2

This is what I think a normal ICMPv6 neighbor advertisement should look like:

Wireshark screenshot of an ICMPv6 neighbor solicitation with option 2 (target link-layer address) set to a mac address

It says "I'm 2001:57a:d000::54 and you can reach me at 02:02:53:85:21:25". This is what neighbor advertisements from my ISP look like. By contrast, this is what neighbor advertisements from my Fortigate router/firewall look like:

Wireshark screenshot of an ICMPv6 neighbor solicitation with no options set

Notably, this does not include the Fortigate's mac address. I suppose the other end could figure it out based on the Ethernet header. Is this how it's supposed to work?

My issue is that the Fortigate can send packets, but can't receive them. I am suspicious it is because my gateway is Neighbor Solicitation-ing to try to get a mac address to send return packets to, but it is getting an empty reply.

1 Answer 1

2

In that packet, the [S]olicited flag indicates that the advertisement is a response to a solicitiation message. The L2 MAC address isn't included since it hasn't changed (that would trigger the [O]verride flag) and the destination MAC from the unicast solicitation is still valid.

You can find the details in RFC 4681:

Target link-layer address

The link-layer address for the target, i.e., the sender of the advertisement. This option MUST be included on link layers that have addresses when responding to multicast solicitations. When responding to a unicast Neighbor Solicitation this option SHOULD be included.

The option MUST be included for multicast solicitations in order to avoid infinite Neighbor Solicitation "recursion" when the peer node does not have a cache entry to return a Neighbor Advertisements message. When responding to unicast solicitations, the option can be omitted since the sender of the solicitation has the correct link- layer address; otherwise, it would not be able to send the unicast solicitation in the first place. However, including the link-layer address in this case adds little overhead and eliminates a potential race condition where the sender deletes the cached link-layer address prior to receiving a response to a previous solicitation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.