What is Neighbor Discovery Protocol (NDP)?
Learn what NDP is, its five ICMPv6 message types, how it replaces ARP for IPv6, and the SEND security extension.
Expected Interview Answer
Neighbor Discovery Protocol (NDP) is the IPv6 suite of ICMPv6 messages that replaces IPv4's ARP, DHCP-lite autoconfiguration, and ICMP redirects with a single set of five message types used to find neighbors, discover routers, and detect duplicate addresses on a link.
NDP defines five core ICMPv6 message types: Router Solicitation and Router Advertisement (for discovering routers and on-link prefixes), Neighbor Solicitation and Neighbor Advertisement (for resolving a neighbor’s link-layer address, the IPv6 equivalent of ARP), and Redirect (telling a host a better next hop exists on the link). A host sends a Neighbor Solicitation to the solicited-node multicast address of a target IP, and the owner replies with a Neighbor Advertisement containing its MAC address, which gets cached — this also underlies Duplicate Address Detection, where a host solicits its own tentative address before using it. Because NDP runs entirely at Layer 3 using ICMPv6 with multicast rather than IPv4-style broadcast, it is more efficient on switched networks, but it is also unauthenticated by default, making NDP spoofing (like ARP spoofing) a real threat that SEcure Neighbor Discovery (SEND) was designed to address.
- Unifies ARP, router discovery, and ICMP redirect into one ICMPv6 framework
- Uses multicast instead of broadcast for more efficient link-layer resolution
- Enables Duplicate Address Detection before a host uses a new address
- Underpins SLAAC by delivering prefixes via Router Advertisements
AI Mentor Explanation
NDP is like a unified set of hand signals a fielding side uses instead of separate shouted instructions for every situation — one signal asks "who is standing at this position" (Neighbor Solicitation), another confirms "that’s me, here I am" (Neighbor Advertisement), and another tells a fielder "actually throw to the keeper instead" (Redirect). Before a substitute takes a position, they wave the signal to themselves to confirm no one else already claims it, like Duplicate Address Detection. One consistent signal system replacing several ad hoc shouts is exactly what NDP does compared to IPv4's separate ARP and ICMP redirect messages.
Step-by-Step Explanation
Step 1
Router discovery
A host sends a Router Solicitation, or waits for a periodic Router Advertisement, to learn on-link prefixes and default routers.
Step 2
Neighbor resolution
A host multicasts a Neighbor Solicitation to the solicited-node address of a target IP to learn its MAC.
Step 3
Neighbor Advertisement
The owning device replies with a Neighbor Advertisement carrying its link-layer address, which gets cached.
Step 4
Redirect and DAD
Routers send Redirect for a better next hop, and hosts run Duplicate Address Detection before using a new address.
What Interviewer Expects
- Names the five NDP message types built on ICMPv6
- Explains NDP replaces ARP, parts of DHCP, and ICMP redirect for IPv6
- Understands multicast (solicited-node address) vs IPv4 broadcast
- Aware of NDP spoofing risk and the SEND mitigation
Common Mistakes
- Confusing NDP with SLAAC (SLAAC uses NDP messages but is a separate concept)
- Thinking NDP still uses broadcast like ARP
- Not knowing NDP is built entirely on ICMPv6
- Forgetting NDP messages are unauthenticated by default
Best Answer (HR Friendly)
“Neighbor Discovery Protocol is IPv6's way of handling several jobs that IPv4 split across separate protocols — finding a neighbor’s hardware address, discovering routers, and getting redirected to a better path — all rolled into one consistent set of ICMPv6 messages. It’s essentially ARP, router discovery, and ICMP redirect combined and modernized for IPv6.”
Code Example
# View the IPv6 neighbor cache (analogous to the ARP table)
ip -6 neigh show
# Example output:
# fe80::1a2b:3c4d:5e6f:7788 dev eth0 lladdr 00:1a:2b:3c:4d:5e REACHABLE
# Trigger router discovery and view advertised prefixes
sudo rdisc6 eth0Follow-up Questions
- How does Neighbor Unreachability Detection keep the neighbor cache accurate?
- What is SEND (SEcure Neighbor Discovery) and what does it protect against?
- How does Duplicate Address Detection use Neighbor Solicitation messages?
- Why does NDP use multicast instead of the broadcast ARP relies on?
MCQ Practice
1. NDP is built on top of which protocol?
Neighbor Discovery Protocol uses ICMPv6 message types to perform its functions.
2. Which IPv4 mechanism does NDP's Neighbor Solicitation/Advertisement replace?
Neighbor Solicitation and Advertisement resolve link-layer addresses, the IPv6 equivalent of ARP.
3. What does NDP use instead of IPv4-style broadcast?
NDP messages use solicited-node multicast addresses, which is more efficient than broadcast.
Flash Cards
What is NDP? — The ICMPv6-based IPv6 protocol suite for neighbor resolution, router discovery, and redirects.
Five NDP message types? — Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, Redirect.
NDP vs ARP? — NDP uses ICMPv6 and multicast; ARP uses a separate protocol and broadcast.
What secures NDP? — SEND (SEcure Neighbor Discovery), since plain NDP is unauthenticated.