Remove unused on-link targets from the cache problem
04Neighbor Discovery, or ND, resolves an IPv6 neighbor to a link-layer address. On a large on-link prefix, many unassigned targets can cause unresolved neighbor entries and repeated solicitation work.
Reset to the chosen ::2/127 pair: only ::2 and ::3 are on-link in that prefix. ::99 is outside it and does not create the pictured unused-target ND entry for this prefix. The actual peer may still require ND; the packet’s other routing outcome is not specified.
Source for this drawing: RFC 6164 · Read RFC section 5.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The /64 Ethernet example uses ND. A forwarded packet for an unassigned on-link address can create an INCOMPLETE neighbor-cache entry, a Neighbor Solicitation and a retransmission timer. The example assumes no responder owns that target.
- The /64 Ethernet example uses ND. A forwarded packet for an unassigned on-link address can create an INCOMPLETE neighbor-cache entry, a Neighbor Solicitation and a retransmission timer. The example assumes no responder owns that target.
- Many distinct unused destinations can consume memory and processing. Rate limiting and garbage collection can limit the impact, but do not necessarily neutralize it; the RFC also discusses extra work when solicited-node multicast groups coincide.
- With both /127 endpoints assigned and Subnet-Router anycast disabled for the prefix, there are no unused addresses in that pair for the described unused-on-link-target exhaustion mechanism.
- ND may still be used to resolve the actual peer. /127 does not disable ND, authenticate peers, prescribe a global drop for every other destination, or prevent all denial-of-service attacks. Other prefixes/routes and other attacks are outside this bounded comparison.
Fictional documentation addresses within 2001:db8::/32. Bounded operator-chosen address examples, not a complete router, Neighbor Discovery, ICMPv6 or address-validation implementation.
Read the RFC section ↗