The ARP process in IPv6

[emanuele]

In IPv6, the IPv4 ARP process has been replaced by something called Neighbor
Discovery.

With IPv4, ARP has an ethernet protocol ID of 0x0806 and IPv4 has a protocol ID
of 0x0800. With IPv6 both the Neighbor Discovery function and regular IPv6
packets have the same protocol ID - 0x86dd. There is then no way to tell
without looking at the higher layers if the traffic is Neighbor Discovery
traffic or regular IPv6 unicast/multicast/anycast traffic.

So, now that we know Neighbor Discovery replaces ARP, lets go through a simple
example showing how it works and the addresses involved.

Here is the topology we will use for the example:

PC1---eth---switch---eth---PC2

The network here is all ethernet, but it could be any Layer 2 medium that
transports ethernet (1483 bridged, LANE, PWE3 etc).

So, assuming no communication has already taken place, we will start a ping
from PC1 to PC2.

PC1 = 2000::1/64
PC2 = 2000::2/64

What happens first is PC1 needs to discover the MAC address of PC2 because the
medium is Ethernet.

PC1 sends out a Neighbor Solicitation packet that looks like this:

----Ethernet Packet----
Source MAC = 00:00:00:00:00:01
Destination MAC = 33:33:FF:00:00:02
Ethernet Protocol ID = 0x86DD

----IPv6 Packet----
IPv6 Next Header = 58 (ICMPv6)
Source IPv6 address = 2000::1
Destination IPv6 address = FF02::1:FF00:2

----ICMPv6 Packet----
Type = 135 (Neighbor Solicitation)
Target Address = 2000::2
Link Layer Address = 00:00:00:00:00:01

Ok, so a few things to explain here. First, where is the destination MAC
address coming from? Well, the 33:33:ff section is reserved for the Neighbor
Discovery process and the 00:00:02 section is an extrapolation of the IPv6 address
(low order 24 bits of the IPv6 address).

Next, where is the destination IPv6 address coming from? This is a special
address which denotes all hosts on the network (FF02::1 - same L2 segment) and
again an extrapolation of the destination IPv6 address (00:2). For example, you
could ping6 FF02::1 and all hosts on that LAN would respond.

Next is the actual ICMPv6 packet and its' contents. The target address is
obvious - it's the destination IPv6 address you're trying to reach. The Link
Layer Address is the local source MAC address.

So, now that we have all the information needed to originate the Neighbor
Discovery process, we will look at the Neighbor Advertisement reply.

Once PC2 receives the Neighbor Solicitation and recognizes his IPv6 address he
must reply with a Neighbor Advertisement packet. This is what it looks like:

----Ethernet Packet----
Source MAC = 00:00:00:00:00:02
Destination MAC = 00:00:00:00:00:01
Ethernet Protocol ID = 0x86DD

----IPv6 Packet----
IPv6 Next Header = 58 (ICMPv6)
Source IPv6 Address = 2000::2
Destination IPv6 Address = 2000::1

----ICMPv6 Packet----
Type = 136 (Neighbor Advertisement)
Sent in *response* to Neighbor Solicitation bit = 1 (true)
Target Address = 2000::2
Link Layer Address = 00:00:00:00:00:02

Here you can see the Unicast Source and Destination MAC address again with the
Protocol ID of 0x86DD. The rest of the information is self explanitory.

The third and fourth packets of the process are the Ping request and Ping reply.

Ping request:

----Ethernet Packet----
Source MAC = 00:00:00:00:00:01
Destination MAC = 00:00:00:00:00:02
Ethernet Protocol ID = 0x86DD

----IPv6 Packet----
IPv6 Next Header = 58 (ICMPv6)
IPv6 Source Address = 2000::1
IPv6 Destination Address = 2000::2

----ICMPv6 Packet----
Type = 128 (Echo Request)

Ping reply:

----Ethernet Packet----
Source MAC = 00:00:00:00:00:02
Destination MAC = 00:00:00:00:01
Ethernet Protocol ID = 0x86DD

----IPv6 Packet----
IPv6 Next Header = 58 (ICMPv6)
IPv6 Source Address = 2000::2
IPv6 Destination Address = 2000::1

----ICMPv6 Packet----
Type = 129 (Echo Reply)

And thats it! The fields I've outlined are the main ones, but there are a
couple others. In a normal default situation, the above fields should be the
only relevant ones.

The last thing we should cover is what a valid Neighbor Cache looks like.
Depending on the OS, the command to display the cache might look different.

Basically, after a successfull Neighbor discovery process, you should have
something like this:

C:\IPv6Kit>ipv6 nc
3: 2000::1 00-00-00-00-00-01 reachable (30000ms) (router)

This example shows Index 3 having IPv6 address 2000::1 using MAC address
00:00:00:00:00:01, is reachable (valid) and has a refresh time of 30 seconds.
2000::1 also happens to be acting as a router in this case (the router bit is
set in the Neighbor Discovery process).