Questions: ICMPv6 and Neighbor Discovery Protocol

Question 1

A network administrator blocks all ICMPv6 traffic on an IPv6 network, reasoning that 'ICMP is non-essential and a security risk.' What will happen?

• A. IPv6 will function normally — NDP uses a separate protocol layer independent of ICMPv6
• B. Address resolution will fail, autoconfiguration will break, and IPv6 connectivity will be lost
• C. Security will improve because NDP spoofing attacks will be prevented
• D. Only ping functionality will be disabled; all other IPv6 traffic will continue normally

Answer: (B)

NDP is built on ICMPv6, not on a separate protocol. Neighbor Solicitation/Advertisement messages (address resolution), Router Advertisement messages (prefix announcements and SLAAC), and Duplicate Address Detection all use specific ICMPv6 types. Blocking all ICMPv6 is equivalent to blocking both ARP and DHCP simultaneously in IPv4 — IPv6 becomes non-functional. This is a critical operational difference from IPv4 networks where ICMP can often be partially blocked. IPv6 firewalls must explicitly permit essential NDP message types (types 133–137) while filtering only genuinely unnecessary ones.

Question 2

How does IPv6 Neighbor Solicitation differ fundamentally from IPv4 ARP in its addressing approach?

• A. Neighbor Solicitation uses link-layer broadcast, just like ARP, to reach all hosts on the segment
• B. Neighbor Solicitation uses solicited-node multicast, so only hosts sharing the target's last 24 address bits receive it
• C. Neighbor Solicitation is sent as unicast directly to the target's known MAC address
• D. Neighbor Solicitation is forwarded to the subnet router, which responds on the target's behalf

Answer: (B)

The solicited-node multicast address is derived from the last 24 bits of the target IPv6 address. Since most implementations have unique interface identifiers, typically only the intended target receives the Neighbor Solicitation — rather than every host on the segment, as ARP's broadcast requires. In a network with thousands of hosts, ARP's broadcast forces every single host to wake up and process each address resolution request. NDP's solicited-node multicast targets only the relevant host, dramatically reducing per-host interrupt overhead at scale.

Question 3

NDP's Duplicate Address Detection works by sending a Neighbor Solicitation for an address a host wants to use; if no host responds, the address is considered safe to assign.

• T. True
• F. False

Answer: True

Before using any newly configured IPv6 address — whether from SLAAC or manual configuration — a host sends a Neighbor Solicitation for that address addressed to its solicited-node multicast group. If another host already has that address, it responds with a Neighbor Advertisement. Silence means the address is unique and safe to use. This is exactly the DAD mechanism: the host is effectively asking 'does anyone already own this address?' and interpreting silence as 'no.'

Question 4

IPv6's Stateless Address Autoconfiguration (SLAAC) requires a DHCPv6 server to be present on the network, because no host can configure a valid address without external assignment.

• T. True
• F. False

Answer: False

SLAAC is specifically designed to be stateless — hosts configure themselves without any server maintaining allocation records. A host receives the network prefix from a Router Advertisement, then constructs its own interface identifier (from its MAC address or a random privacy value) and combines them to form a complete IPv6 address. No server is needed, and no server tracks the assignment. DHCPv6 is an alternative for environments requiring centralized control, but SLAAC operates entirely without it — this is the meaning of 'stateless.'

Question 5

Why can ICMPv6 not be fully blocked in an IPv6 network, and how does this differ from the treatment of ICMPv4 in many IPv4 networks?

Model answer: ICMPv6 carries NDP — the protocol responsible for address resolution (replacing ARP), router discovery, prefix announcement, and duplicate address detection. These are essential functions for any IPv6 communication, so blocking ICMPv6 disables IPv6 entirely. In IPv4, ARP operates at layer 2 independently of IP, and ICMP is a separate optional layer-3 protocol; many IPv4 functions work even with ICMP blocked. IPv6 consolidated all these functions into ICMPv6, making it inseparable from basic connectivity.

The design choice to build NDP on ICMPv6 rather than a separate layer-2 protocol (like ARP) gives NDP access to IPv6's routing and security features, including SEND (Secure Neighbor Discovery). But it creates an operational consequence: IPv6 firewall rules cannot simply 'block ICMP' as IPv4 admins sometimes do. A properly secured IPv6 network must whitelist essential NDP message types (Router Solicitation 133, Router Advertisement 134, Neighbor Solicitation 135, Neighbor Advertisement 136, Redirect 137) while filtering other ICMPv6 types. Carrying IPv4 firewall habits into IPv6 environments causes immediate connectivity failures.