What is NDP?

NDP (Neighbor Discovery Protocol) is how IPv6 devices on a link find each other's MAC addresses, discover routers and check their addresses are unique.

Defined in RFC 4861, NDP does the job of IPv4's ARP and several other mechanisms, all with ICMPv6 messages. There are five:

• Neighbor Solicitation and Neighbor Advertisement (types 135 and 136) resolve an IPv6 address to a link-layer address, and also confirm that a neighbour is still reachable.
• Router Solicitation and Router Advertisement (133 and 134) let hosts find routers, learn the on-link prefixes and configure addresses with SLAAC.
• Redirect (137) tells a host a better first hop for a destination.

Instead of broadcasting like ARP, address resolution uses a solicited-node multicast group derived from the last 24 bits of the target address, so only a few hosts have to look at each query. Before using a new address, a host runs Duplicate Address Detection: it sends a Neighbor Solicitation for its own address and only keeps it if nobody answers. NDP packets are sent with a hop limit of 255 and receivers reject anything lower, so they can't come from off the link.

On Linux, NDP entries appear alongside ARP entries in the neighbour table (ip -6 neigh), with the same states such as REACHABLE and STALE. The commonest NDP problem is a firewall that drops ICMPv6 on a router's input: neighbours then can't resolve each other or hear Router Advertisements, and IPv6 quietly stops working. NDP has no built-in authentication, so anyone on the link can send forged advertisements; switches offer protections such as RA Guard for that. The IPv6 on VyOS lesson sets up Router Advertisements and the firewall rules NDP needs.