IPv6 Neighbour Discovery, SLAAC and DHCPv6: how IPv6 hosts get addresses

Neighbour Discovery replaces ARP

IPv6 has no ARP and no broadcast. Instead the Neighbour Discovery Protocol (NDP) uses five ICMPv6 messages sent to multicast addresses. This is one reason you must never block ICMPv6 wholesale on an IPv6 network: basic connectivity depends on it.

To avoid disturbing every host, an NS goes to the target's solicited-node multicast address: ff02::1:ff followed by the last 24 bits of the target address. For 2001:db8::a1:b2c3 that is ff02::1:ffa1:b2c3. Only hosts whose addresses end the same way listen to it, so the "who has" question reaches almost nobody else.

SLAAC step by step

1. The host creates a link-local address in fe80::/10 as soon as the interface comes up. It works on the local link only and is what routing protocols use as next hops.
2. Duplicate address detection (DAD): it sends an NS for its own address. If nobody answers, the address is unique.
3. It sends an RS to ff02::2 (all routers). Routers also send RAs periodically to ff02::1 (all nodes).
4. The RA carries the /64 prefix, the router's link-local address as default gateway, and flags.
5. The host adds an interface ID to the prefix. Modern systems use random, privacy-friendly IDs rather than the older EUI-64 method based on the MAC.

SLAAC, stateless DHCPv6 or stateful DHCPv6

Two RA flags tell hosts what to do: M (managed) means "get your address from DHCPv6", and O (other) means "get other settings, such as DNS servers, from DHCPv6".

Note that even with DHCPv6, hosts learn their default gateway from the RA, never from DHCPv6. Also, Android devices do not support stateful DHCPv6, so mixed networks usually keep SLAAC on.

interface GigabitEthernet0/1
 ipv6 address 2001:db8:10::1/64
 ipv6 nd other-config-flag
 ipv6 dhcp server CLIENT-DNS
show ipv6 neighbors
show ipv6 interface GigabitEthernet0/1

Securing NDP

Like ARP, NDP trusts what it hears. A rogue device can send fake RAs and become everyone's default gateway, and forged NAs can poison neighbour caches. Access switches defend against this with RA Guard (only permit RAs from router-facing ports), DHCPv6 Guard and IPv6 snooping or source guard.

Real-world example: a school network that had never "turned on" IPv6 found laptops sending traffic to a student's PC. Windows Internet Connection Sharing on that PC was sending router advertisements, and every client accepted them. Enabling RA Guard on access ports stopped it, and the team then planned a proper IPv6 rollout.

Common mistakes: blocking all ICMPv6 on a host or internal firewall, which breaks neighbour and router discovery; forgetting that a /64 prefix is needed for SLAAC to work, so longer prefixes on user VLANs leave hosts without addresses; and assuming a network with no IPv6 plan is safe from IPv6 traffic. Most operating systems enable IPv6 by default, so monitor and protect it even before you deploy it.