IPv6 Neighbor Discovery

IPv6 uses Neighbor Discovery instead of ARP. It is built on ICMPv6 and handles several related jobs on a local link: finding link-layer addresses, finding routers, learning prefixes, and checking that neighbors are still alive.

Neighbor Solicitation and Neighbor Advertisement messages discover link-layer addresses and test whether neighbors remain reachable. They do the job ARP does for IPv4: “who has this address, and what’s your MAC?”

Router Advertisements tell hosts about routers and network prefixes. Your machine listens for them and can configure itself from what it hears, with no DHCP server involved.

Look at your neighbor cache

Your system keeps the results in a neighbor table, just like the IPv4 ARP cache:

ip -6 neighbor

fe80::9e53:22ff:feaa:41e dev eth0 lladdr 9c:53:22:aa:04:1e router REACHABLE
2a01:e0a:4f2:1::1 dev eth0 lladdr 9c:53:22:aa:04:1e STALE

REACHABLE means the entry was confirmed recently. STALE means it’s remembered but unverified — the next packet will trigger a fresh check. The router flag marks a device that sent Router Advertisements. On macOS, ndp -an shows the same table.

You can populate the cache by pinging the all-nodes multicast address on your link:

ping6 -c 2 ff02::1%eth0

Every IPv6 device on the link may answer. On macOS use your interface name, such as ff02::1%en0. The %eth0 part is the zone identifier: link-local addresses exist on every link, so you must say which one you mean.

Multicast, not broadcast

IPv6 uses multicast for these exchanges rather than Ethernet-wide ARP broadcasts. A Neighbor Solicitation goes to a small computed multicast group, so most machines on the LAN never process it. This is one of the quiet efficiency wins of IPv6.

A host also performs Duplicate Address Detection before relying on a new address: it solicits its own tentative address, and silence means the address is free to use.

Don’t firewall ICMPv6 away

Do not block all ICMPv6 as a generic security measure. IPv6 depends on specific ICMPv6 messages for normal local operation and path feedback. A machine that can’t send or receive Neighbor Discovery messages can’t find its router or its neighbors — the result looks like a dead network with a cable that’s clearly plugged in. If IPv6 works for a minute and then dies, check whether a firewall rule is eating Neighbor Discovery or Router Advertisements.