Neighbor Discovery Protocol

Neighbor Discovery Protocol
Name	Neighbor Discovery Protocol
Other names	NDP
Developer	Internet Engineering Task Force
Introduction	1990s
Protocol family	Internet Protocol Suite
Layer	Internet layer
Status	Active

Neighbor Discovery Protocol

Neighbor Discovery Protocol is an Internet-layer protocol used for automated network configuration, address resolution, and reachability information on Internet Protocol version 6 networks. It operates alongside protocols and standards defined by the Internet Engineering Task Force and interacts with mechanisms specified for IPv6 addressing, multicast, and routing. Implementations appear in operating systems, network devices, and virtualization platforms produced by vendors such as Cisco Systems, Juniper Networks, Microsoft, Apple Inc., and Google.

Overview

NDP provides functions comparable to mechanisms in the era of ARP within deployments of IPv4 and complements routing protocols like OSPFv3, BGP and IS-IS. It leverages multicast addressing established by allocations from organizations such as the Internet Assigned Numbers Authority and depends on link-layer behaviors standardized by the Institute of Electrical and Electronics Engineers. NDP is referenced by specifications maintained in the repositories of standards bodies including the Internet Engineering Task Force and has been the subject of operational analysis in forums like the IETF Working Group meetings and the IETF RFC Editor.

Protocol Operations

NDP exchanges control messages between nodes and routers to determine link-layer addresses, discover routers, and detect neighbor reachability. Messages are typically encapsulated directly over IPv6 and make use of multicast groups reserved by IANA; they are processed by stacks in operating systems such as Linux kernel, FreeBSD, OpenBSD, NetBSD, and Windows NT. Router Advertisement behaviors interact with DHCPv6 processes designed by communities that include contributors from Red Hat, Canonical, Debian Project, and SUSE. Network deployments in datacenters run by Amazon Web Services, Microsoft Azure, Google Cloud Platform, or on premises with equipment from Arista Networks and Hewlett Packard Enterprise must tune NDP timers and caching in coordination with link aggregation features developed by Broadcom and Intel Corporation.

Message Types and Format

NDP defines several ICMPv6 message types specified in standards from the IETF. Routers and hosts exchange messages for neighbor solicitation and neighbor advertisement, echoing the semantics found in earlier protocols like ICMP used in IPv4. Message formats include fields for source and target addresses, option lists that may carry link-layer addresses, and timers similar to those used by TCP for timeout control. Tools and utilities used to observe and debug these messages include tcpdump, Wireshark, and system utilities distributed by projects such as the GNU Project and BusyBox.

Address Resolution and Autoconfiguration

Stateless address autoconfiguration provided by NDP enables hosts to generate IPv6 addresses using prefix information advertised by routers. This process references neighbor discovery options that may convey prefix delegation and route information akin to mechanisms in DHCPv6 and interacts with routing advertisements from protocols like RIPng and BGP. The design influenced deployment patterns in enterprise environments managed by vendors including Cisco Systems, Juniper Networks, Huawei Technologies and enterprise services offered by VMware. Implementations consider privacy extensions inspired by academic research from institutions like MIT, Stanford University, University of California, Berkeley, and ETH Zurich.

Security and Threats

Security considerations for NDP address threats such as spoofing, address hijacking, and denial-of-service tactics that have been examined by teams at organizations like National Institute of Standards and Technology, CERT Coordination Center, and Internet Society. Countermeasures include cryptographic protections and protocol modifications exemplified by Secure Neighbor Discovery, developed through IETF work motivated by incidents investigated by groups including SANS Institute and research labs at Carnegie Mellon University and Georgia Institute of Technology. Network operators use access control features from vendors such as Arista Networks and Cisco Systems, and host-based firewalls in Windows Server and Linux distributions, to mitigate exploitation.

Implementation and Interoperability

Multiple implementations exist across operating systems and network equipment firmwares; interoperability testing occurs in venues like the IETF Interop Working Group and industry consortia such as the OpenStack community and Cloud Native Computing Foundation. Commercial network operating systems from Cisco IOS, Juniper Junos, Arista EOS, and open-source stacks from FRRouting and Quagga must correctly handle NDP messages to ensure compatibility with services orchestrated by Kubernetes, Open vSwitch, and virtualization platforms from VMware ESXi and KVM. Certification and conformance testing often reference test suites produced by standards bodies including the IETF and test laboratories like ETSI.

History and Standards Development

The protocol’s specifications were developed within the Internet Engineering Task Force throughout the late 1990s and early 2000s, with foundational documents edited through the IETF RFC Editor process and influenced by early Internet research at institutions such as University College London and Bell Labs. Successive revisions and updates to address operational experience and security concerns have been published alongside related standards for IPv6 transition mechanisms and address management discussed at venues like the IETF meetings and displayed in academic conferences such as SIGCOMM, USENIX, NDSS, and ICNP.

Category:Internet protocols