IPv6 & Neighbor Discovery

Published on:

Most important commands to remember

  • ip -6 address — inspect IPv6 addresses and prefixes.
  • ip -6 route — inspect IPv6 routes and gateways.
  • ip -6 neigh — inspect IPv6 neighbors and their link-layer addresses.

Commands and flags

These commands appear in the short example below.

Command Meaning
ip -6 address show Display IPv6 addresses, prefixes, scopes, and address flags.
ip -6 route show Display the main IPv6 routing table.
ip -6 neigh show Display the IPv6 neighbor table.

-6 selects IPv6. These are the address, route, and neighbor views from the previous trips, now for a different IP version. No network configuration is changed.

The concepts that matter

1. IPv6 uses a larger address space

An IPv6 address contains 128 bits instead of IPv4’s 32. It is written in eight hexadecimal groups separated by colons. Leading zeros in a group can be omitted; :: replaces consecutive all-zero groups and can appear only once in an address.

For example, 2001:db8:1::2 is a shortened address from a documentation range. In 2001:db8:1::2/64, the first 64 bits describe the prefix. /64 is common for IPv6 LAN subnets. The routing table determines which destinations Linux treats as directly reachable.

IPv6 is a separate protocol version. Working IPv4 connectivity does not prove IPv6 connectivity, or the reverse.

2. An interface can have addresses with different scopes

An IPv6 interface commonly has a link-local address, from fe80::/10, as well as other addresses. Link-local addresses are valid only on their attached link; routers do not forward traffic with those addresses to other links.

They are useful for communication with nearby routers and neighbors, even without internet connectivity. An interface can also have global or private-use addresses, and some configurations add temporary addresses for privacy. An IPv6 address is not necessarily derived from its MAC address.

In Linux output, scope link identifies link-local scope. scope global alone does not prove public internet reachability; routes and the surrounding network still matter.

3. Neighbor Discovery replaces ARP’s local lookup

IPv6 uses Neighbor Discovery (ND), part of ICMPv6, to resolve a local next hop’s link-layer address. It does not use ARP.

For initial address resolution on Ethernet, a host sends a Neighbor Solicitation to a solicited-node multicast group associated with the target IPv6 address. The target normally answers with a Neighbor Advertisement carrying link-layer information. Linux caches the mapping.

Multicast addresses a group, rather than every interface as a broadcast does. IPv6 has no broadcast addressing. The group-based request reduces who needs to process the lookup, although a switch may still flood multicast frames locally.

4. ICMPv6 supports basic network operation

Neighbor Discovery does more than map addresses. It supports discovering routers and checking neighbor reachability. Its messages also support checking whether an address is already in use before assigning it, called Duplicate Address Detection.

Router Advertisements can announce prefixes and default-router information and support automatic address configuration. ICMPv6 therefore carries essential network control traffic as well as diagnostic echo messages.

For a remote destination, Linux resolves the next-hop router’s local address, not the remote host’s MAC. Address → route → neighbor remains the useful sequence for understanding delivery.

One small example

Optional: run these commands in a Linux terminal with iproute2 installed. No administrator access is needed:

ip -6 address show
ip -6 route show
ip -6 neigh show

In the address output, look for inet6, the /PREFIX, and scope. ::1 is loopback: the machine talking to itself. A link-local address alone does not establish a route beyond the local link.

In routes, dev identifies the interface and via a next-hop router. A default router may use a link-local address; the interface tells Linux which link it belongs to.

In neighbors, lladdr is the link-layer address and the final state describes reachability. REACHABLE means recently confirmed; STALE is a cached mapping needing reconfirmation, not automatic failure. Your addresses, routes, and neighbors will vary. Empty route or neighbor output can be normal on a machine without configured IPv6 connectivity or recent neighbor activity.

This reads existing state; it does not generate or capture Neighbor Discovery traffic. Nothing needs cleanup.

Keep this idea: IPv6 has its own addresses and routes, and uses ICMPv6 Neighbor Discovery to reach the local next hop.