Neighbor Discovery Protocol (NDP) – what is it?

Any device that uses the Neighbor Discovery Protocol for network communications manages its’ own neighbor cache. In this, all devices of the known network are listed and can be verified by their unique device addresses (MAC). Here you can see whether the buffered address belongs to a simple client or, for example, to a router. However, the neighbor cache is not a standalone, but one of four buffers carrying out the functions of the NDP protocol. The other three components, which are also handled by each device separately, are as follows:

• Destination cache: The ‘target’ cache includes entries about all hosts on the network, which have already been sent data packets. Each of these entries, in turn, refers an address link in the neighbor cache which should be used as the next hop (intermediate station) when sending data packets to the desired destination host.
• Prefix cache: The prefix cache, or prefix list is used to manage all prefixes that apply to the network where the client resides. This listing is necessary, on the one hand, because IPv6 supports multi-homing – i.e. the accessibility of the network via two different providers – and on the other hand, allows the address space to be split into different prefixes. By using the entries in the prefix cache, NDP ensures that the target host is on the same subnet. Each prefix, except for the MAC address (also, link layer address), has a defined validity period so that the cache always remains up to date.
• Default Router List: The default router list includes all known routers that regularly contact the device. Only active routers are listed because the expiration date is automatically defined for all representatives. An extension or refresh is only possible if the router is returned.

In order to create different caches for the NDP, a different internet protocol is used, which is known as ICPMv6 (Internet Control Message Protocol for the Internet Protocol Version 6).

ICMPv6 is commonly used in the current version of the internet protocol family as a relay for error and information messages, and it is also used by the Neighbor Discovery Protocol in the form of 5 different types of ICMPv6. Depending on the type, certain notifications are used – these help to form temporary storage or lists.

This type of message therefore has a standard length of 128 bits, with additional bits for options. Valid options include the routers’ MAC address, the ‘Maximum Transmission Unit’ and all relevant prefix information.

The ‘type’ field is set to 134 and the ‘code’ field are always set to 0. That is followed by a 16-bit ICMP checksum and an 8-bit length specification of the hop limit, which may include the stations recommended by the router.

After that follow single bits, which provide insight into:

• Whether IP addresses can be obtained via dynamic DHCPv6 (M)

• And whether other address information can be obtained via dynamic DHCPv6 (O).

The ‘reserved’ field remains unused and is ignored by the recipient. In addition, the router advertisement contains figures about:

• The time in seconds that the router should remain in the default router list (router lifespan, 16-bit integer, maximum 65535).

• The time in milliseconds that an address in the neighbor cache should still be available after reaching availability (availability time-out, 32-bit integer, maximum of approximately 50 days).

• The time in milliseconds after which a neighbor solicitation message (see below) should be resent (resolution time-out, 32-bit integer).

The default configuration of an NDP-ICMPv6 type 133 message thus provides a minimum length of 64 bits. ‘Type’ is assigned the router solicitation value 133, while ‘Code’ is set to 0 again. The two other mandatory fields are the ICMP checksum (16 bits) and a 32-bit long ‘Reserved” field, which remains unused.

The only possible option that can be attached to the message is the MAC address of the sender.

Like all ICMPv6 message types, neighbor solicitations starts with 8-bit type identification – in this case, ‘type’ has the value 135. This is followed by the 8-bit long code, which is set to 0, and the 16-bit checksum. The ‘Reserved’ field remains unused, as with the previously presented messages.

With 128 bits, the targeted IP address which cannot be a multicast address, makes the bulk of the message, with a total length of at least 192 bits. This type of message, which is decisive for the Neighbor Discovery Protocol, also allows the MAC address of the sender as an optional additional specification.

With a minimum length of 320 bits, redirects are the largest ICMPv6 messages that are relevant to how the Neighbor Discovery Protocol functions. The typical structure with bit strings for the type identification (137), the code (0), the checksum and an unused “reserved” field (32 bits) are followed by the address of the recommended hops and then the address for which both of these redirections are recommended (both 128 bits). Optionally, the message packet may include the destination’s MAC address, as well as the header of the redirected packet.

There is a lot to the caching mechanisms and communications of the Neighbor Discovery Protocol in conjunction with the Internet Control Message Protocol. The following NDP scenarios illustrate the interplay and functionality of the two protocols:

• Detecting the router and network prefix: All routers in a network routinely broadcast router advertisements via multicast to all network operators. These include, among other things, information like the address, network prefix and routing used to create the default router list, as well as the prefix list. These clients are then used to determine the default gateway and subnet mask. Since all entries have only a limited validity period, only active routers remain. The router advertisements can also be enforced using router solicitations.

• Determining important parameters for packet transmission: Router advertisements can also optionally contain information about which parameter the participating clients have to apply when delivering packets. This can be very specific information, such as the maximum packet size, but also broad internet parameters, such as the fixed limit of intermediate stations for outgoing packets.

• Identifying the next hop: If a packet is being sent, the NDP protocol ensures that the destination cache already contains a corresponding entry for the targeted destination host. If this is not the case, the protocol determines the next intermediate station using the information from the prefix list and the default router list. Subsequently, the new state of knowledge is stored in the destination cache, which is immediately available when a new request is made. If the newly created entry does not already have an equivalent in the neighbor cache, this is automatically generated and then the address resolution is initiated.

• Resolving the IP address in the MAC address: In order to determine the MAC address of a specific host in the network, it receives a neighbor solicitation via IPv6 multicast to its own specific multicast address. Only the host can respond to this unique address combination. It sends a neighbor advertisement in response with the MAC address stored by the output client in the neighbor cache. The Neighbor Discovery Protocol is thus used to identify neighbors, as well as to determine routers.

• Detecting negligence of a neighbor: All MAC addresses stored in the neighbor cache must be regularly checked for their relevance. As long as TCP/IP data or receipts are sent from a registered address, this is logically considered to be active and the host hiding behind it can be reached. If there has not been a data exchange with the relevant device for a long time, and the entry’s validity period has expired, this is marked as outdated. To check whether the respective host is no longer accessible, an ordinary data packet is sent to the registered address first. If an answer returns, one final test is started via Unicast neighbor solicitation. If this confirms non-availability, the entry from the neighbor cache disappears.

• Detecting duplicate addresses: If a device has auto-configured an address, NDP classifies it as ‘tentative’ (temporary).  For this purpose, the newly connected network client sends a neighbor solicitation to the temporary address that he wants to use himself – with a temporarily unspecific sender address. If another host is already using the address, they respond with a neighbor advertisement message to the general multicast address. The checking client also receives this message, which suggests a new address.

• Informing about redirect options: The Neighbor Discovery Protocol gives routers with the redirect message the ability to optimize the path from data packets to the targeted hosts. As noted above, they can use ICMPv6 type 137 to make recommendations for more appropriate intermediate stations that are included in the destination cache.

Whether Windows, MacOS, Linux, iOS or Android – modern operating systems support IPv6 and are able to access the possibilities of NDP in ethernet-based networks. By using the appropriate instruction, you can use the command line at any time to call the neighbor cache that was created for your device.

In Windows for example, you can list your network neighbors using the netsh (network shell) program and the following command:

With most Linux distributions, you can access the neighbor cache using the iproute2 tool and this command: