IPv6 · Chapter 02 of 02

Neighbor Discovery, SLAAC and DHCPv6

IPv6 replaces ARP with Neighbor Discovery: ICMPv6 neighbor solicitations sent to solicited-node multicast groups resolve link-layer addresses, and router advertisements announce prefixes and gateway presence. With SLAAC a host builds its own global address from an advertised /64 prefix; RA flags decide whether DHCPv6 adds information (stateless) or assigns addresses (stateful).

Updated 31 August 2026 · RST Forum faculty

In this guideShow
  1. 01IPv6 Addressing Explained: Types, Format and Subnetting
  2. 02Neighbor Discovery, SLAAC and DHCPv6

IPv4 hosts join a network by shouting (ARP broadcasts) and begging (DHCP). IPv6 rebuilt both mechanisms on ICMPv6 and multicast, and made routers active participants: they advertise the network's parameters, and hosts can configure themselves from those advertisements alone. Five ICMPv6 message types carry the whole system: Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136) and Redirect (137).

Address resolution without broadcast

To resolve a neighbour's MAC, a host sends a Neighbor Solicitation — not to all nodes, but to the target's solicited-node multicast group: ff02::1:ff plus the last 24 bits of the target address. Only hosts whose addresses share those final 24 bits have joined that group, so resolution interrupts almost nobody — the NIC filters it in hardware, versus IPv4 ARP waking every host on the LAN. The target answers with a Neighbor Advertisement, and both ends populate their neighbour caches (show ipv6 neighbors — states include REACH, STALE, and the INCMP that marks failed resolution). The same NS/NA machinery performs Duplicate Address Detection: before using any address, a host solicits for it; silence means the address is unique.

Router Advertisements: the network describes itself

Routers multicast RAs to ff02::1 periodically and on request (hosts send an RS at attach time). An RA announces: the router's presence as a default gateway (with a lifetime), one or more on-link prefixes, MTU, and three decisive bits — the prefix's A flag (autonomous: 'you may SLAAC from this'), and the RA's M flag (managed: 'get your address from DHCPv6') and O flag (other-config: 'get DNS and options from DHCPv6').

The three provisioning models

  • SLAAC (A=1, M=0, O=0) — the host concatenates the advertised /64 with an interface identifier it generates itself — historically EUI-64 from the MAC, now usually a random, periodically-rotated privacy address (RFC 8981). Zero-touch, no server, no per-host record.
  • SLAAC + stateless DHCPv6 (A=1, M=0, O=1) — addresses via SLAAC; DNS servers and domain options from a DHCPv6 server that keeps no lease state. (RFC 8106 RA options can also carry DNS directly.)
  • Stateful DHCPv6 (M=1) — addresses assigned and recorded by a server, enterprise-style. Even here the default gateway still comes from the RA — DHCPv6 has no router option, a deliberate and perpetually surprising design choice.

R1(config)# interface gi0/0
R1(config-if)# ipv6 nd other-config-flag ! SLAAC + stateless DHCPv6
! or stateful:
R1(config-if)# ipv6 nd managed-config-flag
R1(config-if)# ipv6 nd prefix 2001:db8:acad:10::/64 no-autoconfig

Operational notes

Because any device sending RAs instantly becomes everyone's default gateway, rogue-RA protection is the IPv6 twin of DHCP snooping: enable RA Guard on access ports. Remember that hosts will hold multiple addresses (link-local, SLAAC global, privacy temporaries, possibly DHCPv6) — audit tooling and ACL thinking must expect it. And when troubleshooting host attachment, the order of questions is fixed: is an RA arriving (debug ipv6 nd / packet capture on ff02::1)? What are its A/M/O flags? Did DAD pass? Is the neighbour cache resolving? That sequence finds the fault in minutes, every time.

Free chapters, real racks, CCIE faculty — that's the whole model.

Browse coursesEnroll