3

I'm debugging a system demonstrating intermittent loss of connection. It's loosing entries from the neighborhood cache while there are active connections.

Does Neighbor Discovery (rfc2461) require that the neighborhood cache (arp cache) can only be refreshed by network probes? Or should the timeout normally be updated by network traffic?

Improve this question

1 Answer 1

Reset to default
3

Does Network Discovery (rfc2461) preclude ARP sniffing?

No, IPv6 prevents ARP sniffing. IPv6 does not use ARP, which requires broadcast, and IPv6 does not have broadcast.

Instead, IPv6 makes heavy use of multicast, and Neighbor Discovery Protocol does many things, including replacing ARP. You should learn more about IPv6 multicast, which has flags and scopes. Also learn about MLDv2, which is what IPv6 uses instead of IGMP that IPv4 uses.

Improve this answer
7
  • Thank you. This clarifies my situation, where the network stack supports both IPv4 and IPv6: it means the problem I see is inherently implementation specific, a result of the shared MAC cache not being maintained by IPv4 traffic in the absence of IPv6 traffic .
    – david
    Commented May 27, 2022 at 0:29
  • NDP has a neighbor table and a destination table instead of an ARP table.
    – Ron Maupin ♦
    Commented May 27, 2022 at 0:31
  • Windows now uses the IPv6 neighbor table as the MAC cache for IPV4. On the evidence of Wireshark, it gets refreshed by IPv4 ARP, but not by IPv4 TCP traffic. On the basis of your answer, there is no requirement that a neighbor table should be updated by IPv4 -- which I hadn't got my head around before.
    – david
    Commented May 27, 2022 at 0:48
  • 1
    RFC 826 is what defines ARP, and it explains that only ARP messages, not other traffic update an ARP table. TCP is carried in IP packets, not ARP packets, so ARP tables should not be updated by any IP packets, including those containing TCP segments. Only ARP packets update ARP tables. Of course, what a particular OS does is off-topic here.
    – Ron Maupin ♦
    Commented May 27, 2022 at 1:02
  • RFC 826 does not cover table aging or timeouts. "It may be desirable to have table aging and/or timeouts. The implementation of these is outside the scope of this protocol." Although the default assumption was that ARP would never timeout, there is nothing in RFC 826 that prevents TCP traffic aging or RFC 2461 timeouts from applying. I have a problem where there is a shared cache with timeout, so it's good to understand what the IPv6 rules mean, as explained in your answer.
    – david
    Commented May 27, 2022 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.