ARP is Dead. Long Live NDP.
When your computer wants to send a packet to another device on the same local network, it knows the destination's IP address but needs its MAC address (the hardware address used at Layer 2). In IPv4, this lookup is done by ARP (Address Resolution Protocol). ARP works by broadcasting a message to every device on the network: "Who has IP 192.168.1.5? Tell me your MAC." Every device receives and processes this message, even though only one needs to respond. On a large network with thousands of devices, this broadcast traffic becomes significant noise.
IPv6 eliminates broadcast entirely. Instead, it uses multicast — messages sent to a specific group address that only relevant devices listen to. The mechanism that replaces ARP is NDP (Neighbor Discovery Protocol), which runs over ICMPv6 (Internet Control Message Protocol version 6).
The Solicited-Node Multicast Address
This is the key to NDP's efficiency. When a device gets an IPv6 address, it automatically joins a special multicast group derived from the last 24 bits of that address:
ff02::1:ff<last-24-bits-of-IPv6-address>
For example, if your address is 2001:db8::1234:5678, you join ff02::1:ff34:5678. Only devices whose addresses end in 34:5678 listen to this multicast group. When someone wants to find your MAC address, they send the query to that specific multicast group — not to every device on the network.
NDP Message Flow
Host A wants to reach Host B (2001:db8::1)
│
├─ Host A sends Neighbor Solicitation (NS)
│ Destination: ff02::1:ff00:0001 (solicited-node multicast)
│ "Who has 2001:db8::1? I am 2001:db8::2"
│
└─ Host B (and only Host B) receives it, replies with Neighbor Advertisement (NA)
Destination: 2001:db8::2 (unicast back to Host A)
"I am 2001:db8::1, my MAC is AA:BB:CC:DD:EE:FF"
NDP's Five Message Types
| Message | ICMPv6 Type | Purpose |
|---|---|---|
| Router Solicitation (RS) | 133 | Host asks: "Any routers here?" |
| Router Advertisement (RA) | 134 | Router announces: "I exist, here's the prefix" |
| Neighbor Solicitation (NS) | 135 | Host asks: "Who has this IPv6 address?" |
| Neighbor Advertisement (NA) | 136 | Host replies: "I have that address, here's my MAC" |
| Redirect | 137 | Router tells host about a better next-hop |
NDP also handles Router Discovery — finding the default gateway — which is critical for SLAAC (covered next). In IPv4, finding the gateway required either static configuration or DHCP. In IPv6, routers periodically multicast Router Advertisements, and hosts can also actively solicit them.
NDP Cache vs ARP Cache
The NDP neighbor cache is the IPv6 equivalent of the ARP table. Entries cycle through states: INCOMPLETE (solicitation sent, waiting), REACHABLE (confirmed working), STALE (not recently confirmed but assumed valid), DELAY (about to probe), and PROBE (actively re-verifying). This state machine makes NDP more robust than ARP's simple timeout model.
Key Point: NDP replaces ARP's noisy broadcast model with targeted multicast using solicited-node addresses, reducing unnecessary traffic on large networks. It also consolidates router discovery, address resolution, and duplicate detection into a single protocol — something IPv4 required three separate mechanisms to accomplish.