What is a Router Advertisement (RA)?
Learn what a Router Advertisement is, its prefix and M/O flags, how it enables SLAAC, and the rogue RA security risk.
Expected Interview Answer
A Router Advertisement (RA) is an ICMPv6 message that an IPv6 router periodically multicasts (or sends in response to a Router Solicitation) to announce its presence, the on-link address prefixes hosts should use, and configuration flags telling hosts how to obtain the rest of their settings.
An RA carries a set of options including one or more Prefix Information options (the /64 prefix hosts use for SLAAC), a default router lifetime, the recommended MTU, and the M and O flags — M signals hosts to use stateful DHCPv6 for addresses, while O signals hosts to fetch extra options like DNS servers via stateless DHCPv6. Hosts either wait for the periodic RA (sent every few seconds to minutes) or send a Router Solicitation to request one immediately when they join the network, letting them configure connectivity within moments instead of waiting for the next periodic broadcast. Because RAs are trusted without authentication by default, a rogue or misconfigured device sending bogus RAs (RA spoofing / "rogue RA") can silently redirect or black-hole a network’s IPv6 traffic, which is why switches often support RA Guard to filter RAs from untrusted ports. RAs are the mechanism that makes SLAAC, default gateway discovery, and DHCPv6 mode selection all work together on an IPv6 link.
- Announces the on-link prefix hosts use to self-configure via SLAAC
- Advertises the router as a default gateway with a lifetime
- Signals via M/O flags whether hosts should also use DHCPv6
- Enables fast startup through Router Solicitation instead of waiting for the next periodic RA
AI Mentor Explanation
A Router Advertisement is like the ground announcer periodically calling out over the PA system, "This ground’s enclosure number is 7, gates close at sundown, and check with the box office for extra passes" — anyone entering can build their own seat location from the enclosure number without asking staff individually. A new arrival can also shout up to the announcer directly and get an immediate repeat of the announcement instead of waiting for the next scheduled call. If an impostor grabs the PA system and announces the wrong enclosure number, spectators end up in the wrong section entirely, just as a rogue Router Advertisement misroutes hosts on a network.
Step-by-Step Explanation
Step 1
Periodic multicast
A router multicasts an RA to the all-nodes address every few seconds to minutes.
Step 2
Solicited response
A newly joined host can send a Router Solicitation to get an immediate RA instead of waiting.
Step 3
Prefix and flags
The RA carries the on-link prefix, router lifetime, and the M/O flags that steer SLAAC vs DHCPv6.
Step 4
Host configuration
Hosts use the prefix for SLAAC, set the router as default gateway, and follow M/O for further configuration.
What Interviewer Expects
- Defines RA as an ICMPv6 message announcing router presence and prefixes
- Knows the Prefix Information option and router lifetime fields
- Explains the M/O flags and their effect on host configuration
- Aware of rogue RA risk and RA Guard as a mitigation
Common Mistakes
- Confusing Router Advertisement with Router Solicitation direction
- Thinking RAs are only sent once at boot instead of periodically
- Not knowing RAs are unauthenticated by default
- Forgetting RAs are what actually deliver the SLAAC prefix
Best Answer (HR Friendly)
“A Router Advertisement is a message an IPv6 router regularly broadcasts on the local network saying, in effect, 'I’m here, use me as your gateway, and here’s the address range you should build your address from.' It’s what lets devices join an IPv6 network and configure themselves automatically without extra setup, and it also tells them whether they should ask a DHCPv6 server for more details.”
Code Example
# Passively listen for Router Advertisements on an interface
sudo tcpdump -i eth0 -vv icmp6 and 'ip6[40] == 134'
# Actively request an RA and print its options
sudo rdisc6 eth0
# Prefix: 2001:db8:1::/64
# Flags : Managed(M)=0, Other(O)=1
# Router lifetime: 1800 secondsFollow-up Questions
- What happens on a network if a rogue device sends fake Router Advertisements?
- How does RA Guard on a switch mitigate rogue RAs?
- What is the difference between the router lifetime and the prefix valid/preferred lifetimes in an RA?
- How does a host choose between multiple routers advertising RAs on the same link?
MCQ Practice
1. What protocol carries Router Advertisement messages?
Router Advertisements are ICMPv6 messages, part of the Neighbor Discovery Protocol suite.
2. What does the M flag in a Router Advertisement indicate?
The M (Managed) flag tells hosts to obtain their address via stateful DHCPv6 rather than SLAAC.
3. How can a host get an RA immediately instead of waiting for the next periodic one?
A Router Solicitation prompts routers on the link to respond immediately with a Router Advertisement.
Flash Cards
What is a Router Advertisement? — An ICMPv6 message a router sends to announce itself, its prefix, and configuration flags.
What triggers an immediate RA? — A host sending a Router Solicitation.
What do M/O flags control? — Whether hosts use stateful DHCPv6 (M) or fetch extra options via stateless DHCPv6 (O).
Key RA security risk? — Rogue/spoofed RAs can misroute a network; mitigated by RA Guard on switches.