NDP operates using ICMPv6 and, even though ICMPv6 messages are encapsulated in payload field of IPv6 datagram, ICMPv6 and ICMP are usually considered as network layer protocols. At least, on Wikipedia they are network layer protocols.

So I thought that NDP, thus, is also network layer protocol. However, on Wikipedia it is directly stated that it is a link layer protocol:

The Neighbor Discovery Protocol (NDP, ND)[1] is a protocol in the Internet protocol suite used with Internet Protocol Version 6 (IPv6). It operates at the Link Layer of the Internet model (RFC 1122), and is responsible for gathering various information required for internet communication, including the configuration of local connections and the domain name servers and gateways used to communicate with more distant systems. [https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol]

So my hypothesis is that NDP is considered as a link layer protocol because ICMPv6 messages used by NDP (Neighbor Solicitations, Router Advertisements, Redirects and so on) never leave the local network -- the same as ARP messages never leave the local network. Am I right?

Thank you for attention.


Well, I realized that the point which is most interesting to me is -- if it is right that NDP ICMPv6 messages never leave the bounds of local network?


Though it looks like nothing can actually prevent me from sending Neighbor Solicitation to any host in the Internet. ICMPv6 is routable. So I can choose any destination IPv6 including that which is outside my network.

  • Also what makes NDP layer 2 protocol is when NS is sent on a link to discover a mac address, its sent to a layer 2 solicited-node multicast address, which is generally 33:33:FF:last 24 bits derived from the Ipv6 address. Mar 4, 2021 at 14:43
  • All higher layer protocols eventually are encapsulated in L2 frames. L2 protocols don't have network layer addresses.
    – Ron Trunk
    Mar 4, 2021 at 14:51

5 Answers 5


First of all: In every "model" you will find some aspects that do not describe the reality correctly. This is true for "models" in computer science, financial theory, politics or any other field of science. As the word already says, the "OSI model" is a "model" so it does not describe the reality correctly in all aspects.

Especially the question "what layer is the protocol XYZ" often has no definite answer: Think about tunneling IP packets in HTTPS connections in a VPN session.

However, the so-called "TCP/IP model" (which is a simplified alternative to the OSI model) sees ICMP packets in the layer corresponding to OSI layer 3, not layer 2.

This model does not see ICMP as own layer-3 protocol, but as part of the IP protocol (which is clearly layer 3):

Placing NDP in any other layer than layer-3 would imply that this protocol works together with any layer-3 protocol (e.g. NDP can be used together with IPv4). However this is not the case.

It would have been possible to place NDP between layer-2 and layer-3:

ARP for example is placed "between" layer-2 and layer-3 (Wikipedia says "layer 2.5") to indicate that this protocol will only work together with certain combinations of layer-2 and layer-3 protocols. (As far as I know ARP only works with the combination IPv4 and Ethernet).

However this is not true in the case of NDP: NDP should work with every layer-2 protocol.

Well, I realized that the point which is most interesting to me is -- if it is right that NDP ICMPv6 messages never leave the bounds of local network?

  1. This criterion is not sufficient to say that a protocol is on layer 2:

    DHCP also never leaves the local network - however DHCP covers OSI layers 5-7.

  2. There is at least one case I know where NDP messages travel around the world:

    When using IPv6 using Teredo!

  • "ARP only works with the combination IPv4 and Ethernet" -- 802.11, too.
    – JoL
    Dec 26, 2018 at 20:49
  • DHCP can be forwarded by routers. This is done when an organization has a central DHCP server for all subnets.
    – Barmar
    Dec 26, 2018 at 21:41
  • @JoL Technically that is correct. However WLAN seems to have been designed in a way to be 1:1 compatible to Ethernet; so every Ethernet frame can be converted to a WLAN frame and vice versa. This would not be the case for PPP, which uses completely different packet type identifiers. Dec 27, 2018 at 6:48

The OSI model is a conceptual idea -- it doesn't relate to anything that people actually built. Moreover, IPv4 and IPv6 were developed without the OSI model in mind, so there is no direct correlation between them. Many IPv4 protocols don't really fit the model, and the same is true of IPv6.

People spend endless hours debating at what layer a particular protocol resides. Your reasoning is as good as any.

See this questions and answer for more information on the OSI model and networking protocols.

  • I see. But am I right that NDP ICMPv6 messages never leave the bounds of local network so this is why we can say that NDP is link layer even though ICMPv6 is network layer?
    – JenyaKh
    Dec 26, 2018 at 16:26
  • Yes, I suppose.
    – Ron Trunk
    Dec 26, 2018 at 16:30

I also want to answer my own question. The answer concerns particularly the two UPDATES which I appended to the initial question. I wondered what will happen if I try to send any NDP ICMPv6 message to a host outside my local network. This sounds like a security problem. So I found that the problem is solved in the following way in RFC-4861 [https://www.rfc-editor.org/rfc/rfc4861]:

11.2. Securing Neighbor Discovery Messages

The protocol reduces the exposure to the above threats in the absence of authentication by ignoring ND packets received from off-link senders. The Hop Limit field of all received packets is verified to contain 255, the maximum legal value. Because routers decrement the Hop Limit on all packets they forward, received packets containing a Hop Limit of 255 must have originated from a neighbor.


3.1. Comparison with IPv4

By setting the Hop Limit to 255, Neighbor Discovery is immune to off-link senders that accidentally or intentionally send ND messages. In IPv4, off-link senders can send both ICMP Redirects and Router Advertisement messages.

So in each of the sections of this RFC-4861, corresponding to each type of NDP messages, --

6.1.1.  Validation of Router Solicitation Messages
6.1.2.  Validation of Router Advertisement Messages
7.1.1.  Validation of Neighbor Solicitations
7.1.2.  Validation of Neighbor Advertisements
8.1.    Validation of Redirect Messages

-- there is the following phrase:

A host MUST silently discard any received message that does not satisfy all of the following validity checks:

  • The IP Hop Limit field has a value of 255, i.e., the packet could not possibly have been forwarded by a router.
  • ...

So normally NDP messages have capability to travel only locally in the network and should not be routed.


NDP belongs to the L3 network layer. It is an essential part of IPv6, just like ICMPv6 which it a special form or extension of.


NDP belongs to the OSI layer 3 (Network layer) and TCP/IP layer 2 (Internet layer), why?

  1. NDP is routable

Since NDP runs on ICMPv6, and ICMPv6 is routable since it runs on IPv6, NDP can be routed across the internet, unlike ARP which is not routable. An example of NDP traveling over the internet is when using Teredo.

  1. NDP requires an IPv6 address to work.

Unlike ARP that can work without an IPv4 address since ARP uses MAC address, NDP requires an IPv6 address to work, that is why clients need to configure itself an IPv6 link-local address before it can send NDP messages, while a client does not need an IPv4 address before it can send ARP messages.

This is why on ARP, clients broadcast on FF:FF:FF:FF:FF:FF which is a MAC address, while on NDP, clients multicast on a solicited-node multicast address by taking the least-significant 24 bits of an unicast or anycast address and appending them to the prefix ff02::1:ff00:0/104 which is an IPv6 address.

  1. NDP does not have its own EtherType

NDP does not have its own EtherType since it does not run directly on Ethernet frames, but it runs on ICMPv6 that runs on IPv6. Unlike ARP that has its own EtherType, since it does not run on IPv4, but on Ethernet frames directly.

  • "while on NDP, clients broadcast on FF02::1 which is an IPv6 address." NDP does not broadcast because there is no broadcast in IPv6. Each IPv6 host must listen to a Solicited-Node multicast address for each IPv6 address (based on the last 24 bits of the unicast IPv6 address) it has on a link, and NDP sends multicast to the solicited-node multicast address of the target, not a broadcast or All-Nodes (FF02::1) multicast address. That way, NDP multicast only interrupts one or very few hosts on a link, but ARP broadcast interrupts all hosts on a link.
    – Ron Maupin
    Sep 4, 2023 at 14:19
  • @RonMaupin TIL that there is no broadcast functionality in IPv6, thanks!
    – Anim Mouse
    Sep 5, 2023 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.