Given the following capture (click to zoom):


There are 3 routers attached to a switch. One of them pings FF02::1 (packet #2). I understand, that the other two routers have to figure out the first one's link-layer address (hence the NS and NA messages #3,4,5,6). After that both of them sends their ping reply.

My question is, why are those additional NDP messages exchanged (#11-14)? They are coming from the router, which sent the echo request. It should already know about the link-layer addresses of the other two from the Neighbor Solicitation messages. What am I missing?

  • These come 5 seconds after the echo packets. Is this behaviour consistent if you repeat the experiment? You could clear the neighbor cache before repeating it. – Gerben Apr 22 '15 at 11:10
  • 1
    Yes, it happens every time. I wonder if it has anything to do with Neighbor Unreachability Protocol, as the DELAY_FIRST_PROBE_TIME (RFC4861 page 70) is set to 5 sec. – Davs Apr 27 '15 at 17:04
  • You could try to disable NUD or change the timer to test your theory (if possible on your system). – Gerben Apr 27 '15 at 20:09