Ch.13 ICMPv6 Neighbor Discovery

Ch.13 ICMPv6 Neighbor Discovery
CIS 116 IPv6 Fundamentals Rick Graziani Cabrillo College

ICMPv6 Messages

ICMP (Internet Control Message Protocol)
MyMac$ ping PING mundo.cabrillo.edu ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=51 time= ms 64 bytes from : icmp_seq=1 ttl=51 time= ms 64 bytes from : icmp_seq=2 ttl=51 time= ms 64 bytes from : icmp_seq=3 ttl=51 time= ms ^C MyMac$ Router# debug ip packet detail IP packet debugging is on (detailed) Router# ping Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: U.U.U May 27 05:27:27.11: IP: s= (local), d= (Serial0), len 100, sending May 27 05:27:27.15: ICMP type=8, code=0 ! Echo request sent (ping) May 27 05:27:27.19: IP: s= (Serial0), d= (Serial0), len 56, rcvd 3 May 27 05:27:27.23: ICMP type=3, code=1 ! Local router returns: Destination host unreachable May 27 05:27:27.27: IP: s= (local), d= (Serial0), len 100, ICMP is one of the main protocols of the Internet (TCP/IP) suite. Used to send messages between devices.

Internet Control Message Protocol for IPv6
ICMPv6 Internet Control Message Protocol for IPv6 ICMPv6 is defined in RFC 4443. Similar to ICMPv4, describes two types of messages: Informational Error ICMPv6 Neighbor Discovery is described in RFC 4861. Much more robust than ICMP for IPv4. Contains new functionality and improvements. More than just “messaging” but “how IPv6 conducts business”. IPv6 Main Header Next Header 58 ICMPv6 Header Data All ICMPv6 messages

ICMPv6 Neighbor Discovery – Lesson 10
ICMPv6 Neighbor Discovery defines 5 different packet types: Router Solicitation Message Router Advertisement Message Used with dynamic address allocation Neighbor Solicitation Message Neighbor Advertisement Message Used with address resolution (IPv4 ARP) Redirect Message Similar to ICMPv4 redirect message Router-to-Device messaging Router-Device Messaging Device-Device Messaging Described in RFC 4443 Much more robust than ICMP for IPv4 Contains new functionality and improvements. More than just “messaging” but “how IPv6 conducts business”. General message similar to ICMP for IPv4 (Type and Code fields)

ICMPv6 Messages ICMPv6 error messages are: Destination Unreachable
Packet Too Big Time Exceeded Parameter Problem ICMPv6 informational messages used by the ping command: Echo Request Echo Reply Similar to IPv4 We will take a brief look at these Similar to IPv4 We will see a packet analysis example

ICMPv6 Messages ICMPv6 informational messages used for Multicast Listener Discovery (RFC 2710 ): Multicast Listener Query Multicast Listener Report Multicast Listener Done ICMPv6 informational messages used by Neighbor Discovery (RFC 4861): Router Solicitation Message Router Advertisement Message Neighbor Solicitation Message Neighbor Advertisement Message Redirect Message Similar to IGMP for IPv4 (Internet Group Message Protocol) Discussed in previous chapter New message types (except for Redirect message). Discussed previously and will discuss more here.

ICMPv6 General Message Format
IPv6 Header Next Header = 58 ICMPv6 Message 8 16 24 31 Type Code Checksum Message Body IPv6 Next Header Value: 58 decimal or 3A hexadecimal ICMPv6 General Message Format (similar to ICMP for IPv4)

Three fields in the message:
Type (8 bits): Indicates the type of ICMPv6 message, such as Echo Request, Destination Unreachable, or Packet Too Big. Code (8 bits): Provides more granularity for the Type field. Its meaning depends on the message type. For example, Type is Destination Unreachable, the Code field gives the specific reason the packet was not able to reach its destination.

The Type field is used to group ICMPv6 messages into two classes:
Error messages: Type = 0 to 127 Informational messages: Type = 128 to 255

ICMPv6 Error Messages

ICMPv6 error messages are: Destination Unreachable Packet Too Big
Time Exceeded Parameter Problem

Error Message: Destination Unreachable Message
Code Values 0 - No route to destination 1 - Communication with destination administratively prohibited 2 - Beyond scope of source address 3 - Address unreachable 4 - Port unreachable 5 - Source address failed ingress/egress policy 6 - Reject route to destination 8 16 24 31 Type = 1 Code Checksum Unused As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU. Sent when a packet cannot be delivered to its destination for reasons other than congestion. A router (or a firewall) usually generates these messages. Type = 1 Code values vary, giving more detail.

C:\> ping -6 2a03:2880:f122:face:b00c::1
Destination host unreachable. <Wireshark capture: ICMPv6 Message> Internet Control Message Protocol v6 Type: Destination Unreachable (1) Code: 3 (Address unreachable) Checksum: 0xfec5 [correct] Reserved: Data: Internet Protocol Version 6, Version: 6 Traffic class: 0x . . . Type: Echo (ping) request (128) Code: 0 C:\ > Data field contains the IPv6 header and ICMPv6 message of the original ICMPv6 Echo Request that generated this Destination Unreachable message.

Error Message: Packet Too Big
8 16 24 31 Type = 2 Code = 0 Checksum MTU of the next hop link As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU. Important difference with IPv6… IPv4 routers fragment a packet when the MTU (Maximum Transmission Unit) of the outgoing link is smaller than the size of the packet. The destination device is responsible for reassembling the fragmented packets. IPv6 routers do not fragment packets (unless it is the source of the packet).

IPv4 Fragmentation IPv4 fields used for fragmentation and reassembly.
IPv6 routers do not perform fragmentation unless they are the source of the packet. Any fragmentation needed will be handled by the source using an extension header.. IPv4 IPv6

IPv4 Fragmentation MTU of outgoing link smaller than packet size – fragment IPv4 packet. It is my job to reassemble the packet fragments. Link with smaller MTU PCA PCB R1 R2 R3 Destination Source 1 2 3 IPv4 Packet IPv4 Packet IPv4 Packet IPv4 Packet IPv4 Packet IPv4 Packet IPv4 Packet IPv4 Packet IPv4 requires that every link have a minimum MTU of 68 bytes. Every internet destination must be able to receive a packet of 576 bytes either in one piece or in fragments to be reassembled. RFC791: Every internet module must be able to forward a datagram of 68 octets without further fragmentation. This is because an internet header may be up to 60 octets, and the minimum fragment is 8 octets. Every internet destination must be able to receive a datagram of 576 octets either in one piece or in fragments to be reassembled.

I will use MTU of the interface.
IPv6 Path MTU Discovery MTU of outgoing link smaller than packet size. Drop packet. Send ICMPv6 Packet Too Big message, use MTU 1350. Packet received. I will use MTU of the interface. MTU = 1500 MTU = 1500 MTU = 1350 MTU = 1500 PCA PCB R1 R2 Link with smaller MTU R3 Destination Source 1 IPv6 Packet – MTU 1500 2 ICMPv6 Packet Too Big Use MTU 1350 3 IPv6 requires that every link have a minimum MTU of 1280 bytes, with a recommended MTU of 1500 bytes. Path MTU Discovery uses this same process. Because IPv6 routers do not fragment packets, Path MTU Discovery is used when their links are greater than 1280. RFC2460: IPv6 requires that every link in the internet have an MTU of 1280 octets or greater. On any link that cannot convey a 1280-octet packet in one piece, link-specific fragmentation and reassembly must be provided at a layer below IPv6. Path MTU discovery is discussed in the lesson XXX. RFC 1981 IPv6 nodes SHOULD implement Path MTU Discovery in order to discover and take advantage of paths with PMTU greater than the IPv6 minimum link MTU [IPv6-SPEC]. A minimal IPv6 implementation (e.g., in a boot ROM) may choose to omit implementation of Path MTU Discovery. Sending hosts discover the path MTU through the following process: The sending host assumes that the path MTU is the link MTU of the interface on which the traffic is being forwarded. The sending host sends IPv6 datagrams at the path MTU size. If a router on the path is unable to forward the packet over a link because the packet is larger than the link MTU, the router sends an ICMPv6 Packet Too Big message back to the sending host and discards the packet. PAThe Packet Too Big message contains the MTU of the link on which the forwarding failed. The sending host sets the path MTU for packets being sent to the destination to the value of the MTU field in the Packet Too Big message. IPv6 Packet MTU 1350

Path MTU Discovery is defined in RFC 1981,Path MTU Discovery for IPv6
Optional When a device has a large number of packets to transmit, it is preferable for these packets to be as large as possible so that fewer packets need to be sent. This requires the source to know the minimum link MTU (the smallest MTU) of all the links in the path to the destination. The size of this packet is referred to as the Path MTU (PMTU).

Error Message: Time Exceeded
IPv6 8 16 24 31 Type = 3 Code = 0 Checksum Unused As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU. If a router receives a packet with a Hop Limit of zero, or if a router decrements a packet's Hop Limit to zero, it MUST: Discard the packet Send an ICMPv6 Time Exceeded message (Type = 3, Code 0) to the source of the packet. This indicates either a routing loop or too small an initial Hop Limit value.

Error Message: Time Exceeded
Apples-MacBook-Pro-9:~ rigrazia$ traceroute6 traceroute6 to (2620:108:700f::3428:3c77) from 2601:642:c300:cfa9:3d11:f46f:2db9:7e51, 64 hops max, 12 byte packets :642:c300:cfa9:5e8f:e0ff:fe4d:f ms ms ms :558:4000:7:: ms ms ms 3 te sur03.monterey.ca.sfba.comcast.net ms ms ms 4 be-222-ar01.santaclara.ca.sfba.comcast.net ms ms ms 5 be-3651-cr02.sunnyvale.ca.ibone.comcast.net ms ms ms 6 be pe02.529bryant.ca.ibone.comcast.net ms ms ms :108:700f::3428:3c ms ms ms Apples-MacBook-Pro-9:~ rigrazia$ Windows uses tracert (IPv4 and IPv6) or tracert -6 (IPv6 only)

Windows uses tracert (IPv4 and IPv6) or tracert -6 (IPv6 only)
R1# traceroute 2001:db8:cafe:4:250:56ff:feaf:2524 ! Or R1(config)# ipv6 host LinuxPC 2001:db8:cafe:4:250:56ff:feaf:2524 R1(config)# end R1# traceroute ipv6 LinuxPC Type escape sequence to abort. Tracing the route to LinuxPC (2001:DB8:CAFE:4:250:56FF:FEAF:2524) 1 2001:DB8:CAFE:2::2 4 msec 0 msec 0 msec 2 2001:DB8:CAFE:3::2 0 msec 0 msec 0 msec 3 LinuxPC (2001:DB8:CAFE:4:250:56FF:FEAF:2524) 8 msec 0 msec 0 msec R1# Windows uses tracert (IPv4 and IPv6) or tracert -6 (IPv6 only)

The IPv6 hop limit of the first packet is 1.
Windows traceroute (tracert) uses ICMP Echo Requests with a Hop Limit of 1. The Cisco IOS traceroute (and Unix/Linux implementations) uses UDP segments with an initial destination port number of 33434, or as specified in the extended traceroute command. The IPv6 hop limit of the first packet is 1. As long as an ICMP Time Exceeded message is received by the source, this cycle repeats, with incremental hop limits and destination port numbers. When the source receives an ICMPv6 Port Unreachable message, it knows that the destination has been reached. Similar to ping, the Windows implementation of traceroute (tracert) sends ICMP Echo Requests. Unlike ping, the first IPv4 packet has a starting TTL value of one. Routers decrement Time-To-Live (TTL) values by one before forwarding the packet. However, if the TTL value is zero the router will drop the packet and return an ICMP Time Exceeded message back to the source. Each time the source of the traceroute receives an ICMP Time Exceeded message, it displays the source IPv4 address of the ICMP Time Exceeded message, increments the TTL by one and sends another ICMP Echo Request. As each new ICMP Echo Request is sent, it makes it to one router more than the last Echo Request before receiving another ICMP Time Exceeded message. Traceroute uses the returned ICMP Time Exceeded messages to display a list of routers that the IPv4 packets traverse on their way to the final destination, the destination IPv4 address of the traceroute. When the packet reaches the final destination, the source returns an ICMP Echo Reply. Cisco IOS and Unix/Linux operation systems use a slightly different approach with traceroute. These implementations do not use ICMP Echo Requests. Instead they send out a sequence of User Datagram Protocol (UDP) datagrams, each with incrementing TTL values, to an invalid destination port address (Cisco uses a default of 33434). Similar to the Windows traceroute implementation, as the TTL expires (is decremented to zero), each router along the path will return an ICMP Time Exceeded message. When the packet reaches the final destination, because these datagrams try to access an invalid port (Cisco default is 33434) at the destination host, the host responds with an ICMP "port unreachable" message that indicates an unreachable port. This event signals to the source of the traceroute that the traceroute program has reached its destination. Note: The user can interrupt the trace by invoking escape sequence by pressing Ctrl+Shift+6. In Windows, the escape sequence is invoked by pressing Ctrl+C. To use extended traceroute, simply type traceroute, without providing any parameters, and press ENTER. IOS will guide you through the command options by presenting a number of prompts related to the setting of all the different parameters. Figure 1 shows the IOS extended traceroute options and their respective descriptions. While the Windows tracert command allows the input of several parameters, it is not guided and must be performed through options in the command line. Figure 2 shows the available options for tracert in Windows. Note: Traceroute in IPv6 has similar implementations. In IPv6 the TTL field was renamed to Hop Limit. ICMPv6 Time Exceeded messages are sent by the router when this field is decremented to zero.

Never really implemented, so deprecated in RFC 6814
RFC 1393, Traceroute Using an IP Option, defines a more efficient way to perform a traceroute. The source device sends a single packet to the destination, containing a special Traceroute IP option. Each router in the path recognizes the option as the test message and responds to the original source with an ICMPv6 Traceroute message. Never really implemented, so deprecated in RFC 6814 Similar to ping, the Windows implementation of traceroute (tracert) sends ICMP Echo Requests. Unlike ping, the first IPv4 packet has a starting TTL value of one. Routers decrement Time-To-Live (TTL) values by one before forwarding the packet. However, if the TTL value is zero the router will drop the packet and return an ICMP Time Exceeded message back to the source. Each time the source of the traceroute receives an ICMP Time Exceeded message, it displays the source IPv4 address of the ICMP Time Exceeded message, increments the TTL by one and sends another ICMP Echo Request. As each new ICMP Echo Request is sent, it makes it to one router more than the last Echo Request before receiving another ICMP Time Exceeded message. Traceroute uses the returned ICMP Time Exceeded messages to display a list of routers that the IPv4 packets traverse on their way to the final destination, the destination IPv4 address of the traceroute. When the packet reaches the final destination, the source returns an ICMP Echo Reply. Cisco IOS and Unix/Linux operation systems use a slightly different approach with traceroute. These implementations do not use ICMP Echo Requests. Instead they send out a sequence of User Datagram Protocol (UDP) datagrams, each with incrementing TTL values, to an invalid destination port address (Cisco uses a default of 33434). Similar to the Windows traceroute implementation, as the TTL expires (is decremented to zero), each router along the path will return an ICMP Time Exceeded message. When the packet reaches the final destination, because these datagrams try to access an invalid port (Cisco default is 33434) at the destination host, the host responds with an ICMP "port unreachable" message that indicates an unreachable port. This event signals to the source of the traceroute that the traceroute program has reached its destination. Note: The user can interrupt the trace by invoking escape sequence by pressing Ctrl+Shift+6. In Windows, the escape sequence is invoked by pressing Ctrl+C. To use extended traceroute, simply type traceroute, without providing any parameters, and press ENTER. IOS will guide you through the command options by presenting a number of prompts related to the setting of all the different parameters. Figure 1 shows the IOS extended traceroute options and their respective descriptions. While the Windows tracert command allows the input of several parameters, it is not guided and must be performed through options in the command line. Figure 2 shows the available options for tracert in Windows. Note: Traceroute in IPv6 has similar implementations. In IPv6 the TTL field was renamed to Hop Limit. ICMPv6 Time Exceeded messages are sent by the router when this field is decremented to zero.

Error Message: Parameter Problem
Code Extension Header Name Erroneous header field encountered 1 Unrecognized Next Header type encountered 2 Unrecognized IPv6 option encountered 8 16 24 31 Type = 4 Code Checksum Pointer As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU. ? IPv6 Main Header Next Header 138 Extension Header Next Header 6 TCP Header Data Type 4 Generated when a receiving device finds a problem with a field in the main IPv6 header such as the Next Header field – packet is discarded. Means the device didn’t understand the information in the IPv6 header and had to discard it.

ICMPv6 Informational Messages: Echo Request and Echo Reply

ICMPv6 Messages ICMPv6 informational messages used by the ping command: Echo Request Echo Reply ICMPv6 informational messages used for Multicast Listener Discovery (RFC 2710 ): Multicast Listener Query Multicast Listener Report Multicast Listener Done ICMPv6 informational messages used by Neighbor Discovery (RFC 4861): Router Solicitation Message Router Advertisement Message Neighbor Solicitation Message Neighbor Advertisement Message Redirect Message

ICMPv6 Echo Request and Echo Reply
Type 128 = Echo Request Type 129 = Echo Reply 8 16 24 31 Type = 128/129 Code = 0 Checksum Identifier Sequence Number Data ICMPv6 Echo Request Ping PCB PCA PCB ICMPv6 Echo Reply Similar to IPv4 Echo Request and Echo Reply messages are used by the ping utility.

Ping Command PCA R1 2001:DB8:CAFE:1::/64 G0/0 2001:DB8:CAFE:1::100
FE80::50A5:8A35:A5bb:66E1 2001:DB8:CAFE:1::1 FE80::1 PCA> ping 2001:db8:cafe:1::1 Pinging 2001:db8:cafe:1::1 from 2001:db8:cafe:1::100 with 32 bytes of data: Reply from 2001:db8:cafe:1::1: time=1ms <rest of output omitted> PCA> With windows we use the same ping command as with IPv4 using an IPv6 address. The may or may not be the case with all operating systems. On my MAC….

ICMPv6 Echo Request to GUA
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 40 Next header: ICMPv6 (0x3a) Hop limit: 128 Source: 2001:db8:cafe:1::100 Destination: 2001:db8:cafe:1::1 Internet Control Message Protocol v6 Type: 128 (Echo (ping) request) Code: 0 (Should always be zero) Checksum: 0x8f38 [correct] ID: 0x0001 Sequence: 0 Data (32 bytes) ICMPv6 Echo Request IPv6 Header Next Header = 58 ICMPv6 Message 3a hex = 58 decimal

ICMPv6 Echo Reply from GUA
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 40 Next header: ICMPv6 (0x3a) Hop limit: 64 Source: 2001:db8:cafe:1::1 Destination: 2001:db8:cafe:1::100 Internet Control Message Protocol v6 Type: 129 (Echo (ping) reply) Code: 0 (Should always be zero) Checksum: 0x8e38 [correct] ID: 0x0001 Sequence: 0 Data (32 bytes) ICMPv6 Echo Reply 3a hex = 58 decimal

ICMPv6 Echo Request to GUA
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 40 Next header: ICMPv6 (0x3a) Hop limit: 128 Source: 2001:db8:cafe:1::100 Destination: 2001:db8:cafe:1::1 Internet Control Message Protocol v6 Type: 128 (Echo (ping) request) Code: 0 (Should always be zero) Checksum: 0x8f38 [correct] ID: 0x0001 Sequence: 0 Data (32 bytes) Identifier: Help match a series of Echo Request messages with their corresponding Echo Reply messages. Echo Request and the Echo Reply have the same value. This value remains constant for the entire sequence 3a hex = 58 decimal

ICMPv6 Echo Reply from GUA
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 40 Next header: ICMPv6 (0x3a) Hop limit: 64 Source: 2001:db8:cafe:1::1 Destination: 2001:db8:cafe:1::100 Internet Control Message Protocol v6 Type: 129 (Echo (ping) reply) Code: 0 (Should always be zero) Checksum: 0x8e38 [correct] ID: 0x0001 Sequence: 0 Data (32 bytes) Sequence: Provides more granularity by matching individual Echo Reply messages with their specific Echo Request messages. An Echo Request is generated with a Sequence number, and its corresponding Echo Reply includes that same Sequence number. The next Echo Request increments the Sequence number by 3a hex = 58 decimal

Ping Command Link-Local Address
PCA 2001:DB8:CAFE:1::/64 G0/0 R1 2001:DB8:CAFE:1::100 FE80::50A5:8A35:A5bb:66E1 2001:DB8:CAFE:1::1 FE80::1 R1# ping fe80::50a5:8a35:a5bb:66e1 Output Interface: gig 0/0 % Invalid interface. Use full interface name without spaces (e.g. Serial0/1) Output Interface: gigabitethernet0/0 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to FE80::50A5:8A35:A5BB:66E1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R1# Routers usually have multiple interfaces so IOS needs to know which interface you want to use. Remember, the same link-local address may be on different links (networks) but it must be unique on that link.

ICMPv6 Echo Request to Link-Local Address
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 60 Next header: ICMPv6 (0x3a) Hop limit: 64 Source: fe80::1 Destination: fe80::50a5:8a35:a5bb:66e1 Internet Control Message Protocol v6 Type: 128 (Echo (ping) request) Code: 0 (Should always be zero) Checksum: 0x0444 [correct] ID: 0x0a24 Sequence: 0 Data (52 bytes) ICMPv6 Echo Request Source and destination link-local addresses. Default address selection

ICMPv6 Echo Reply from Link-Local Address
Internet Protocol Version 6 = Version: 6 <output omitted> Payload length: 60 Next header: ICMPv6 (0x3a) Hop limit: 64 Source: fe80::50a5:8a35:a5bb:66e1 Destination: fe80::1 Internet Control Message Protocol v6 Type: 129 (Echo (ping) reply) Code: 0 (Should always be zero) Checksum: 0x0344 [correct] ID: 0x0a24 Sequence: 0 Data (52 bytes) ICMPv6 Echo Reply Source and destination link-local addresses.

Pinging a Link-Local Address from WinPC to R1
WinPC> ping fe80::1 Pinging fe80::1 with 32 bytes of data: Reply from fe80::1: time<1ms Ping statistics for fe80::1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms WinPC>

Pinging a Link-Local Address from WinPC to R1
WinPC> ping fe80::1 Pinging fe80::1 with 32 bytes of data: Reply from fe80::1: time<1ms <output omitted for brevity> WinPC> ping fe80::1%11

Pinging a Link-Local Address from LinuxPC to R3
LinuxPC$ ping6 fe80::3 Connect: Invalid argument LinuxPC$ ping6 fe80::3%eth0 PING fe80::3%eth0(fe80::3) 56 data bytes 64 bytes from fe80::3: icmp_seq=0 ttl=64 time=0.552 ms 64 bytes from fe80::3: icmp_seq=1 ttl=64 time=0.429 ms <output omitted for brevity> LinuxPC$ ping6 –I eth0 fe80::3 64 bytes from fe80::3: icmp_seq=1 ttl=64 time=0.551 ms

ICMPv6 Neighbor Discovery

ICMPv6 Neighbor Discover Protocol
ICMPv6 Neighbor Discovery defines 5 different packet types: Router Solicitation Message Router Advertisement Message Used with dynamic address allocation Neighbor Solicitation Message Neighbor Advertisement Message Used with address resolution (IPv4 ARP) Redirect Message Similar to ICMPv4 redirect message Router-to-Device messaging Router-Device Messaging Device-Device Messaging See these processes with: R1# debug ipv6 nd

Devices, including routers, use ICMPv6 Neighbor Discovery for the following: Router and prefix discovery: Address resolution: Duplicate Address Detection (DAD) Neighbor Unreachability Detection (NUD): Redirection

The five ICMPv6 Neighbor Discovery messages may include one or more options: Type 1—Source Link-Layer Address: Contains the Layer 2 address (typically Ethernet) of the sender of the packet. (NS, RS, RA) Type 2—Target Link-Layer Address: Contains the Layer 2 address (typically Ethernet) of the intended target. (NA, Redirect) Type 3—Prefix Information: Provides hosts with prefixes and other information for SLAAC. (RA) Type 4—Redirect Header: Used in Redirect messages to contain all or part of the packet that is being redirected. (Redirect) Type 5—MTU: Used in Router Advertisement messages to help ensure that all devices on a link use the same MTU. (RA)

Router and Prefix Discovery: Router Solicitation and Router Advertisement Messages

Dynamic Address Allocation in IPv4
DHCPv4 Server 1 2 I need IPv4 addressing information. Here is everything you need. DHCPv4 server is a stateful server.

Dynamic Address Allocation in IPv6
To all IPv6 routers: I need IPv6 address information. I might not be needed. Router(config)# ipv6 unicast-routing ICMPv6 Router Solicitation DHCPv6 Server ICMPv6 Router Advertisement To all IPv6 devices: Let me tell you how to do this … 1. SLAAC SLAAC (Stateless Address Autoconfiguration) 2. SLAAC with Stateless DHCPv6 The Router Advertisement (RA) tells hosts how it will receive IPv6 Address Information. Sent periodically by an IPv6 router or… … when the router receives a Router Solicitation (RS) message from a host. More options for devices to get addressing. The device doesn’t need to access a DHCPv6 server for addressing. It’s router, its default gateway is its way out of the network and everything it needs for addressing. Much more in lesson XXX 3. Stateful DHCPv6

Router Advertisement Flags
RA Address Allocation Method A Flag (SLAAC) Default: On O Flag (Stateless DHCPv6) Default: Off M Flag (Stateful DHCPv6) Method 1: SLAAC (default) 1 (on) 0 (off) Method 2: SLAAC and stateless DHCPv6 Method 3: Stateful DHCPv6 N/A RA message contains three flags to tell a device how to obtain or create its global unicast address: Address Autoconfiguration flag (A flag): When set to 1 (on), this flag tells the receiving host to use SLAAC to create its global unicast address. Other Configuration flag (O flag): When set to 1 (on), this flag tells the host to get other addressing information, other than its global unicast address, from a stateless DHCPv6 server. Managed Address Configuration flag (M flag): When set to 1 (on), this flag tells the host to use a stateful DHCPv6 server for its global unicast address and all other addressing information.

Router Solicitation / Router Advertisement
2001:DB8:CAFE:1::/64 Link-local: FE80::1 MAC: b-e9-d4-80 Link-local: FE80::50A5:8A35:A5BB:66E1 MAC: b-d9-c6-44 R1 PC1 Router Solicitation Sent when device needs IPv6 addressing information. Router Advertisement Sent every 200 seconds or in response to RS 1 To: FF02::2 (All-IPv6 Routers) From: FE80::50A5:8A35:A5BB:66E1 ICMPv6 Router Solicitation RS 2 To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) ICMPv6 Router Advertisement RA

Analyzing the Router Solicitation Message

Router Solicitation Message Source Link-Layer Address (Type 1)
8 16 24 32 Type = 133 Code = 0 Checksum Reserved Valid Options: Source Link-Layer Address (Type 1)

Router Solicitation Message
Ethernet II, Src: 00:21:9b:d9:c6:44, Dst: 33:33:00:00:00:02 Internet Protocol Version 6 = Version: 6 [Traffic class and Flowlabel not shown] Payload length: 16 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: fe80::50a5:8a35:a5bb:66e1 Destination: ff02::2 Internet Control Message Protocol v6 Type: 133 (Router solicitation) Code: 0 Checksum: 0x3277 [correct] ICMPv6 Option (Source link-layer address) Type: Source link-layer address (1) Length: 8 Link-layer address: 00:21:9b:d9:c6:44 Ethernet multicast MAC address – Maps to “all IPv6 routers” Next header is an ICMPv6 header Link-local address of PC1 All-IPv6-routers multicast address Router Solicitation message MAC address of PC1 but RA is sent as all-IPv6-host multicast Lesson 6 discusses the mapping of IPv6 multicast addresses to Ethernet MAC addresses Router Solicitation Message

Analyzing the Router Advertisement Message

Router Advertisement Message
8 16 24 32 Type = 133 Code = 0 Checksum Cur Hop Limit M O H P Reserved Router Lifetime Reachable Time Retrans Time Valid Options: Source Link-Layer Address MTU Prefix Information

An IPv6 Router R1(config)# ipv6 unicast-routing
R1# show ipv6 interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:1 MTU is 1500 bytes <output omitted for brevity> ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. All-routers multicast group A Flag = 1 (M, 0 = 0)

Analyzing the Router Advertisement Message
Ethernet II, Src: 00:03:6b:e9:d4:80, Dst: 33:33:00:00:00:01 Internet Protocol Version 6 = Version: 6 = Traffic class: 0x000000e0 = Flowlabel: 0x Payload length: 64 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: fe80::1 Destination: ff02::1 Ethernet multicast MAC address – Maps to “All-IPv6 devices” Next Header is an ICMPv6 header Link-local address of R1. Added to hosts’ Default Router List and is the address they will use as their default gateway. All-IPv6 devices multicast Continued next slide

Router Advertisement Message
Internet Control Message Protocol v6 Type: 134 (Router advertisement) Code: 0 Cur hop limit: 64 Flags: 0x00 = Managed address configuration: Not set = Other configuration: Not set = Home Agent: Not set = Prf (Default Router Preference): Medium (0) = Proxy: Not set = Reserved: 0 Router lifetime (s): 1800 Reachable time (ms): 0 Retrans timer (ms): 0 Router Advertisement Recommended Hop Limit value for hosts M and O flags indicate that no information is available via DHCPv6 Router Advertisement Message

ICMPv6 Option (Source link-layer address)
Type: Source link-layer address (1) Length: 8 Link-layer address: 00:03:6b:e9:d4:80 ICMPv6 Option (MTU) Type: MTU (5) MTU: 1500 ICMPv6 Option (Prefix information) Type: Prefix information (3) Length: 32 Prefix Length: 64 Flag: 0xc0 = On-link flag(L): Set = Autonomous address-configuration flag(A): Set = Router address flag(R): Not set = Reserved: 0 Valid Lifetime: Preferred Lifetime: Prefix: 2001:db8:cafe:1:: Router R1’s MAC address MTU of the link. L Flag = Prefix/prefix-length is onlink A Flag = Prefix can be used for SLAAC Prefix of this network to be used for autoconfiguration

Address Resolution: Neighbor Solicitation and Neighbor Advertisement Messages

Address Resolution

Address Resolution: IPv4 and IPv6

IPv6 Solicited-Node Multicast Address
1 ICMPv6 NS Target IPv6 Address Global Routing Prefix Subnet ID Interface ID 24 bits 2001:0db8:cafe 0001 d0f8:9ff6:42 01:7086 2 Copy 24 bits Solicited-Node Multicast Address IPv6 Destination Address ff02 0000 0000 0000 0000 0001 ff 01:7086 3 Copy 32 bits Ethernet IPv6 Multicast Ethernet Destination MAC Address 33-33 ff

ARP Request in IPv4 ICMPv6 Neighbor Solicitation Message Intended target Intended target Ethernet broadcast: Data must be passed to the ARP process to determine if the device is the intended target. Ethernet multicast: NIC card can determine whether it needs to pass the data to IPv6.

Address Resolution: IPv4 and IPv6
ARP Request: Broadcast IPv4: ARP over Ethernet Ethernet ARP Request/Reply ARP Cache Know IPv4, what is the MAC? My IPv4! Here is the MAC? 2 1 ARP Reply PC2 ARP Request PC1 2 1 My IPv6! Here is the MAC? Know IPv6, what is the MAC? Neighbor Advertisement Neighbor Solicitation Neighbor Cache IPv6: ICMPv6 over IPv6 over Ethernet NS: Multicast NS: Solicited Node Multicast Ethernet More about address resolution in Lesson X. More about Solicited Node Multicast in Lesson X and Y. IPv6 Header ICMPv6: Neighbor Solicitation/Advertisement

Neighbor Solicitation
2001:DB8:CAFE:1::100/64 2001:DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) Neighbor Cache MAC Address 00-1B A2-1E MAC Address B-D9-C6-44 PC2 PC1 Neighbor Solicitation I know the IPv6, but what is the MAC?

Neighbor Solicitation
8 16 24 32 Type = 135 Code = 0 Checksum Reserved Target Address Valid Options: Source Link-Layer Address Figure 13-8

PC1 NS Ethernet II, Src: 00:21:9b:d9:c6:44, Dst: 33:33:ff:00:02:00
Internet Protocol Version 6 = Version: 6 = Traffic class: 0x = Flowlabel: 0x Payload length: 32 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: 2001:db8:cafe:1::100 Destination: ff02::1:ff00:200 Internet Control Message Protocol v6 Type: 135 (Neighbor solicitation) Code: 0 Checksum: 0xbbab [correct] Reserved: 0 (Should always be zero) Target: 2001:db8:cafe:1::200 ICMPv6 Option (Source link-layer address) Type: Source link-layer address (1) Length: 8 Link-layer address: 00:21:9b:d9:c6:44 Mapped multicast address for PC2 Next header is an ICMPv6 header Global unicast address of PC1 Solicited-node multicast address of PC2 Neighbor Solicitation message Target IPv6 address, needing MAC address (if two devices have the same solicited node address, this resolves the issue) MAC address of the sender, PC1

Neighbor Advertisement
2001:DB8:CAFE:1::100/64 2001:DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) MAC Address 00-1B A2-1E MAC Address B-D9-C6-44 PC2 PC1 Neighbor Advertisement Neighbor Cache It’s my IPv6 and here is my MAC?

Neighbor Advertisement
8 16 24 32 Type = 136 Code = 0 Checksum R S O Reserved Target Address Valid Options: Target Link-Layer Address Figure 13-9

PC2 NA Ethernet II, Src: 00:1b:24:04:a2:1e, Dst: 00:21:9b:d9:c6:44
Internet Protocol Version 6 = Version: 6 = Traffic class: 0x = Flowlabel: 0x Payload length: 32 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: 2001:db8:cafe:1::200 Destination: 2001:db8:cafe:1::100 Internet Control Message Protocol v6 Type: 136 (Neighbor advertisement) Code: 0 Checksum: 0x1b4d [correct] Flags: 0x Target: 2001:db8:cafe:1::200 ICMPv6 Option (Target link-layer address) Type: Target link-layer address (2) Length: 8 Link-layer address: 00:1b:24:04:a2:1e Unicast MAC address of PC1 Next header is an ICMPv6 header Global unicast address of PC2 Global unicast address of PC1 Neighbor Advertisement message IPv6 address of the sender, PC2 ICMPv6 Target IPv6 – you knew this but you needed – Link-layer Dest IPv6 and Dest MAC – Were part of the Neighbor Solicitation message MAC address of the sender, PC2 the target of the NS

ICMPv6 Duplicate Address Detection (DAD)
Global Unicast :DB8:CAFE:1::200 Link-local FE80::1111:2222:3333:4444 See the process with: R1# debug ipv6 nd PC2 Neighbor Solicitation Hopefully no Neighbor Advertisement Duplicate Address Detection (DAD) is used to guarantee that an IPv6 unicast address is unique on the link. A device will send a Neighbor Solicitation for its own unicast address (static or dynamic). After a period of time, if a NA is not received, then the address is deemed unique. Once required, RFC was updated to where it is only recommended - /64 Interface ID makes duplicates unlikely!

Neighbor Cache

Neighbor Cache ? PC1 Neighbor Cache IPv6 Address MAC Address
Neighbor Solicitation Neighbor Advertisement PC1 Neighbor Cache IPv6 Address MAC Address 2001:DB8:ACAD:1:: bd9.c644 IPv :DB8:ACAD:1::10 MAC bd9.c644 ? Neighbor Cache – Maps IPv6 addresses with Ethernet MAC addresses Similar to ARP Cache for IPv4 5 States (2 noticeable and 3 transitory): Reachable: Packets have recently been received providing confirmation that this device is reachable. Stale: A certain time period has elapsed since a packet has been received from this address. Transitory States: INCOMPLETE, DELAY, PROBE

Neighbor Cache R1# clear ipv6 neighbors R1# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface R1# ping 2001:db8:cafe:1:d0f8:9ff6:4201:7086 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms 2001:DB8:CAFE:1:D0F8:9FF6:4201: af REACH Gi0/0 R1# Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Neighbor Cache <30 seconds later> R1# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface 2001:DB8:CAFE:1:D0F8:9FF6:4201: af STALE Gi0/0 R1# ping 2001:db8:cafe:1:d0f8:9ff6:4201:7086 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms 2001:DB8:CAFE:1:D0F8:9FF6:4201: af REACH Gi0/0 R1# Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Neighbor Cache FSM Neighbor Cache (“ARP Cache”) See the process with:
R1# debug ipv6 nd Neighbor Solicitation (NS) sent No Entry Exists Incomplete 3 NS sent with no NA returned NA received Reachable Time exceeded (default 30 sec) Or Unsolicited NA received Reachable NS sent and NA received Packet returned (TCP increasing ACK) Stale – no action required (Requires resolution again) Packet sent Delay (Resolution pending) 5 sec Probe (Reresolution in progress) The only ways that reachability can be confirmed are: 1. Hints from an upper-layer protocol show that the connection is making forward progress – for example increasing, non-duplicate TCP acknowledgements are received. 2. A solicited NA is received in response to an NS. The NA must be solicited because an unsolicited NA would only confirm 1-way reachability. 3 NS sent with no NA returned

Neighbor Cache R1# clear ipv6 neighbors R1# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface R1# debug ipv6 nd ICMP Neighbor Discovery events debugging is on R1# ping 2001:db8:cafe:1:d0f8:9ff6:4201:7086 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Neighbor Cache ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) Resolution request ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) DELETE -> INCMP ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) Sending NS ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) Queued data for resolution ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) Received NA from 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086 ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) LLA af.9768 ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) INCMP -> REACH R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface 2001:DB8:CAFE:1:D0F8:9FF6:4201: af REACH Gi0/0 <after 30 seconds> ICMPv6-ND: (GigabitEthernet0/0,2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) REACH -> STALE 2001:DB8:CAFE:1:D0F8:9FF6:4201: af STALE Gi0/0 Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Displaying the Neighbor Cache
To display the neighbor cache on a Windows host, use this command: C:\> netsh interface ipv6 show neighbors To display the neighbor cache on a Linux host, use this command: Linux# ip -6 neighbor show To display the neighbor cache on a MacOS host, use this command: MacOS$ ndp -a

Neighbor Cache X <WinPC, 2001:db8:cafe:1:d0f8:9ff6:4201:7086, has been shutdown> R1# debug ipv6 nd ICMP Neighbor Discovery events debugging is on R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface 2001:DB8:CAFE:1:D0F8:9FF6:4201: af STALE Gi0/0 R1# ping 2001:db8:cafe:1:d0f8:9ff6:4201:7086 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086, timeout is 2 seconds: Success rate is 0 percent (0/5) Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Neighbor Cache X ICMPv6-ND: (GigabitEthernet0/0, 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) STALE -> DELAY ICMPv6-ND: (GigabitEthernet0/0, 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) DELAY -> PROBE ICMPv6-ND: (GigabitEthernet0/0, 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) Sending NS ICMPv6-ND: PROBE deleted: 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086 ICMPv6-ND: (GigabitEthernet0/0, 2001:DB8:CAFE:1:D0F8:9FF6:4201:7086) PROBE -> DELETE ICMPv6-ND: Remove ND cache entry R1# undebug all R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface R1# Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Destination Cache

Destination Cache WinPC# ping 2001:db8:cafe:4::1 Reply from 2001:db8:cafe:4::1 time=13ms Reply from 2001:db8:cafe:4::1 time<1ms <output omitted for brevity> WinPC> netsh interface ipv6 show destinationcache PMTU Destination Address Next Hop Address :db8:cafe:4:: fe80::1 WinPC> Destination Cache maintains a list of the destinations that traffic has been recently sent to, including those on other links or networks. In those cases, the entry is the Layer 2 address of the next-hop router. An IPv6 host maintains a Default Router List from which it selects a router for traffic to off-link destinations. The selected router for a destination is then cached in the Destination Cache.

Duplication Address Detection (DAD)

Duplicate Address Detection (DAD)
I am sending a NS message with my IPv6 address to see if anyone else is using it. 1 WinPC LLA fe80::d0f8:9ff6:4201:7086 (Tentative) MAC 00:50:56:af:97:68 ICMPv6 Duplicate Address Detection (DAD) to determine whether an address it wants to assign to an interface is already in use by another device. If a duplicate address is discovered during this process, it cannot be used on the interface. With some exceptions, RFC 4861 recommends that DAD be performed on every unicast address, link-local or global, before it is assigned to an interface regardless of whether it was assigned using SLAAC, DHCPv6, or manual configuration. There are some exceptions to this behavior, as discussed in RFC 4429, Optimistic Duplicate Address Detection (DAD) for IPv6.

2001:db8:cafe:1::/64 ::1 G0/0 LLA fe80::1 MAC 58:ac:78:93:da:00 R1 I am sending a NS message with my IPv6 address to see if anyone else is using it. 1 WinPC LLA fe80::d0f8:9ff6:4201:7086 (Tentative) MAC 00:50:56:af:97:68 2 3 Neighbor Solicitation Message Destination MAC address: 33:33:ff:01:70:86 Source MAC address: 00:50:56:af:97:68 Source IPv6 address: :: (Unspecified address) Destination IPv6 address: ff02::1:ff01:7086 Target address: fe80::d0f8:9ff6:4201:7086 Source Link-layer address : 00:50:56:af:97:68 Ethernet IPv6 ICMPv6 NS 4 Neighbor Advertisement Message

Redirect Message

ICMPv6 Redirect Network X Similar functionality as ICMPv4.
Destination: PCB Destination: Network X Host IPv6 Network A IPv6 Network B PCA PCB Similar functionality as ICMPv4. Like IPv4, a router informs an originating host of the IP address of a router that is on the local link and is closer to the destination. Unlike IPv4, a router informs an originating host that the destination host (on a different prefix/network) is on the same link as itself. Redirect Function Routers use the redirect function to inform originating hosts of a better first-hop neighbor to which traffic should be forwarded for a specific destination. Routers use the redirect function for two purposes: A router informs an originating host of the IP address of a router available on the local link that is closer to the destination. The term closer is a routing metric function used to reach the destination network segment. This condition can occur when multiple routers are on a network segment, the originating host chooses a default router, and it is not the best one to use to reach the destination. A router informs an originating host that the destination is a neighbor (it is on the same link as the originating host). This condition can occur when the prefix list of a host does not include the prefix of the destination. Because the destination does not match a prefix in the list, the originating host forwards the packet to its default router. The following steps occur in the IPv6 redirect process: The originating host sends a unicast packet to its default router. The router processes the packet and notes that the address of the originating host is a neighbor. Additionally, the router notes that both the originating host and the next-hop are on the same link. The router forwards the packet to the appropriate next-hop address. The router sends the originating host a Redirect message. In the Target Address field of the Redirect message is the next-hop address of the node to which the originating host should send packets addressed to the destination. For packets redirected to a router, the Target Address field is set to the link-local address of the router. For packets redirected to a host, the Target Address field is set to the destination address of the packet originally sent. The Redirect message includes the Redirected Header option. The message might also include the Target Link-Layer Address option. 5. Upon receiving the Redirect message, the originating host updates the destination address entry in the destination cache with the address in the Target Address field. If the Redirect message includes the Target Link-Layer Address option, its contents are used to create or update the corresponding entry in the neighbor cache. Only the first router in the path between the originating host and the destination sends redirect messages, and (like ICMPv6 error messages) they are rate limited. Hosts never send Redirect messages, and routers never update routing tables based on the receipt of a Redirect message.

Ch.13 ICMPv6 Neighbor Discovery

Similar presentations

Presentation on theme: "Ch.13 ICMPv6 Neighbor Discovery"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Ch.13 ICMPv6 Neighbor Discovery

Similar presentations

Presentation on theme: "Ch.13 ICMPv6 Neighbor Discovery"— Presentation transcript:

Similar presentations

About project

Feedback