Neighbor Discovery and ICMPv6

From ARP thinking to ND thinking

On IPv4, when a host knows a neighbor’s IP but not its MAC, it sends an ARP request (Ethernet broadcast) and installs an ARP cache entry from the reply. IPv6 removes ARP entirely for IPv6 next-hop resolution. The replacement is Neighbor Discovery (ND), defined to run over ICMPv6 and to use multicast (not broadcast) on the local link.

H12-811 items test the mapping:

If you remember only one sentence: ND replaces ARP; ICMPv6 carries ND; there is no IPv6 broadcast.

ICMPv6 is not “optional”

ICMPv6 is the control companion protocol for IPv6. It still has error messages (destination unreachable, packet too big, time exceeded, parameter problem) and informational messages (echo request/reply). Critically for this section, ND message types are ICMPv6 messages. Blocking “all ICMP” the way some IPv4 firewall habits did can break IPv6 neighbor resolution, path MTU discovery, and router discovery.

For HCIA depth you must:

• Recognize that ND uses ICMPv6.
• Name the four ND message roles: NS, NA, RS, RA.
• Know DAD relies on NS/NA before an address is considered unique.
• Contrast ND with ARP without inventing “IPv6 ARP.”

You do not need to memorize every ICMPv6 type number for day-to-day HCIA, but you do need the functional story.

Neighbor Solicitation and Neighbor Advertisement

Neighbor Solicitation (NS)

A node sends NS when it needs the link-layer address of an on-link IPv6 neighbor, or when performing DAD. Conceptually:

1. Node A wants to send to on-link unicast B (2001:db8:1::20) but has no neighbor cache entry for B’s MAC.
2. A sends NS asking “Who has this target address?” toward the appropriate solicited-node multicast for B (not a LAN-wide broadcast).
3. B answers with NA containing its link-layer address.
4. A caches the binding in the neighbor cache (IPv6 analog of the ARP table).

Neighbor Advertisement (NA)

NA announces or answers with link-layer information:

• Solicited NA — reply to NS (resolution complete).
• Unsolicited NA — may announce a change (for example, MAC change) so neighbors can update caches.

Neighbor cache vs ARP table

On dual-stack Huawei devices you still have IPv4 ARP, but IPv6 neighbors live in ND/neighbor tables. Verification family (names vary slightly by version):

<Huawei> display ipv6 neighbors
<Huawei> display ipv6 interface GigabitEthernet0/0/0

Symptoms that scream ND problems:

• Ping to an on-link IPv6 host fails while addresses look correct.
• Neighbor entry incomplete/missing while the host is up.
• Layer 2 issues (VLAN mismatch, port blocked) prevent multicast ND from completing—same class of fault as ARP failure, different protocol.

Router Solicitation and Router Advertisement

Hosts need more than neighbor MAC resolution. They need to learn default routers, on-link prefixes, and flags that control address autoconfiguration. That is the RS/RA pair.

Router Solicitation (RS)

A host coming online (or refreshing) can send RS to ask routers on the link to advertise immediately rather than waiting for the next periodic RA. Destination is commonly the all-routers multicast FF02::2.

Router Advertisement (RA)

Routers periodically—and in response to RS—send RA to all-nodes multicast FF02::1 (and may unicast in some cases). RA content is the control plane of the link for SLAAC and default-router selection:

Exact flag combinations drive the next section’s SLAAC vs stateful vs stateless DHCPv6 decision tree. For this section, lock the messages: RS asks; RA informs; routers listen on FF02::2; nodes listen on FF02::1.

Default gateway without “IPv4-style DHCP only”

In many pure SLAAC designs, the default router is learned from RA, not from a DHCPv6 option. That is a major mental shift from IPv4 campus templates where DHCP often hands out gateway + mask + DNS together. IPv6 can split the jobs: ND/RA for router and prefix, DHCPv6 for DNS only (stateless), or DHCPv6 for addresses too (stateful).

Duplicate Address Detection (DAD)

Before an IPv6 address is considered safe to use as a preferred source, the node typically performs DAD:

1. The address is tentative.
2. The node sends NS for its own tentative address (nobody else should answer).
3. If an NA is received claiming that address, a duplicate exists—the node must not use it.
4. If no conflicting NA arrives, the address can become preferred/valid per policy.

DAD is why “plug two static same IPv6 addresses on one VLAN” can fail differently than IPv4—you should expect detection and refusal rather than silent dual use. Exam language: DAD uses Neighbor Solicitation (with Neighbor Advertisement if a conflict exists).

Solicited-node multicast (why ND is efficient)

Instead of waking every host with a broadcast for every resolution, IPv6 maps each unicast address to a solicited-node multicast address in FF02::1:FFxx:xxxx derived from the last 24 bits of the unicast address. Only hosts that share those last 24 bits join that group—dramatically fewer listeners than FF02::1 for every resolution. HCIA may not force you to compute the group by hand every time, but it may ask why ND uses multicast or what FF02::1 / FF02::2 mean.

Redirects and on-link determination (exam-aware sketch)

ND also includes Redirect messages: a router can tell a host “for this destination, use a better next hop on-link.” Hosts also use RA prefix information to decide what is on-link versus what must be sent to a default router. If a host mistakenly thinks a remote destination is on-link, it will NS for a remote address and fail—classic dual-stack troubleshooting pattern when prefixes/flags are wrong.

Huawei operational notes

For HCIA you primarily understand ND behavior and verify neighbors; deep ND timer tuning is beyond typical associate items. Still, link the earlier addressing section:

• Without ipv6 enable and a usable link-local, ND cannot operate on that interface.
• RA generation is a router behavior on the link—hosts alone do not make other hosts learn a default gateway via RA.
• When static routing uses a link-local next hop, the next hop must be resolvable via ND on the correct outbound interface.

Useful displays:

<Huawei> display ipv6 interface brief
<Huawei> display ipv6 neighbors
<Huawei> display ipv6 routing-table

If neighbors never complete, check VLAN/L2, IPv6 enablement, ACLs that drop ICMPv6, and whether you are testing the wrong address type (link-local vs GUA).

Packet walk: first IPv6 frame to an on-link host

1. Host A has GUA 2001:db8:1::10/64; Host B has 2001:db8:1::20/64 on the same VLAN.
2. A determines B is on-link (same prefix from configuration/RA).
3. A checks neighbor cache—miss.
4. A sends NS to B’s solicited-node multicast; B replies NA with its MAC.
5. A encapsulates the IPv6 packet in Ethernet to B’s MAC and sends.

No ARP. No ff:ff:ff:ff:ff:ff IPv4-style ARP broadcast for that resolution.

Packet walk: host finds a default router

1. Host boots, enables IPv6, configures link-local, runs DAD on link-local.
2. Host sends RS to FF02::2.
3. Router answers RA to FF02::1 with prefix 2001:db8:1::/64, lifetime, and flags.
4. Host may SLAAC an address, runs DAD on that address, installs default route via the advertising router’s link-local.
5. Later traffic to off-link destinations uses that default router; hop-by-hop L2 resolution to the router again uses NS/NA.

Exam traps for ND and ICMPv6

• “IPv6 still uses ARP for MAC resolution.” False.
• “IPv6 uses broadcast for neighbor discovery.” False—multicast.
• Confusing NS/NA (neighbor L2 resolution / DAD) with RS/RA (router and prefix discovery).
• Thinking DAD is a DHCPv6-only feature—DAD applies to addresses from SLAAC, static, and often DHCPv6 assignment before use.
• Blocking ICMPv6 completely and expecting ND and PMTU to keep working.
• Mixing FF02::1 (all-nodes) with FF02::2 (all-routers).
• Expecting RA to assign DNS by itself in every design—DNS may need stateless DHCPv6 (next section).

Mastery checklist

• Map ARP → NS/NA; map gateway discovery → RS/RA.
• Explain DAD in one short paragraph with NS/NA.
• Name FF02::1 and FF02::2 roles in ND.
• State that ND messages are ICMPv6 and that IPv6 has no ARP/broadcast ND.

Next, connect RA flags and host behavior to SLAAC, stateful DHCPv6, and stateless DHCPv6—the exam’s three-way configuration model.