1

I'm trying to make a project to detect NAs in an inter-vlan IPv6 environment via trunk line. I know that NAs are sent in multicast so it would be possible to see the NA messages using a trunk line. With this in mind, I set up an environment consisting of 5 pcs and 2 vlans (10 and 20). PC1 and PC2 are vlan 10(switchport mode access) and PC3 and PC4 are vlan 20(switchport mode access). PC5 is a trunkline (switchport mode trunk). In order to verify I receive the messages, I use wireshark to check all packets. I can ping from one vlan to another and I can see other NDP message types such as RS, RA and even NS; however, there was no NA detected. I can't seem to find any reason why. Any response would help. Thanks

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:27
3

Since there is no ARP in ipv6 you need the Neighbor Solicitation and Neighbor Advertisement messages to resolve IP to MAC addresses within the same subnet. If you are pinging PCs in the same subnet across switches, at some point in time the NS and NA messages were present. If you can't see them now its most probably because the MAC addresses have been cached in the PCs.

  • Hi, i would like to ask if it is still possible that NAs can be sniffed using trunkline if the MAC addresses have not been cached in the PCs? Thanks – John Paul Feb 14 '15 at 2:45
  • Yes, at some point in time the IP has to be resolved into a MAC address. This is when the NS is sent and an NA is received. If this resolution is happening over a trunk (but within the same VLAN), you should see them. Change the IP on a remote PC to force a new MAC resolution while you are sniffing traffic. That should do it. – Ricardo Feb 14 '15 at 3:06
  • Hi Would'nt the trunkline sniff the NAs for multiple vlans since different vlans goes through the trunkline ? – John Paul Feb 14 '15 at 3:27
  • No, if the ping is going to another VLAN then it is routed via a router (or layer 3 switch), so no NS is sent if the router MAC is already known. – Ricardo Feb 14 '15 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.