 🫶
The protocol has no mechanism for figuring out which neighbors are authorized to send a particular type of message (for example, Router Advertisements). So any neighbor, presumably even when authentication is in place, can send Router Advertisement messages and cause denial of service. Plus, any neighbor can send proxy Neighbor Advertisements as well as unsolicited Neighbor Advertisements, which is a potential DoS attack too 🚩
Many link layers have their own DoS problems too 🌪️ For example, someone can continuously occupy the link in CSMA/CD (Carrier Sense Multiple Access with Collision Detection) networks, either by sending packets closely back-to-back or by asserting the collision signal on the link. Someone can also originate packets with somebody else's source MAC address to confuse things like Ethernet switches. On the bright side 🌈 many of the threats in this section are less effective, or totally non-existent, on point-to-point links, or on cellular links where a host shares a link with only one neighbor, i.e., the default router.
11.2. Securing Neighbor Discovery Messages 🔐
Without authentication, the protocol cuts down its exposure to the threats above by ignoring ND packets received from off-link senders. 🙌 The Hop Limit field of every received packet is verified to contain 255, the maximum legal value. This works because routers decrement the Hop Limit on all packets they forward, so a received packet with a Hop Limit of 255 must have come from a neighbor. Smart, right? 🧠
Cryptographic security mechanisms for Neighbor Discovery are outside the scope of this document and are defined in [SEND]. Another option is IPsec, which can be used for IP layer authentication [IPv6-SA]. Internet Key Exchange (IKE) is not a good fit for creating dynamic security associations that can secure address resolution or neighbor solicitation messages, as documented in [ICMPIKE]. Not ideal 😬
In some cases, it may be acceptable to use statically configured security associations with either [IPv6-AUTH] or [IPv6-ESP] to secure Neighbor Discovery messages. Important caveat though ⚠️ statically configured security associations don't scale well (especially on multicast links), so they're really only for small networks with known hosts.
⚠️ Whenever [IPv6-AUTH] or [IPv6-ESP] is used, ND packets MUST be verified for the purpose of authentication. Packets that fail authentication checks MUST be silently discarded. No exceptions, periodt 💜
12. Renumbering Considerations 🔄
Neighbor Discovery, together with IPv6 Address Autoconfiguration [ADDRCONF], gives us tools to help with renumbering. New prefixes and addresses can be introduced, and old ones can be deprecated and removed. Very glow-up energy ✨
The robustness of all this depends on every node on the link receiving the Router Advertisement messages in a timely manner. 😅 But a host might be turned off or unreachable for a long stretch (like a machine that gets powered down for months after a project ends). It's possible to keep renumbering robust in those cases, but it puts some constraints on how long prefixes have to be advertised.
Let's walk through an example 🗓️ A prefix is first advertised with a lifetime of 2 months. Then on August 1st, someone realizes the prefix needs to be deprecated and removed by September 1st due to renumbering. The fix is to cut the advertised lifetime down to 1 week starting on August 1st. As the cutoff gets closer, the lifetimes get shorter and shorter, until by September 1st the prefix is advertised with a lifetime of 0.
Here's the catch 🙀 If one or more nodes were unplugged from the link before September 1st, they might still think the prefix is valid, since the last lifetime they got was 2 months. So a node unplugged on July 31st thinks the prefix is valid until September 30th. If that node gets plugged back in before September 30th, it may keep using the old prefix. The only way to force a node to stop using a prefix that was previously advertised with a long lifetime is to have it receive an advertisement for that prefix that moves the lifetime downward. The fix for this example is simple: keep advertising the prefix with a lifetime of 0 from September 1st until October 1st. Problem solved 💖
In general, to be robust against nodes that might get unplugged from the link, it's important to track how far into the future any node on the link could still view a particular prefix as valid. The prefix then has to be advertised with a 0 lifetime until that point in the future. 🔮 That "furthest into the future" time is simply the maximum, over all Router Advertisements, of the time the advertisement was sent plus the prefix's lifetime contained in the advertisement.
This also has a big implication for infinite lifetimes 👀 If a prefix is advertised with an infinite lifetime, and that prefix later needs renumbering, it's undesirable to keep advertising it with a zero lifetime forever. So either infinite lifetimes should be avoided, or there must be a limit on how long a node can be unplugged from the link before it's plugged back in. The catch is that it's unclear how a network administrator could enforce a limit on how long hosts such as laptops stay unplugged 💻
Network administrators should seriously consider using relatively short lifetimes (i.e., no more than a few weeks). 🌸 You might think long lifetimes would help robustness, but in reality, a host can't communicate without properly functioning routers. Those routers send Router Advertisements containing appropriate (and current) prefixes. A host on a network with no functioning routers is likely to have way bigger problems than just a missing valid prefix and address. 🙃
The discussion above doesn't distinguish between preferred and valid lifetimes. For all practical purposes, it's probably enough to track the valid lifetime, since the preferred lifetime won't exceed the valid lifetime. Easy 🎀
13. IANA Considerations 📋
This document doesn't require any new ICMPv6 types or codes to be allocated. However, existing ICMPv6 types have been updated to point to this document instead of RFC 2461. The procedure for assigning ICMPv6 types/codes is described in Section 6 of [ICMPv6].
This document keeps using the following ICMPv6 message types, which were introduced in RFC 2461 and already assigned by IANA:
Message name ICMPv6 Type
Router Solicitation 133
Router Advertisement 134
Neighbor Solicitation 135
Neighbor Advertisement 136
Redirect 137This document also keeps using the following Neighbor Discovery option types, which were introduced in RFC 2461 and already assigned by IANA:
Option Name Type
Source Link-Layer Address 1
Target Link-Layer Address 2
Prefix Information 3
Redirected Header 4
MTU 5Neighbor Discovery option types are allocated using this procedure 📝
- The IANA should allocate and permanently register new option types from IETF RFC publication. This covers all RFC types, including standards track, informational, and experimental status, that originate from the IETF and have been approved by the IESG for publication.
- IETF working groups with working group consensus and area director approval can request reclaimable Neighbor Discovery option type assignments from the IANA. The IANA will tag the values as "reclaimable in future".
The "reclaimable in the future" tag will be removed when an RFC is published documenting the protocol as defined in 1). That makes the assignment permanent and updates the reference on the IANA Web pages. ✅
When the option type values reach 85% assigned, the IETF will review the assignments tagged "reclaimable in the future" and tell the IANA which ones should be reclaimed and reassigned. Reclaim arc unlocked 🔓
- Requests for new option type value assignments from outside the IETF are only made through the publication of an IETF document, per 1) above. Also note that documents published as "RFC Editor contributions" [RFC3667] are not considered to be IETF documents. 🧐
14. References 📚
14.1. Normative References 📚✨
okay bestie, these are the must-read docs the rest of this spec leans on, so they're kinda the foundation 🧱 Here's the squad:
- [ADDR-ARCH] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, February 2006.
- [ICMPv6] Conta, A., Deering, S., and M. Gupta, Ed., "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification", RFC 4443, March 2006.
- [IPv6] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
- [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
14.2. Informative References 🦋
these ones are the extra reading 🤓 not strictly required, but SO good for context, and some of them are literally the reason things work the way they do 💖
- [ADDRCONF] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, September 2007.
- [ADDR-SEL] Draves, R., "Default Address Selection for Internet Protocol version 6 (IPv6)", RFC 3484, February 2003.
- [ARP] Plummer, D., "Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet Hardware", STD 37, RFC 826, November 1982.
- [ASSIGNED] Reynolds, J., Ed., "Assigned Numbers: RFC 1700 is Replaced by an On-line Database", RFC 3232, January 2002.
- [DHCPv6] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
- [HR-CL] Braden, R., Ed., "Requirements for Internet Hosts - Communication Layers", STD 3, RFC 1122, October 1989.
- [ICMPIKE] Arkko, J., "Effects of ICMPv6 on IKE", Work in Progress, March 2003.
- [ICMPv4] Postel, J., "Internet Control Message Protocol", STD 5, RFC 792, September 1981.
- [IPv6-3GPP] Wasserman, M., Ed., "Recommendations for IPv6 in Third Generation Partnership Project (3GPP) Standards", RFC 3314, September 2002.
- [IPv6-CELL] Arkko, J., Kuijpers, G., Soliman, H., Loughney, J., and J. Wiljakka, "Internet Protocol Version 6 (IPv6) for Some Second and Third Generation Cellular Hosts", RFC 3316, April 2003.
- [IPv6-ETHER] Crawford, M., "Transmission of IPv6 Packets over Ethernet Networks", RFC 2464, December 1998.
- [IPv6-SA] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, December 2005.
- [IPv6-AUTH] Kent, S., "IP Authentication Header", RFC 4302, December 2005.
- [IPv6-ESP] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303, December 2005.
- [IPv6-NBMA] Armitage, G., Schulter, P., Jork, M., and G. Harter, "IPv6 over Non-Broadcast Multiple Access (NBMA) networks", RFC 2491, January 1999.
- [LD-SHRE] Hinden, R. and D. Thaler, "IPv6 Host-to-Router Load Sharing", RFC 4311, November 2005.
- [MIPv6] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in IPv6", RFC 3775, June 2004.
- [MLD] Deering, S., Fenner, W., and B. Haberman, "Multicast Listener Discovery (MLD) for IPv6", RFC 2710, October 1999.
- [MLDv2] Vida, R., Ed., and L. Costa, Ed., "Multicast Listener Discovery Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
- [PSREQ] Nikander, P., Ed., Kempf, J., and E. Nordmark, "IPv6 Neighbor Discovery (ND) Trust Models and Threats", RFC 3756, May 2004.
- [RAND] Eastlake, D., 3rd, Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
- [RDISC] Deering, S., Ed., "ICMP Router Discovery Messages", RFC 1256, September 1991.
- [RFC3667] Bradner, S., "IETF Rights in Contributions", RFC 3667, February 2004.
- [RTSEL] Draves, R. and D. Thaler, "Default Router Preferences and More-Specific Routes", RFC 4191, November 2005.
- [SH-MEDIA] Braden, B., Postel, J., and Y. Rekhter, "Internet Architecture Extensions for Shared Media", RFC 1620, May 1994.
- [SEND] Arkko, J., Ed., Kempf, J., Zill, B., and P. Nikander, "SEcure Neighbor Discovery (SEND)", RFC 3971, March 2005.
- [SYNC] S. Floyd, V. Jacobson, "The Synchronization of Periodic Routing Messages", IEEE/ACM Transactions on Networking, April 1994.
ftp://ftp.ee.lbl.gov/papers/sync_94.ps.Z
Appendix A: Multihomed Hosts 🏠🌐
okay this one is a whole saga 😭 there are a bunch of tricky issues when Neighbor Discovery runs on hosts with multiple interfaces. this section doesn't try to pin down the proper behaviour for multihomed hosts 🙈 instead it just lists the issues that still need more study. implementors are encouraged to experiment with different approaches and report back on what they find 🧪 more on this lives in [RTSEL] 💜
if a multihomed host gets Router Advertisements on all of its interfaces, it will (probably) have learned on-link prefixes for the addresses on each link 🔗 but when a packet has to go through a router, picking the "wrong" one can lead to a suboptimal or totally broken path 💀 there are a few things to think about:
- In order for a router to send a redirect, it must determine that the packet it is forwarding originates from a neighbor. The standard test for this case is to compare the source address of the packet to the list of on-link prefixes associated with the interface on which the packet was received. If the originating host is multihomed, however, the source address it uses may belong to an interface other than the interface from which it was sent. In such cases, a router will not send redirects, and suboptimal routing is likely. In order to be redirected, the sending host must always send packets out the interface corresponding to the outgoing packet's source address. Note that this issue never arises with non-multihomed hosts; they only have one interface. Additional discussion on this topic can be found in RFC 1122 under Section 3.3.4.2.
- If the selected first-hop router does not have a route at all for the destination, it will be unable to deliver the packet. However, the destination may be reachable through a router on one of the other interfaces. Neighbor Discovery does not address this scenario; it does not arise in the non-multihomed case.
- Even if the first-hop router does have a route for a destination, there may be a better route via another interface. No mechanism exists for the multihomed host to detect this situation.
if a multihomed host fails to receive Router Advertisements on one or more of its interfaces, it won't know (without configured info) which destinations are on-link on the affected interface(s) 😬 that leads to this problem: if Router Advertisements arrive on some, but not all, interfaces, a multihomed host could choose to only send packets out the interfaces where it got Router Advertisements. A key assumption made here, however, is that routers on those other interfaces will be able to route packets to the ultimate destination, even when those destinations sit on the subnet the sender connects to but has no on-link prefix information for. Should the assumption be FALSE, communication would fail 💔 and even if the assumption holds, packets will still take a suboptimal path 🫠
Appendix B: Future Extensions 🔮✨
these are the possible extensions for future study 👀
- Using dynamic timers to be able to adapt to links with widely varying delay. Measuring round-trip times, however, requires acknowledgments and sequence numbers in order to match received Neighbor Advertisements with the actual Neighbor Solicitation that triggered the advertisement. Implementors wishing to experiment with such a facility could do so in a backwards-compatible way by defining a new option carrying the necessary information. Nodes not understanding the option would simply ignore it. 🕰️
- Adding capabilities to facilitate the operation over links that currently require hosts to register with an address resolution server. This could, for instance, enable routers to ask hosts to send them periodic unsolicited advertisements. Once again, this can be added using a new option sent in the Router Advertisements. 📡
- Adding additional procedures for links where asymmetric and non-transitive reachability is part of normal operations. Such procedures might allow hosts and routers to find usable paths on, e.g., radio links. 📻💜
Appendix C: State Machine for the Reachability State ✨
okay so this appendix is basically a cheat sheet 🎀 It sums up the rules from Sections 7.2 and 7.3. Quick reminder that this document does not mandate that implementations adhere to this model, as long as their external behavior matches what's described here 💅
When it's doing address resolution and Neighbor Unreachability Detection, these state transitions apply using the conceptual model:
State Event Action New state
- Packet to send. Create entry. INCOMPLETE
Send multicast NS.
Start retransmit timer
INCOMPLETE Retransmit timeout, Retransmit NS INCOMPLETE
less than N Start retransmit
retransmissions. timer
INCOMPLETE Retransmit timeout, Discard entry -
N or more Send ICMP error
retransmissions.
INCOMPLETE NA, Solicited=0, Record link-layer STALE
Override=any address. Send queued
packets.
INCOMPLETE NA, Solicited=1, Record link-layer REACHABLE
Override=any address. Send queued
packets.
INCOMPLETE NA, Solicited=any, Update content of unchanged
Override=any, No IsRouter flag
Link-layer address
- NS, RS, Redirect - -
No link-layer address
!INCOMPLETE NA, Solicited=1, - REACHABLE
Override=0
Same link-layer
address as cached.
!INCOMPLETE NA, Solicited=any, Update content of unchanged
Override=any, No IsRouter flag.
link-layer address
REACHABLE NA, Solicited=1, - STALE
Override=0
Different link-layer
address than cached.
STALE, PROBE NA, Solicited=1, - unchanged
Or DELAY Override=0
Different link-layer
address than cached.
!INCOMPLETE NA, Solicited=1, Record link-layer REACHABLE
Override=1 address (if
different).
!INCOMPLETE NA, Solicited=0, - unchanged
Override=0
!INCOMPLETE NA, Solicited=0, - unchanged
Override=1
Same link-layer
address as cached.
!INCOMPLETE NA, Solicited=0, Record link-layer STALE
Override=1 address.
Different link-layer
address than cached.
!INCOMPLETE upper-layer reachability - REACHABLE
confirmation
REACHABLE timeout, more than - STALE
N seconds since
reachability confirm.
STALE Sending packet Start delay timer DELAY
DELAY Delay timeout Send unicast NS probe PROBE
Start retransmit timer
PROBE Retransmit timeout, Retransmit NS PROBE
less than N
retransmissions.
PROBE Retransmit timeout, Discard entry -
N or more
retransmissions.Now for the bit about receiving unsolicited information, which is everything except Neighbor Advertisement messages 🌸 This applies to either the source of the packet (for Neighbor Solicitation, Router Solicitation, and Router Advertisement messages) or the target address (for Redirect messages):
State Event Action New state
- NS, RS, RA, Redirect Create entry. STALE
INCOMPLETE NS, RS, RA, Redirect Record link-layer STALE
address. Send queued
packets.
!INCOMPLETE NS, RS, RA, Redirect Update link-layer STALE
Different link-layer address
address than cached.
INCOMPLETE NS, RS No link-layer - unchanged
address
!INCOMPLETE NS, RS, RA, Redirect - unchanged
Same link-layer
address as cached.Appendix D: Summary of IsRouter Rules 🦋
this appendix is the recap for how the IsRouter flag gets maintained 🧚 The big idea is that ND messages carry info, either implied or spelled out, about whether the sender (or Target Address) is a host or a router. Here's what's assumed:
- The sender of a Router Advertisement is implicitly assumed to be a router.
- Neighbor Solicitation messages don't have any implicit or explicit hint about the sender. Hosts and routers both send them.
- Neighbor Advertisement messages carry an explicit "IsRouter flag", the R-bit.
- The target of a redirect, when the target is different from the destination address in the packet being redirected, is implicitly assumed to be a router. This makes sense, since that node is expected to be able to forward packets toward the destination.
- The target of a redirect, when the target is the same as the destination, doesn't tell you anything about host vs. router. All you know is that the destination (aka the target) is on-link, but it could be either a host or a router 🤷♀️
The rules for setting the IsRouter flag come from that info. If an ND message has explicit or implicit info, receiving it will update the IsRouter flag. But when an ND message has no host vs. router info, receiving it MUST NOT cause a change to the IsRouter state. When receiving such a message creates a Neighbor Cache entry, this document says the IsRouter flag gets set to FALSE. There's more potential for mischief when a node wrongly thinks a host is a router than the other way around 😬 In those cases, a later Neighbor Advertisement or Router Advertisement message will set the correct IsRouter value 💖
Appendix E: Implementation Issues 🔥
E.1. Reachability Confirmations
okay bestie, this part is lowkey important 🫶 Neighbor Unreachability Detection needs explicit confirmation that a forward-path is working properly. To avoid needing Neighbor Solicitation probe messages, upper-layer protocols should give that indication whenever it's cheap to do so. Reliable connection-oriented protocols like TCP usually know when the forward-path is working. When TCP sends (or receives) data, for example, it updates its window sequence numbers, sets and cancels retransmit timers, and so on 💅 Specific situations that usually mean the forward-path is working include:
- Receiving an acknowledgment that covers a sequence number (e.g., data) that wasn't acknowledged before means the forward path was working at the time the data was sent.
- Finishing the initial three-way handshake is a special case of the rule above. No data is sent during the handshake, but the SYN flags count as data from the sequence number perspective. This applies to both the SYN+ACK for the active open and the ACK of that packet on the passively opening peer 🌈
- Receiving new data (i.e., data that wasn't received before) means the forward-path was working at the time an acknowledgment was sent that moved forward the peer's send window, which let that new data get sent 🍓
To keep the cost of sharing reachability info between the TCP and IP layers low, an implementation may want to rate-limit the reachability confirmations it sends to IP 🎀 One option is to only process reachability every few packets. For example, if an implementation only has one round-trip timer per connection, it might update reachability info once per round-trip time. For implementations that cache Destination Cache entries within control blocks, it may be possible to update the Neighbor Cache entry directly (no expensive lookup needed) once the TCP packet has been demultiplexed to its control block. For other implementations, it may be possible to piggyback the reachability confirmation on the next packet submitted to IP, as long as the implementation guards against that piggybacked confirmation going stale when no packets get sent to IP for a long time ⏳
TCP also has to make sure it doesn't mistake "stale" info for current reachability 🙈 For example, new data received 30 minutes after a window opened up does not confirm that the path is working right now. It only shows that 30 minutes ago the window update reached the peer, meaning the path was working at that point in time. An implementation must also account for TCP zero-window probes, which get sent even when the path is broken and the window update never reached the peer 💀
For UDP-based applications (Remote Procedure Call (RPC), DNS), it's pretty simple for the client to send reachability confirmations when a response packet arrives 🧚 It's harder, and in some cases impossible, for the server to generate them, since there's no flow control. The server can't tell whether a received request means a previous response reached the client.
Note that an implementation can't use negative upper-layer advice in place of the Neighbor Unreachability Detection algorithm 😭 Negative advice (e.g., from TCP when there are excessive retransmissions) could hint that the forward path from the sender of the data might not be working. But it would miss the case where the path from the receiver of the data isn't working, so none of the acknowledgment packets reach the sender.
Appendix F: Changes from RFC 2461 🎀
okay bestie, this is the changelog 📝✨ Here's everything that got glow-up'd between RFC 2461 and this version:
- Removed references to IPsec AH and ESP for securing messages or as part of validating the received message. 🔒 not the vibe anymore 💅
- Added Section 3.3. 🆕
- Updated Section 11 to include more detailed discussion on threats, IPsec limitations, and use of SEND. 👀 it's giving security deep dive
- Removed the on-link assumption in Section 5.2 based on RFC 4942, "IPv6 Neighbor Discovery On-Link Assumption Considered Harmful". 💀 lowkey iconic title tbh
- Clarified the definition of the Router Lifetime field in Section 4.2. 🧐
- Updated the text in Sections 4.6.2 and 6.2.1 to indicate that the preferred lifetime must not be larger than valid lifetime. ⏳ the preferred lifetime must not be larger than valid lifetime, no cap 🧢
- Removed the reference to stateful configuration and added reference for DHCPv6 instead. 🌸
- Added the IsRouter flag definition to Section 6.2.1 to allow for mixed host/router behavior. 🦋
- Allowed mobile nodes to be exempt from adding random delays before sending an RS during a handover. 📱✨
- Updated the definition of the prefix length in the prefix option. 🔢
- Updated the applicability to NBMA links in the introduction and added references to 3GPP RFCs. 🌐
- Clarified that support for load balancing is limited to routers. ⚖️ routers only, bestie
- Clarified router behavior when receiving a Router Solicitation without Source Link-Layer Address Option (SLLAO). 🙈
- Clarified that inconsistency checks for CurHopLimit are done for non-zero values only. 🔥
- Rearranged Section 7.2.5 for clarity, and described the processing when receiving the NA in INCOMPLETE state. 🧹✨
- Added clarifications in Section 7.2 on how a node should react upon receiving a message without SLLAO. 💜
- Added new IANA section. 🧚
- Miscellaneous editorials. 💅
Acknowledgments 🫶
The authors of RFC 2461 would like to thank the IPV6 working group and, especially (in alphabetical order), Ran Atkinson, Jim Bound, Scott Bradner, Alex Conta, Stephen Deering, Richard Draves, Francis Dupont, Robert Elz, Robert Gilligan, Robert Hinden, Tatuya Jinmei, Allison Mankin, Dan McDonald, Charles Perkins, Matt Thomas, and Susan Thomson. 🌟 the main character cast 👑
The editor of this document (Hesham Soliman) would also like to thank the IPV6 working group for all the contributions to this revision 💖, especially (in alphabetical order) Greg Daley, Elwyn Davies, Ralph Droms, Brian Haberman, Bob Hinden, Tatuya Jinmei, Pekka Savola, Fred Templin, and Christian Vogt. 🙌
Authors' Addresses 📮
Thomas Narten
IBM Corporation
P.O. Box 12195
Research Triangle Park, NC 27709-2195
USA
Phone: +1 919 254 7798
EMail: narten@us.ibm.com
Erik Nordmark
Sun Microsystems, Inc.
17 Network Circle
Menlo Park, CA 94025
USA
Phone: +1 650 786 2921
Fax: +1 650 786 5896
EMail: erik.nordmark@sun.com
William Allen Simpson
Daydreamer
Computer Systems Consulting Services
1384 Fontaine
Madison Heights, Michigan 48071
USA
EMail: william.allen.simpson@gmail.com
Hesham Soliman
Elevate Technologies
EMail: hesham@elevatemobile.comFull Copyright Statement ©️
Copyright (C) The IETF Trust (2007). 🦋
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. 🔐
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ⚠️ the legal disclaimer, all caps because it means business 💀
Intellectual Property 💜
The IETF takes no position on whether any Intellectual Property Rights or other rights that might be claimed to apply to the technology in this document are valid or in scope, or whether anyone could get a license for them. It also doesn't claim to have done any independent search for such rights. 🔍 For the procedures around rights in RFC documents, check out BCP 78 and BCP 79. 📚
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses that will be made available, and the results of any attempt to get a general license or permission to use these proprietary rights for implementers or users of this specification can be found in the IETF's online IPR repository at http://www.ietf.org/ipr. 🗂️
The IETF invites anyone who is interested to point out any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 📬 speak up if you know something, bestie 🫶
📦 where this page comes from
- ietf: rfc4861 2007-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms