ipv6 packets exchanged at start-up

[sarahr202]

hi everybody.

how is everyone doing?

Please consider the following scenario:

R1 f0/0---------------f0/0 R2

Both routers are ipv6-enabled

R2#show ipv6 int brief

FastEthernet0/0            [up/up]

    FE80::C201:CFF:FE98:0

    2000::2

R1#show ipv6 int brief

FastEthernet0/0            [up/up]

    FE80::C200:CFF:FE98:0

    2000::1

Below is wireshark captured packet  was  transmitted by r1 to or r2 .

No.     Time        Source                Destination           Protocol Length Info

      2 0.297000    ::                    ff02::1:ff98:0        ICMPv6   78     Neighbor Solicitation for fe80::c200:cff:fe98:0

Below is the expanded fields of the above packet:

Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)

Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_ff:98:00:00 (33:33:ff:98:00:00)

Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff98:0 (ff02::1:ff98:0)

Internet Control Message Protocol v6

    Type: Neighbor Solicitation (135)

    Code: 0

    Checksum: 0xadf6 [correct]

    Reserved: 00000000

    Target Address: fe80::c200:cff:fe98:0 (fe80::c200:cff:fe98:0)

What is router trying to do?  is it trying to verify the link local adress  fe80::c200:cff:fe98:0  not being used by some other ipv6 node?

==============================

After a while, R1 sends a packet which is shown below:

No.     Time        Source                Destination           Protocol Length Info

      6 1.078000    ::                    ff02::1:ff00:1        ICMPv6   78     Neighbor Solicitation for 2000::1

Frame 6: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)

Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_ff:00:00:01 (33:33:ff:00:00:01)

Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff00:1 (ff02::1:ff00:1)

Internet Control Message Protocol v6

    Type: Neighbor Solicitation (135)

    Code: 0

    Checksum: 0x5aa6 [correct]

    Reserved: 00000000

    Target Address: 2000::1 (2000::1)

Is R1 trying to verify 2000::1 i not being used by any other ipv6 node?

=========================================================

R1 transmits the following packet to R2

No.     Time        Source                Destination           Protocol Length Info

      7 1.391000    fe80::c200:cff:fe98:0 ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Below is the expanded field of the above packet:

Frame 7: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)

Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_00:00:00:16 (33:33:00:00:00:16)

Internet Protocol Version 6, Src: fe80::c200:cff:fe98:0 (fe80::c200:cff:fe98:0), Dst: ff02::16 (ff02::16)

Internet Control Message Protocol v6

    Type: Multicast Listener Report Message v2 (143)

    Code: 0

    Checksum: 0xa2d8 [correct]

    Reserved: 0000

    Number of Multicast Address Records: 1

    Multicast Address Record Changed to exclude: ff02::1:ff98:0

        Record Type: Changed to exclude (4)

        Aux Data Len: 0

        Number of Sources: 0

        Multicast Address: ff02::1:ff98:0 (ff02::1:ff98:0)

What is the purpose of this packet?

Thanks and have a great day.

[Peter Paluch · Accepted solution]

Hi Sarah,

Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_ff:98:00:00 (33:33:ff:98:00:00)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff98:0 (ff02::1:ff98:0)
Internet Control Message Protocol v6
    Type: Neighbor Solicitation (135)
    Code: 0
    Checksum: 0xadf6 [correct]
    Reserved: 00000000
    Target Address: fe80::c200:cff:fe98:0 (fe80::c200:cff:fe98:0)
What  is router trying to do?  is it trying to verify the link local adress   fe80::c200:cff:fe98:0  not being used by some other ipv6 node?

Yes. The router is performing Duplicate Address Detection (DAD) on its link-local address. While the link-local addresses are usually automatically assigned and derived from MAC addresses, they are nevertheless configurable and are subject to DAD just like any other IPv6 address.

Frame 6: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_ff:00:00:01 (33:33:ff:00:00:01)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff00:1 (ff02::1:ff00:1)
Internet Control Message Protocol v6
    Type: Neighbor Solicitation (135)
    Code: 0
    Checksum: 0x5aa6 [correct]
    Reserved: 00000000
    Target Address: 2000::1 (2000::1)
Is R1 trying to verify 2000::1 i not being used by any other ipv6 node?

Yes. The router is performing DAD on its global unicast IPv6 address.

Frame 7: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
Ethernet II, Src: c0:00:0c:98:00:00 (c0:00:0c:98:00:00), Dst: IPv6mcast_00:00:00:16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: fe80::c200:cff:fe98:0 (fe80::c200:cff:fe98:0), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6
    Type: Multicast Listener Report Message v2 (143)
    Code: 0
    Checksum: 0xa2d8 [correct]
    Reserved: 0000
    Number of Multicast Address Records: 1
    Multicast Address Record Changed to exclude: ff02::1:ff98:0
        Record Type: Changed to exclude (4)
        Aux Data Len: 0
        Number of Sources: 0
        Multicast Address: ff02::1:ff98:0 (ff02::1:ff98:0)
What is the purpose of this packet?

This is a multicast join into solicited-node multicast group for the router's link-local IPv6 address. As this is MLDv2, it is source-and-group specific. The "Change to exclude" with an empty source list means "exclude no one". In other words, the router simply wants to receive a multicast traffic for this particular solicited-node multicast group (related to the router's link-local IPv6 address) from all sources.

Best regards,

Peter