RFC 9926

Prefix Registration for IPv6 Neighbor Discovery

📅 published February 2026, from ietf

Okay bestie, let's get into RFC 9926 🎀 It's called "Prefix Registration for IPv6 Neighbor Discovery" and it's a Standards Track doc, so this is the real deal ✨ P. Thubert, Ed. wrote it, it's dated February 2026, and its ISSN is 2070-1721 🌸 It updates RFCs 4861, 6550, 8505, 8928, and 9010, and the header doesn't list any obsoletes 💅 The official status, errata, and feedback page lives at https://www.rfc-editor.org/info/rfc9926 🦋

Abstract 📝

So this doc updates IPv6 Neighbor Discovery (RFC 4861) and IPv6 Subnet Neighbor Discovery (RFC 8505, RFC 8928) so that a node which owns a prefix, or is directly connected to one, can register that prefix with its neighbor routers 🫶 The registration says the prefix can be reached through the advertising node without a loop 🔁 The unicast prefix registration lets the node ask one or more neighbor routers to redistribute the prefix into another routing domain, no matter which routing protocol that domain uses 🌈 This doc also updates the Routing Protocol for Low-Power and Lossy Networks (RPL), as specified in RFCs 6550 and 9010, so that a 6LoWPAN Router (6LR) can inject the registered prefix into RPL 🧚

Status of This Memo 📜

This is an Internet Standards Track document ⭐

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841 💖

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9926 🔗

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License 🧾

Table of Contents 🗺️

1.  Introduction
2.  Terminology
  2.1.  Requirements Language
  2.2.  Inherited Terms and Concepts
  2.3.  Acronyms and Initialisms
  2.4.  New Terms
3.  Overview
4.  Updating RFC 4861
5.  Updating RFC 7400
6.  Updating RFC 6550
7.  Updating RFC 8505
  7.1.  New P-Field Value
  7.2.  New EARO Prefix Length Field and F flag
  7.3.  New EDAR Prefix Length Field
  7.4.  Updating the Registration Operation
8.  Updating RFC 9010
9.  Updating RFC 8928
10. Updating RFC 8929
11. Security Considerations
12. Operational Considerations
  12.1.  Partially Upgraded Networks
  12.2.  Application to RPL-Based Route-Over LLNs
  12.3.  Application to a Shared Link
  12.4.  Application to a Hub Link with Stub Spokes
13. IANA Considerations
  13.1.  Updated P-Field Registry
  13.2.  New 6LoWPAN Capability Bit
14. Normative References
15. Informative References
Acknowledgments
Author's Address

1. Introduction ✨

The design of Low Power and Lossy Networks (LLNs) is mostly about saving energy, which is the most constrained resource of all 🔋 Other design constraints (such as a limited memory capacity, duty cycling of the LLN devices, and low-power lossy transmissions) come from that main concern. The radio (both transmitting or simply listening) is a major energy drain, so LLN protocols have to be adapted to let nodes sleep with the radio turned off most of the time 😴

Examples of LLNs include hub-and-spoke access links such as (Low-Power) Wi-Fi [IEEE80211] and Bluetooth (Low Energy) [IEEE802151], Mesh-Under networks where the routing operation is handled at Layer 2 (L2), and route-over networks such as the Wi-SUN [WI-SUN] and 6TiSCH [RFC9030] mesh networks, which leverage 6LoWPAN [RFC4919] [RFC6282] and RPL [RFC6550] over [IEEE802154] 🕸️

LLNs and constrained devices are the original home turf for 6LoWPAN protocols 🏠 So when designing those protocols, minimizing energy spending is a foremost concern. In non-LLN environments where lowering carbon emissions is also a priority, it could make sense to apply the 6LoWPAN designs and extend some of the 6LoWPAN protocols. The general design points include:

  • Placing the protocol complexity in the less-constrained routers to simplify the host implementation and avoid expanding the control traffic to all nodes.
  • Using host-triggered operations to enable transient disconnections with the routers, e.g., to conserve power (sleep), but also to cope with inconsistent connectivity.

These points translate into:

  • Stateful proactively built knowledge in the routers that is available at any point of time.
  • Unicast host-to-router operations triggered by the host and its applications.
  • Minimal use of asynchronous L2 broadcast operations that would keep the host awake and listening with no application-level need to do so.

"RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks" [RFC6550] provides IPv6 [RFC8200] routing services within such constraints 🧭 To save signaling and routing state in constrained networks, RPL routing is only performed along a Destination-Oriented Directed Acyclic Graph (DODAG) that is optimized to reach a Root node, as opposed to along the shortest path between two peers, whatever that would mean in each LLN 🌳

The classical Neighbor Discovery Protocol (NDP) [RFC4861] [RFC4862] was defined for serial links and shared transit media such as Ethernet, back when L2 broadcast was cheap on those media and memory for the neighbor cache was expensive 🥲 So it was designed as a reactive protocol that relies on caching and multicast operations for the Duplicate Address Detection (DAD) and Address Resolution (AR), aka address discovery or address lookup, of IPv6 unicast addresses. Those multicast operations typically impact every node on-link when at most one is really targeted, which is a waste of energy, and they imply that all nodes are awake to hear the request, which clashes with power-saving (sleeping) modes 💀

"Architecture and Framework for IPv6 over Non-Broadcast Access" [IPv6-over-NBMA] introduces an evolution of IPv6 ND towards a proactive AR method 🚀 Because the IPv6 model for NBMA depends on a routing protocol to reach inside the subnet, the IPv6 ND extension for NBMA is referred to as Subnet Neighbor Discovery (SND). SND is based on work done in the context of the Internet of Things (IoT), known as 6LoWPAN ND. Unlike classical IPv6 ND, this evolution follows the energy conservation principles discussed above:

  • The original 6LoWPAN ND, "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)" [RFC6775], was introduced to avoid the excessive use of multicast messages and enable IPv6 ND for operations over energy-constrained nodes. [RFC6775] changes the classical IPv6 ND model to proactively establish the Neighbor Cache Entry (NCE) associated to the unicast address of a 6LoWPAN Node (6LN) in the one or more 6LoWPAN Routers (6LRs) that serve it. To that effect, [RFC6775] defines a new Address Registration Option (ARO) that is placed in unicast Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages between the 6LN and the 6LRs.
  • "Registration Extensions for IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) Neighbor Discovery>" [RFC8505] updates [RFC6775] into a generic Address Registration mechanism and is the foundation for Subnet Neighbor Discovery (SND). SND introduces the Extended Address Registration Option (EARO) to enable the registering node to access services such as routing inside a subnet and ND proxy operations [RFC8929]. This provides a routing-protocol-agnostic method for a host to request that the router inject a unicast IPv6 address in the local routing protocol and provide return reachability for that address.
  • "Listener Subscription for IPv6 Neighbor Discovery Multicast and Anycast Addresses" [RFC9685] updates [RFC8505] to enable a listener to subscribe to an IPv6 anycast or multicast address; the document also updates [RFC9010] to enable a 6LR to inject the anycast and multicast addresses in RPL. Similarly, this specification updates [RFC8505] and [RFC9010] to add the capability for a 6LN to register unicast prefixes up to 120 bits long, as opposed to addresses, and to signal in a routing-protocol-independent fashion to a 6LR that it is expected to redistribute the prefixes. This is the new bit! 🎀

This specification updates the above registration and subscription methods to enable a node to register a unicast prefix to the routing system and get it injected into the routing protocol 🌷 As with [RFC8505], the prefix registration is agnostic to the routing protocol in which the router injects the prefix, and the router is agnostic to the method that was used to allocate the prefix to the node. The energy conservation principles in [RFC8505] are retained as well, meaning that the node does not have to send or expect asynchronous multicast messages 🔋💖

Please note that an energy-conserving node is not necessarily a router, so even when a node is advertising a prefix, it is a design choice not to use Router Advertisement (RA) messages that would make the node look like a router to peer nodes 🙈 From the design principles above, it is clearly a design choice not to leverage (1) broadcasts from or to the node or (2) complex state machines in the node. It is also a design choice to use and extend the EARO rather than the Route Information Option (RIO) [RFC4191], because the RIO is not intended to inject routes into routing and lacks related control information like the R bit in the EARO. Additionally, an RA with RIO cannot be trusted for a safe injection into the routing protocol, because it has no equivalent of the Registration Ownership Verifier (ROVR) [RFC8928] found in the EARO 🔐

The R bit and the ROVR are the reason the EARO wins this one. Don't sleep on the details!

2. Terminology 📚

2.1. Requirements Language

Here's the key-word rule 🔑 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

2.2. Inherited Terms and Concepts

This document uses terms and concepts that are discussed in:

  • "Neighbor Discovery for IP version 6 (IPv6)" [RFC4861] and
  • "IPv6 Stateless Address Autoconfiguration" [RFC4862] for the Neighbor Solicitation operation,
  • "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)" [RFC6775], as well as
  • "Registration Extensions for IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) Neighbor Discovery" [RFC8505], and
  • "RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks" [RFC6550] for RPL, which is the routing protocol used in LLNs for SND 🧠

2.3. Acronyms and Initialisms 🎀

okay so bestie, here's the acronym cheat sheet this doc uses. Save it, you'll need it 💅

6CIO:       6LoWPAN Capability Indication Option [RFC7400]
6LBR:       6LoWPAN Border Router [RFC6775]
6LN:        6LoWPAN Node [RFC6775]
6LR:        6LoWPAN Router [RFC6775]
ARO:        Address Registration Option [RFC6775]
DAD:        Duplicate Address Detection [RFC4861]
DAO:        Destination Advertisement Object [RFC6550]
DODAG:      Destination-Oriented Directed Acyclic Graph
EARO:       Extended Address Registration Option [RFC8505]
EDAC:       Extended Duplicate Address Confirmation [RFC8505]
EDAR:       Extended Duplicate Address Request [RFC8505]
ESS:        Extended Service Set [IEEE80211]
IPAM:       IP Address Management
LLN:        Low-Power and Lossy Network
LLA:        Link-Layer Address
LoWPAN:     Low-Power Wireless Personal Area Network
LR-WPAN:    Low-Rate Wireless Personal Area Network [IEEE802154]
MAC:        Medium Access Control
NA:         Neighbor Advertisement (message) [RFC4861]
NBMA:       Non-Broadcast Multi-Access (full mesh)
NCE:        Neighbor Cache Entry [RFC4861]
ND:         Neighbor Discovery (protocol)
NDP:        Neighbor Discovery Protocol
NS:         Neighbor Solicitation (message) [RFC4861]
ROVR:       Registration Ownership Verifier (pronounced "rover")
            [RFC8505]
RPL:        IPv6 Routing Protocol for LLNs (pronounced "ripple")
            [RFC6550]
RA:         Router Advertisement (message) [RFC4861]
RS:         Router Solicitation (message) [RFC4861]
RTO:        RPL Target Option [RFC6550]
SLLAO:      Source Link-Layer Address Option [RFC4861]
SND:        Subnet Neighbor Discovery (protocol)
TID:        Transaction ID [RFC8505]
TIO:        Transit Information Option [RFC6550]
TLLAO:      Target Link-Layer Address Option [RFC4861]

2.4. New Terms 🦋

only one new term in this doc, so let's keep it simple 🌸

This document introduces the following term:

Origin: The node that issued the prefix advertisement, either in the form of a NS(EARO) or as a DAO(TIO, RTO)

3. Overview ✨

okay so this spec is basically borrowing from [RFC6550], [RFC8505], and [RFC9010] so we can register prefixes instead of just addresses. it's giving upgrade energy 🙈

The IPv6 ND operation doesn't care which routing protocol is used in the SND. Route-over LLNs usually lean on RPL. A RPL-based SND deployment looks like this:

  • one or more 6LBRs that act as RPL Root,
  • intermediate routers down the RPL graph that propagate routing information on addresses and prefixes towards the Root,
  • 6LRs that are RPL-aware 6LNs and can leverage RPL directly to expose their addresses and prefixes, and
  • 6LNs that are the RPL-unaware destinations and need SND to obtain reachability over the RPL LLN for their addresses and, with this specification, their prefixes as well.

The SND operation for prefixes is inherited from the one for unicast addresses, so it's the same unless this doc says otherwise 💜 Forwarding a packet works the way Section 11 of [RFC6550] describes, including loop avoidance and detection. The one twist: with multicast, multiple copies might get generated 👀

[RFC8505] is a prerequisite here, no skipping it. A node that implements this MUST also implement [RFC8505]. This spec doesn't add a brand new option. Instead it tweaks the existing ones and updates their behaviors so registering prefixes works as an extension to [RFC8505] ✨

This spec also updates the P-Field from [RFC9685] for use in EARO, DAR, and RTO, with a new value of 3 meaning "this is a prefix registration" (more on that in Section 7.2) 🎀 Now a 6LN can say it wants traffic for every address in a prefix's range, by putting P-Field value 3 in the EARO. Multiple 6LNs acting as border routers to the same external network, or as access routers to the same subnet, may register the same prefix to the same 6LR or to different 6LRs. Very group project energy 🍓

If the R flag is set in the registration of one or more 6LNs for the same prefix, then, according to its redistribution policy, the 6LR MUST redistribute the prefix in the routing protocol(s) (e.g., RPL) that it participates in. The redistribution lasts based on the longest registration lifetime across the non-expired received registrations for the prefix.`

Use cases where this spec may apply include virtual links, shared links, and hub links, shown in Sections 12.3 and 12.4, respectively 🦋 More generally, the 6LN may be a router running a different routing protocol in an external network (say, a stub network) and acting as a border router. Using prefix registration lets the routing protocol in the 6LN be decoupled from the one the 6LRs run in the main LLN, and it provides the signaling to kick off the redistribution 💅

4. Updating RFC 4861 🌈

okay the NS/NA exchange in [RFC4861] is designed for a unicast address, which goes in the Target Address field of the ND message. Section 5.5 of [RFC8505] stretches [RFC4861] so the Registered Address can ride in the Target Address field too.

This spec updates [RFC4861] by letting a 6LN advertise a prefix in the Target Address field when the NS or NA message is used for a registration, per Section 5.5 of [RFC8505]. In that case, the prefix length MUST be indicated in the EARO of the NS message, overloading the field that the NA response uses for the Status. (yes it's a lot, but it's clever 😭)

If the 6LN owns at least one IPv6 address derived from the registered prefix with a non-zero interface ID, then it MUST indicate one of these addresses in full in the Target Address field of the NS(EARO) message. Else, it MUST indicate the prefix padded with zeros in the Target Address field 🫶

5. Updating RFC 7400 💖

This spec updates "6LoWPAN-GHC: Generic Header Compression for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)" [RFC7400] by defining a new capability bit for use in the 6CIO. [RFC7400] was already extended by [RFC8505] for use in IPv6 ND messages, so this is the next glow-up ✨

The new "Registration for prefixes supported" (F) flag tells the 6LN that the 6LR:

  1. accepts IPv6 prefix registrations as specified in this document,
  2. will ensure that packets for the addresses that match this prefix will be routed to the 6LNs that registered the prefix, and
  3. will ensure that the route to the prefix will be redistributed if the R flag is set to 1.

Figure 1 shows the F flag in its spot (position 16, counting 0 to 47 in network order in the 48-bit array). Here's the diagram 👑

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |   Length = 1  | Experimental  |X|A|D|L|B|P|E|G|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |F|                         Reserved                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                  Figure 1: New Capability Bit in the 6CIO

New Option Field:

  • F: 1-bit flag, set to 1 to indicate "Registration for prefixes supported"

6. Updating RFC 6550 🧚

[RFC6550] uses the Path Sequence in the Transit Information Option (TIO) to keep only the freshest unicast route and drop stale ones, e.g., when things move around (mobility). [RFC9010] copies the TID from the EARO into the Path Sequence, and the ROVR field into the associated RPL Target Option (RTO). That way you can tell both who registered and what order they registered in, for every single advertisement, so the most recent path and lifetime values are the ones that win 🏆

[RFC9685] requires the ROVR field to indicate the origin of a Target advertisement in RPL DAO messages, as specified in Section 6.1 of [RFC9010]. For anycast and multicast advertisements (in NS or DAO messages), multiple origins may subscribe to the same address. In that case the advertisements from different or unknown origins get merged by the common parent, and that common parent becomes the origin of the merged advertisements and uses its own ROVR value. On the flip side, a parent that passes along an advertisement from a single origin keeps the original ROVR in the propagated RTO, same as for unicast address advertisements, so the origin is still recognized across multiple hops 🦋

This spec updates [RFC6550] to require that, for prefix routes, the Path Sequence is used between and only between advertisements for the same Target and from the same origin (i.e., with the same ROVR value). In that case, only the freshest advertisement is kept. However, the freshness comparison can't apply if the origin isn't determined (i.e., the origin didn't support this spec) 😬

[RFC6550] uses the Path Lifetime in the TIO to show how much time is left for the advertisement to be valid for unicast route determination. A Path Lifetime of 0 invalidates that route. [RFC9010] maps the Address Registration lifetime in the EARO and the Path Lifetime in the TIO so they can be compared when both forms of advertisements show up 💜

The RPL router that merges multiple advertisements for the same prefix MUST use and advertise the longest remaining lifetime across all the origins of the advertisements for that prefix. When the lifetime expires, the router sends a no-path DAO message (i.e., the lifetime is 0) using the same ROVR value as the previous advertisements. That ROVR value refers either to the single descendant that advertised the Target, if there's only one, or to the router itself if there's more than one.

Note that the Registration Lifetime, TID, and ROVR fields also go in the EDAR message, so the state EDAR creates can be compared with the state from an NS(EARO) or a DAO message too. For simplicity, the text below only mentions NS(EARO), but it applies to EDAR as well 🌸

7. Updating RFC 8505 🍓

This spec updates the EARO and EDAR messages so they can register prefixes, and it updates the registration operation for a prefix. It's mainly from the 6LR's point of view, for example to make it possible to register overlapping prefixes 🫧

7.1. New P-Field Value ✨

okay so [RFC9685] gives us a 2-bit P-Field that can be 0 through 2, and it's been holding value 3 in reserve for later 🎀 this spec is the one that finally gives value 3 a meaning, bestie 💅

When the P-Field is set to 3, it's telling you the Registered Address is actually a prefix and not just one single address 🌸 So when a receiver gets an NS(EARO) with the P-Field set to 3, it MUST install a route to the indicated prefix via the source address of that NS(EARO) message. no cap, that's a big deal 😭

This spec assigns the value 3 to the P-Field, so the full set of defined values now looks like this 👑

             +=======+======================================+
             | Value | Meaning                              |
             +=======+======================================+
             | 0     | Registration for a Unicast Address   |
             +-------+--------------------------------------+
             | 1     | Registration for a Multicast Address |
             +-------+--------------------------------------+
             | 2     | Registration for an Anycast Address  |
             +-------+--------------------------------------+
             | 3     | Registration for a Unicast Prefix    |
             +-------+--------------------------------------+

                         Table 1: P-Field Values

7.2. New EARO Prefix Length Field and F flag 🦋

so [RFC8505] Section 4.1 is where the EARO shows up, and it's basically an extension to the ARO option that [RFC6775] defined first 🧚

The Status field only gets used when the EARO is sitting in an NA message. This spec gives that field a second job 💜 when the EARO is in an NS message, the field carries the prefix length instead, as you can see in Figure 2. The prefix length is 7 bits, and the most significant bit of the field is reserved. A 7-bit value of 0 is read as a truncated 128, which means the registration is for an address and not a prefix. This is backward compatible with [RFC8505] and works for both addresses and prefixes, which is giving flexibility 🙌

Next up, this spec adds a new F flag that says the Registered Prefix is topologically correct through the Registering Node 🌈 In other words, the Registering Node relays packets sourced from the Registered Prefix to the outside, following "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing" [BCP38]. The receiver forwards packets to the Registering Node address whenever the source address of those packets derives from the Registered Prefix. Note that to avoid loops, the receiver must be on the inside, so packets the sender sends toward the outside may never reach the receiver 🙈 And "inside" and "outside" are administratively defined. For example, "inside" could be a particular L2 network like an Ethernet fabric 🍓

When the F flag is not set, the Registering Node owns the prefix and will deliver packets to the destination if the destination address derives from that prefix. But if the F flag is set, the Registering Node forwards traffic whose source address derives from the Registered Prefix into a network location (for example, an ISP Provider Edge) where that source address is topologically correct (for example, because it derives from a prefix assigned by that ISP) ✨ The F flag lives in the most significant bit of the EARO Status field whenever that field is carrying a Prefix Length, as shown in Figure 2.

   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     Type      |     Length    |F|Prefix Length|    Opaque     |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |r|C| P | I |R|T|     TID       |     Registration Lifetime     |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
 ...                            ROVR                             ...
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

             Figure 2: EARO Format for Use in NS Messages

New and updated Option Fields:

  • F (Forwarding Flag): A 1-bit flag. When set to 1, it means the sender expects other routers to forward packets to the sender when those packets are sourced from within the registered prefix. 🦋
  • Prefix Length: A 7-bit unsigned integer. When the P-Field is set to 3 and the EARO is included in an NS message, this field MUST contain a prefix length expressed in bits, with a value in the inclusive range of 16 to 120. When the EARO is included in an NA message, this field MUST carry a status value, regardless of the setting of the P-Field. In all other cases, this field is reserved; it MUST be set to zero by the sender and MUST be ignored by the receiver. 🌸
  • r (reserved): A 1-bit reserved field. It MUST be set to zero by the sender and MUST be ignored by the receiver. 💜

7.3. New EDAR Prefix Length Field 💖

This spec adds the new value of 3 to the P-Field to signal that the Registered Address is a prefix 🧚 When that's the case, the prefix is assumed to be at most 120 bits long, padded with zeros up to 120 bits, and the remaining byte holds one reserved bit and the Prefix Length. bestie, it's a tight little byte 🎀

Figure 3 shows the EDAR message when the P-Field is 3. Figure 4 shows the response EDAC message, which has the Status field and the echoed Prefix 🌈

   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     Type      |CodePfx|CodeSfx|          Checksum             |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |P=3| Reserved  |     TID       |     Registration Lifetime     |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
 ...                          ROVR                               ...
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                           Prefix                              +
  |                                                               |
  +              (up to 120 bits, padded with zeros)              +
  |                                                               |
  +                                               +-+-+-+-+-+-+-+-+
  |                                               |r|Prefix Length|
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |   Options ...
  +-+-+-+-+-+-+-+-+-+-+-+-

                 Figure 3: EDAR Message Format with P == 3
   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     Type      |CodePfx|CodeSfx|          Checksum             |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |    Status     |     TID       |     Registration Lifetime     |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
 ...                          ROVR                               ...
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  +                           Prefix                              +
  |                                                               |
  +              (up to 120 bits, padded with zeros)              +
  |                                                               |
  +                                               +-+-+-+-+-+-+-+-+
  |                                               |r|Prefix Length|
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |   Options ...
  +-+-+-+-+-+-+-+-+-+-+-+-

                       Figure 4: EDAC Message Format

New and updated EDAR/EDAC Message Fields:

  • Prefix: A 15-byte field that carries up to 120 bits of the prefix. If the prefix is shorter than 120 bits, the remaining bits MUST be padded with zeros. The receiver MUST treat the padding as zeroed and MUST overwrite any unused bits with zeros before using the prefix. 🎀
  • r (reserved): A 1-bit reserved field. It MUST be set to zero by the sender and MUST be ignored by the receiver. 💜
  • Prefix Length: A 7-bit unsigned integer indicating the length of the prefix in bits. The value MUST be in the inclusive range of 16 to 120. 🌸

Putting the P-Field and the contiguous "Reserved" field into the EDAR message is covered in Section 7.2 of [RFC9685] ✨ Appending ND options to the EDAR and EDAC messages is introduced in Section 3.1 of [RFC8929] 🫶 All other fields work exactly as defined in [RFC8505]. IANA maintains the values for these fields and their RFC references under the "Internet Control Message Protocol version 6 (ICMPv6) Parameters" [IANA.ICMP] registry group 👑

7.4. Updating the Registration Operation ✨

Okay so registration is where things get really fun 💅 With [RFC8505]:

  • A router that expects to reboot may send a final RA message, and then nodes should register elsewhere or redo the registration to the same router when it comes back up 🔄. In all other cases, a node reboot is silent 🤫. When the node comes back to life, existing registration state might be lost if it was not safely stored, e.g., in persistent memory 💀.
  • Only unicast addresses can be registered 🎀.
  • The 6LN must register all its Unique Local Addresses (ULAs) and Global Unicast Addresses (GUAs) with a NS(EARO) 🫶.
  • The 6LN may set the R flag in the EARO to get return reachability services from the 6LR, e.g., through ND proxy operations or by injecting the route in a route-over subnet 🦋.
  • The 6LR keeps a registration state per Registered Address, including an NCE with the Link Layer Address (LLA) of the Registered Node (the 6LN here) 🧚.

Prefix registration works a lot like address registration from the 6LN's point of view, but the router side is a different story 👑. The router keeps a separate state for each origin and merges them into its own advertisements. This spec adds the following behavior, kind of like what [RFC9685] brought in for multicast addresses:

  • The EARO status indicating a "Registration Refresh Request" applies to prefixes too ✨.

This status shows up in asynchronous NA(EARO) messages to tell peer 6LNs that they should reregister all the addresses and prefixes they previously registered with the originating node. The NA message MAY be sent to a unicast or a multicast link-scope address, and SHOULD be contained within the L2 range where nodes may effectively have registered/subscribed to this router, e.g., a radio broadcast domain, so energy and spectrum are saved 🌈.

A device that wants to refresh its state, e.g., after a reboot where it might have lost some registration state, SHOULD send an asynchronous NA(EARO) with this new status value 🔥. That asynchronous NA(EARO) SHOULD go to the all-nodes link-scope multicast address (ff02::1). Target MUST be set to the link-local address this node previously exposed to accept registrations, and the TID MUST be set to 0. The ROVR field MUST be set to all zeros and gets ignored by the receiver 🙈.

In an environment with unreliable transmissions, the multicast NA(EARO) may get resent in a fast sequence, and the TID goes up each time 🔁. A 6LN that recently processed an NA(EARO) indicating a "Registration Refresh Request" ignores any extra NA(EARO) also indicating a "Registration Refresh Request" during that fast sequence 🙅. How long that is depends on the environment and has to be configured. By default, it is 10 seconds ⏱️.

  • Registration for prefixes is now supported 🎉. The value of 3 in the P-Field of the EARO and the EDAR message tells everyone the registration is for a prefix instead of an address. DAD for prefixes and addresses becomes a prefix overlap match 🧩. Whether overlapping addresses and prefixes may be registered is a network policy decision and out of scope 🙅‍♀️. The same prefix can be injected twice (multiple routes) as long as they use the same value of the ROVR 🍓.

Overlaps can actually be super useful 💜. For example, a router or a proxy (see Section 10) might register a prefix or an aggregation while a host using an address from that prefix, or a prefix from that aggregation, also registers its own piece.

When registrations overlap, the longest prefix match wins 👑. So if the network policy allows overlapping registrations, the routes for the registered prefixes get installed towards the node that registered with the longest prefix match, all the way to /128.

  • If the 6LR acts as a border router to external prefixes or owns the prefixes entirely, it SHOULD register all those prefixes on every interface from which it might be needed to relay traffic to that prefix 🌸. It MUST set the P-Field in the EARO to 3 for those prefixes and set the R flag to receive the traffic associated with the prefixes 💖. It MAY skip registering a prefix on one interface if that prefix is already successfully registered on another interface, or if the router handled the EDAR/EDAC flow by itself, so that the prefix ownership is known and validated by the 6LBR 🫧. Also, if the router expects to receive traffic for that prefix on that interface, it needs to make sure the prefix is advertised some other way, e.g., over a routing protocol such as RPL 🦋.
  • The 6LN MAY set the R flag in the EARO to ask the 6LR to redistribute the prefix on other links using a routing protocol 🧚. The 6LR MUST NOT reregister that prefix to yet another router unless loops are avoided some way, e.g., by following a tree structure 🌳.
  • The 6LR and the 6LBR are extended to accept more than one registration for the same prefix, since multiple 6LNs may register it 👯. The ROVR in the EARO uniquely identifies a registration within the namespace of the Registered Prefix 🔑.
  • The 6LR MUST maintain a registration state per tuple (IPv6 prefix, prefix length, ROVR) for all registered prefixes 📋. It SHOULD notify the 6LBR with an EDAR message, unless it determined that the 6LBR is legacy and does not support this specification (see Section 5) 📣. In turn, the 6LBR MUST maintain a registration state per tuple (IPv6 prefix, ROVR) for all prefixes 🧠.

8. Updating RFC 9010 🌷

With [RFC9010]:

  • The 6LR injects only unicast routes in RPL 🛣️.
  • Upon a registration with the R flag set to 1 in the EARO, the 6LR injects the address in the RPL unicast support 💫.
  • Upon receiving a packet directed to a unicast address for which it has an active registration, the 6LR delivers the packet as a unicast L2 frame to the LLA of the node that registered the unicast address 📦.

This specification adds the following behavior:

  • Upon a registration with the R flag set to 1 and the P-Field set to 3 in the EARO, the 6LR injects the prefix in RPL using a prefix RTO. The P-Field in the RTP MUST be set to 3 🍑.
  • Upon receiving a packet directed to an address that derives from a prefix for which it has at least one registration, the 6LR delivers a copy of the packet as a unicast L2 frame to the LLA of exactly one of the nodes that registered to that prefix. It uses the longest prefix match derivation to find the best 6LN 🎯.

9. Updating RFC 8928 🔐

"Address-Protected Neighbor Discovery for Low-Power and Lossy Networks" [RFC8928] was defined to protect the ownership of unicast IPv6 addresses that are registered with [RFC8505] 🛡️.

With Address-Protected Neighbor Discovery (AP-ND) [RFC8928], a node can autoconfigure a pair of public and private keys and use them to sign the registration of addresses that are either autoconfigured or obtained through other methods 🗝️.

The first-hop router (the 6LR) can then validate a registration and perform source address validation on packets coming from the sender node (the 6LN) ✅.

Since multiple nodes may register the same prefix, the method specified in [RFC8928] cannot be used with node-local autoconfigured keypairs, which only protect a single ownership 🙃.

For a prefix, just like for an anycast or a multicast address, it is still possible to use AP-ND [RFC8928] to enforce the right to register 💅. If AP-ND [RFC8928] is used, a keypair MUST be created and associated with the prefix before the prefix is deployed, and a ROVR MUST be generated from that keypair as specified in [RFC8928]. The prefix and the ROVR MUST then be installed in the 6LBR at the first registration, or by an external mechanism such as IP Address Management (IPAM) or DHCPv6 snooping before the first registration. That way, the 6LBR can recognize the prefix in future registrations and validate the right to register based on the ROVR 🧾.

The keypair MUST then be provisioned in each node that needs to register the prefix or a prefix within it, so the node can follow the steps in [RFC8928] to register the prefix 🔑✨.

When an NA message with the status set to 5 "Validation Requested" comes in, the node that registered the address or prefix performs the proof of ownership based on that longest prefix match 🕵️‍♀️.

10. Updating RFC 8929 🧚‍♀️

"IPv6 Backbone Router" [RFC8929] defines a proxy operation where a 6LoWPAN Border Router (6LBR) can impersonate a 6LN when doing an address registration 🎭. In that case, [RFC8505] messages are used as-is, with one change: the SLLAO in the proxied NS(EARO) messages indicates the Registering Node (the 6LBR) instead of the Registered Node (the 6LN). You can see Figure 5 of [RFC8929] for an example of proxy operation by the 6LBR, which generates an NS(EARO) upon receiving an EDAR message 📸.

This specification updates that proxy operation with the updates in [RFC9685] and defines the formats and content of the EARO, EDAR, and EDAC messages so they can support the P-Field and the signaling of prefixes 🌈. The proxy MUST use the P-Field as received in the EDAR or NS(EARO) message to generate the proxied NS(EARO). It MUST also use the exact same prefix and prefix length as received when it's a prefix registration 💯.

11. Security Considerations 🚨

This specification updates [RFC8505], and the security considerations of that document also apply to this document. In particular, the link layer SHOULD be sufficiently protected to prevent rogue access. Otherwise, a rogue node with physical access to the network may inject packets and launch an attack from inside 😱💀. Bestie, this is serious!

Section 9 leverages AP-ND [RFC8928] to stop a rogue node from registering a unicast address it does not own 🛑. The mechanism could be extended to anycast and multicast addresses if the values of the ROVR they use are known in advance, but how to do that is not in scope for this specification 🙈. One way would be to authorize the ROVR of the valid users in advance. A less preferred way could be to synchronize the ROVR and TID values across the valid registering nodes as preshared key material 🫠.

In the latter case, it could be possible to update the keys associated with a prefix in all the 6LNs. But the flow is not clearly documented and may not complete in time for all nodes in LLN use cases 😭. It may be simpler to install an all-new address with new keys over a period of time, then switch the traffic to that address once the migration is complete 🦋.

12. Operational Considerations 🌸

12.1. Partially Upgraded Networks 🌸

Okay so devices can totally coexist while offering different levels of support 🫶. A device might do only [RFC8505], or both [RFC8505] and [RFC9685], or those two plus this specification. Here's what can happen:

  • A legacy 6LN will not register prefixes, and the service will be the same when the network is upgraded. 💅
  • A legacy 6LR will not set the F flag in the 6CIO, and an upgraded 6LN will not register prefixes with that router. It may still do so with other 6LRs that support this specification. 🦋
  • Upon an EDAR message, a legacy 6LBR may not realize that the address being registered comes with a whole prefix, so it might return that it is duplicate in the EDAC status. The 6LR MUST ignore a duplicate status in the EDAR for prefixes. 🙈

12.2. Application to RPL-Based Route-Over LLNs 🍓

This specification also updates [RFC6550] and [RFC9010] for a route-over multilink subnet based on the RPL routing protocol. The goal is to add multicast ingress replication in Non-Storing Mode and anycast support in both Storing and Non-Storing modes. A 6LR that implements the RPL extensions specified therein MUST also implement [RFC9010]. 🔥

Figure 5 shows the classic setup: an LLN as a single IPv6 subnet, with a 6LoWPAN Border Router (6LBR) that acts as the Root for RPL operations and as the Address Registrar for 6LoWPAN ND. 👑

         .- -- .
      .-(        ).
     (   Internet   )
    (___.________.___)
              |
   ---+-------+--
      |
    +--------+
    |  6LBR  |
    | (Root) |
    +--------+
    o   o  o  o
      o   o  o
 o  o  o       o  o  o
 o  o  o  LLN   o   +-------+
   o  o          o  |  6LR  | RPL Router
   o o    o   o     +-------+
   o  o    o  o          +-------+  RPL
          o              |  6LN  |  leaf
                         +-------+  L

  o : LLN node

                  Figure 5: RPL-Based Route-Over LLN

A RPL leaf L acting as a 6LN registers its addresses and prefixes with a RPL router acting as a 6LR. It does this using a L2 unicast NS message carrying an EARO, as specified in [RFC8505] and [RFC9685]. A RPL leaf acting as a 6LN can still be a border router for another routing protocol, an access router for an IP link, or a virtual router serving virtual machines or applications within the same physical node. ✨ A RPL-aware leaf would preferably use RPL directly to inject routes, so it can fully leverage the routing protocol. 🧚

The Registering Node (the 6LN) periodically renews the registration state, before the lifetime indicated in the EARO expires at the 6LR. For unicast IPv6 addresses, the 6LR uses an Extended Duplicate Address Request/Confirmation (EDAR/EDAC) exchange with the 6LBR to tell the 6LBR about the listeners. 💜 With this specification, a router that owns a prefix or provides reachability to an external prefix, but is not a RPL router, can also register those prefixes with the R flag set. That lets the prefix be reachable within the RPL domain. 🌈

A shared link is a situation where more than one prefix is deployed over an L2 link. Think a switched Ethernet fabric, or a Wi-Fi Extended Service Set (ESS) that federates multiple Access Points (APs). Not every node has to know every prefix. 🫠 Figure 6 shows this, with two routers, 6LR1 and 6LR2, that own the prefixes P1:: and P2:: and advertise them in their RA messages over the same link. The shared link may be run with any combination of NDP and SND, as discussed in Section 7 of [IPv6-over-NBMA]. 💅

         .- -- .
      .-(        ).
     (   Internet   )
    (___.________.___)
          |
     +----+--+          +-------+
     | P1::a |          | P2::b |
     | 6LR1  |          | 6LR2  |
     +---+---+          +---+---+
         |                  |
  ----+--+------+---------+-+-------+---------+----
      |         |         |         |         |
   +--+--+   +--+--+   +--+--+   +--+--+   +--+--+
   |P1::c|   |P2::d|   |P2::e|   |P1::f|   |P1::g|
   +-----+   +-----+   +-----+   +-----+   +-----+

                        Figure 6: Shared Link

Say that 6LR1 is the router providing access to the outside, and 6LR2 sees 6LR1 as its default gateway. With this specification, 6LR2 registers P2:: to 6LR1, and 6LR1 installs a route to P2:: via 6LR2. That way, addresses derived from P2:: can still be reached via 6LR1 and then 6LR2. 🎀 6LR2 may then use ICMP Redirect messages [RFC4861] to shorten the path between 6LR1 and the nodes that own those addresses. ⭐

If 6LR1 delegated P2, for example using DHCPv6 [RFC9915], then the expectation is that 6LR1 aggregates P1:: and P2:: in its advertisements to the outside. In that case there's no need to set the R flag. 🙌 Still, unless 6LR2 knows about this situation (say, through configuration), 6LR2 SHOULD set the R flag to ask 6LR1 to advertise P2:: so it can get reachability. 🥺

A hub link is a situation where stub links are deployed around a backbone and interconnected by routers. Figure 7 shows this: one router, 6LR1, serves the hub link, and at least one router like 6LR2 or 6LR3 provides connectivity from the stub links to the hub link. In this example, there's one prefix on each link. P1:: is on the hub link, and P2:: and P3:: are on the stub links. 🌸

   +-----+   +-----+   +-----+       +-----+
   |P2::s|   |P2::d|   |P2::e|       |P2::f|
   +--+--+   +--+--+   +--+--+       +--+--+
      |         |         |             |
  ----+----+----+---------+--STUB-LINK--+-----
           |
       +---+---+              +-------+
       | P2::r |              |       |        .- --..
       | 6LR2  |              | 6LR1  +---- .-(       ).
       | P1::b |              | P1::a |   (   Internet  )
       +---+---+              +---+---+  (___._______.___)
           |                      |              |
  -------+-+---------+--HUB-LINK--+-----+--      |
         |           |                  |        |
     +---+---+    +--+--+           +---+---+    |
     | P1::c |    |P1::n|           | P1::q |    |
     | 6LR3  |    +-----+           | 6LR4  +----+
     | P3::m |                      | P3::a |
     +---+---+                      +---+---+
         |                              |
  ----+--+------+---------+--STUB-LINK--+-+-----
      |         |         |               |
   +--+--+   +--+--+   +--+--+         +--+--+
   |P3::h|   |P3::i|   |P3::j|         |P3::k|
   +-----+   +-----+   +-----+         +-----+

                       Figure 7: Hub and Stubs

As before, say that 6LR1 is the router providing access to the outside, and 6LR2 sees 6LR1 as its default gateway. With this specification, 6LR2 registers P2:: to 6LR1, and 6LR1 installs a route to P2:: via 6LR2. That way, nodes on the stub link behind 6LR2 that derive their addresses from P2:: can still be reached via 6LR1 and then 6LR2. The same goes for 6LR3 and any other routers serving stub links. 🦋

If 6LR1 delegated P2, then the expectation is that 6LR1 aggregates P1:: and P2:: in its advertisements to the outside, and there's no need to set the R flag. 💖 Still, unless 6LR2 knows about this (say, through configuration), 6LR2 SHOULD set the R flag to ask 6LR1 to advertise P2:: so it can get reachability. 🫶

In this example, 6LR3 and 6LR4 both connect to the same stub link where subnet P3 is installed. They may both register P3 to 6LR1, and 6LR1 will apply its own load-balancing logic to pick either of the routers. 🎀✨

13. IANA Considerations 🌈

IANA has made changes under the "Internet Control Message Protocol version 6 (ICMPv6) Parameters" [IANA.ICMP] and the "Routing Protocol for Low Power and Lossy Networks (RPL)" [IANA.RPL] registry groups, as follows. 💅

13.1. Updated P-Field Registry 🧚

This specification updates the P-Field introduced in [RFC9685] to assign the value 3. That's the only remaining unassigned value for the 2-bit field, so it's a big deal 👑. To that effect, IANA has updated the "P-Field Values" registry in the "Internet Control Message Protocol version 6 (ICMPv6) Parameters" registry group, as shown in Table 2:

      +=======+===================================+===========+
      | Value | Meaning                           | Reference |
      +=======+===================================+===========+
      | 3     | Registration for a Unicast Prefix | RFC 9926  |
      +-------+-----------------------------------+-----------+

                      Table 2: New P-Field Value

13.2. New 6LoWPAN Capability Bit 🍓

IANA has made an addition to the "6LoWPAN Capability Bits" [IANA.ICMP.6CIO] registry in the "Internet Control Message Protocol version 6 (ICMPv6) Parameters" registry group, as shown in Table 3:

IANA has also fixed the description of bit 9 (the "A" flag defined in [RFC8928]). It's not called "1" but "A", and that's the whole tea ☕.

  +=====+=============================================+===========+
  | Bit | Description                                 | Reference |
  +=====+=============================================+===========+
  | 9   | AP-ND Enabled (A bit)                       | [RFC8928] |
  +-----+---------------------------------------------+-----------+
  | 16  | Registration for prefixes supported (F bit) | RFC 9926  |
  +-----+---------------------------------------------+-----------+

                 Table 3: New 6LoWPAN Capability Bit

14. Normative References ✨

okay bestie, these are the must-read docs 📚 the spec leans on them, so they're not optional homework 🫶

15. Informative References 🦋

these ones are the extra reading, the "ooh tell me more" list 🌈

Acknowledgments 💖

the people who helped make this happen are literal legends 👑 huge thanks to Dave Thaler and Dan Romascanu for their early reviews, Adnan Rashid for all his contributions, and Éric Vyncke for his in-depth AD review 🫶 and a big group hug for the reviewers of the IETF Last Call and IESG rounds: Dan Romascanu, Shuping Peng, Mohamed Boucadair, Paul Wouters, Ketan Talaulikar, Gunter Van de Velde, Mike Bishop, and Roman Danyliw 🌸

Author's Address 🎀

Pascal Thubert (editor)
06330 Roquefort-les-Pins
France
Email: pascal.thubert@gmail.com
📦 where this page comes from