IPv6 Security · Topic 1 of 4
ICMPv6 and Neighbor Discovery Messages
Learn the ICMPv6 message types, the five Neighbor Discovery messages and options, the hop limit check, and the main ND attacks with RouterOS defences.
- 5 min
- ICMPv6 uses Next Header 58, and it is required for IPv6 to work.
- Types 1 to 4 are errors, and 128 and 129 are echo request and reply.
- ND uses types 133 to 137: RS, RA, NS, NA and Redirect.
What it is
ICMPv6 is the control protocol of IPv6, and the Neighbor Discovery messages are a part of it.
In IPv4, ICMP is helpful but often filtered. In IPv6 it is essential, because address resolution, router discovery and Path MTU Discovery all depend on it. Blocking it wholesale breaks the network.
ICMPv6 uses Next Header value 58. Each message has a type and a code, and the type tells you what the message is.
How it works
Types below 128 are error messages, and types from 128 upward are informational messages.
Common ICMPv6 types
| Type | Name | Class |
|---|---|---|
| 1 | Destination Unreachable | Error |
| 2 | Packet Too Big | Error |
| 3 | Time Exceeded | Error |
| 4 | Parameter Problem | Error |
| 128 | Echo Request | Informational |
| 129 | Echo Reply | Informational |
| 130 to 132 | MLD query, report and done | Informational |
| 133 | Router Solicitation | ND |
| 134 | Router Advertisement | ND |
| 135 | Neighbor Solicitation | ND |
| 136 | Neighbor Advertisement | ND |
| 137 | Redirect | ND |
| 143 | MLDv2 report | Informational |
Ping uses types 128 and 129. Traceroute relies on Time Exceeded messages from routers along the path, and Path MTU Discovery relies on Packet Too Big.
The five Neighbor Discovery messages
| Message | Sent by | Purpose |
|---|---|---|
| Router Solicitation (RS) | Host | Ask routers to advertise now |
| Router Advertisement (RA) | Router | Announce prefixes, flags and router lifetime |
| Neighbor Solicitation (NS) | Any node | Resolve an address, check duplicates, check reachability |
| Neighbor Advertisement (NA) | Any node | Answer an NS, or announce a change |
| Redirect | Router | Point a host to a better first hop |
An RS goes to the all routers group ff02::2. An RA goes to the all nodes group ff02::1, or to the unicast address of the host that asked.
An NS goes to the solicited node group for address resolution and duplicate checks. For a reachability check it goes straight to the neighbour.
ND options
Messages carry options that hold the actual data. The common ones are:
- Source link layer address: the MAC address of the sender.
- Target link layer address: the MAC address of the target.
- Prefix information: a prefix with its on-link and autonomous flags and lifetimes.
- MTU: the link MTU hosts should use.
- Recursive DNS server: DNS addresses sent in an RA.
RouterOS can add the DNS server to advertisements with advertise-dns in /ipv6 nd. The MTU option comes from the mtu setting in the same menu.
The hop limit of 255
Every genuine ND message is sent with a hop limit of 255. A router decreases the hop limit at each hop, so a message that arrives with 255 cannot have crossed a router. A receiver can drop any ND message whose hop limit is lower, and that stops remote attackers from injecting ND messages.
Attacks on ND
ND has no authentication by default, so devices on the same link can abuse it.
| Attack | What happens |
|---|---|
| Rogue Router Advertisement | An attacker announces itself as a router and takes traffic |
| Neighbor cache poisoning | A forged NA maps a victim address to the attacker MAC |
| Duplicate address denial | The attacker answers every duplicate check, so hosts can never take an address |
These are the IPv6 relatives of ARP spoofing. The standard cure is Secure Neighbor Discovery, which uses cryptographic signatures, but it is rarely deployed.
RouterOS defences
On a router, you can stop it believing rogue advertisements and filter ND messages with the firewall.
/ipv6 settings set accept-router-advertisements=no
/ipv6 firewall filter add chain=input protocol=icmpv6 icmp-options=134:0 in-interface-list=LAN action=dropThe first command makes the router ignore Router Advertisements. The second drops advertisements that arrive from the LAN side of the router. Use a hop limit match to insist on 255 for ND messages.
/ipv6 firewall filter add chain=input protocol=icmpv6 icmp-options=135:0 hop-limit=not-equal:255 action=dropIf hosts share a bridge, the firewall sees bridged traffic only when use-ip-firewall is enabled in the bridge settings.
Allow ICMPv6 in the input and forward chains, then block only the specific types you do not want. Allowing it by default is safer than blocking by default.
What to remember for the exam
Eight facts cover most questions on this topic.
- ICMPv6 uses Next Header 58, and it is required for IPv6 to work.
- Types 1 to 4 are errors, and 128 and 129 are echo request and reply.
- ND uses types 133 to 137: RS, RA, NS, NA and Redirect.
- RS goes to
ff02::2, and RA goes toff02::1or to the asking host. - ND messages are sent with hop limit 255, so a lower value is not genuine.
- NS and NA also provide duplicate address detection and reachability checks.
- Rogue RA and cache poisoning are the main ND attacks.
accept-router-advertisements=nostops a router learning from advertisements.
Do not copy IPv4 habits and drop all ICMP. Without ICMPv6 types 2 and 133 to 137, IPv6 stops working properly.
Common mistakes
These four mistakes appear often.
Blocking all ICMPv6. Address resolution, router discovery and Path MTU Discovery all fail.
Confusing NS and RS. Neighbor Solicitation resolves a neighbour. Router Solicitation asks for a router.
Ignoring rogue advertisements. On shared LANs, a fake RA can redirect all traffic.
Forgetting bridged traffic. The firewall does not see bridged frames unless use-ip-firewall is on.
Check yourself
Work through these three questions.
Which ICMPv6 types carry the five ND messages?
Types 133 to 137 carry Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect.
Why are ND messages sent with a hop limit of 255?
A router lowers the hop limit, so a value of 255 proves the message came from the same link.
What is a rogue Router Advertisement?
A fake RA from a device that is not a router, used to take over traffic on the link.
Topic 1 of 4 in IPv6 Security
Test yourself on IPv6 Security
The full MikroTik MTCIPv6E question bank has 486 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.