13.2. Examples for tcpdump packet dumps

13.2.1.1. Router advertisement

15:43:49.484751 fe80::212:34ff:fe12:3450 > ff02::1: icmp6: router
╛ advertisement(chlim=64, router_ltime=30, reachable_time=0,
╛ retrans_time=0)(prefix info: AR valid_ltime=30, preffered_ltime=20,
╛ prefix=2002:0102:0304:1::/64)(prefix info: LAR valid_ltime=2592000,
╛ preffered_ltime=604800, prefix=3ffe:ffff:0:1::/64)(src lladdr:
╛ 0:12:34:12:34:50) (len 88, hlim 255)

Router with link-local address "fe80::212:34ff:fe12:3450" send an advertisement to the all-node-on-link multicast address "ff02::1" containing two prefixes "2002:0102:0304:1::/64" (lifetime 30 s) and "3ffe:ffff:0:1::/64" (lifetime 2592000 s) including its own layer 2 MAC address "0:12:34:12:34:50".

13.2.1.2. Router solicitation

15:44:21.152646 fe80::212:34ff:fe12:3456 > ff02::2: icmp6: router solicitation
╛ (src lladdr: 0:12:34:12:34:56) (len 16, hlim 255)

Node with link-local address "fe80::212:34ff:fe12:3456" and layer 2 MAC address "0:12:34:12:34:56" is looking for a router on-link, therefore sending this solicitation to the all-router-on-link multicast address "ff02::2".

13.2.2.1. Neighbor discovery solicitation for duplicate address detection

Following packets are sent by a node with layer 2 MAC address "0:12:34:12:34:56" during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address.

• Node wants to configure its link-local address "fe80::212:34ff:fe12:3456", checks for duplicate now

15:44:17.712338 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
╛ fe80::212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim 255)

• Node wants to configure its global address "2002:0102:0304:1:212:34ff:fe12:3456" (after receiving advertisement shown above), checks for duplicate now

15:44:21.905596 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
╛ 2002:0102:0304:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32,
╛ hlim 255)

• Node wants to configure its global address "3ffe:ffff:0:1:212:34ff:fe12:3456" (after receiving advertisement shown above), checks for duplicate now

15:44:22.304028 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
╛ 3ffe:ffff:0:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim
╛ 255)

13.2.2.2. Neighbor discovery solicitation for looking for host or gateway

• Note wants to send packages to "3ffe:ffff:0:1::10" but has no layer 2 MAC address to send packet, so send solicitation now

13:07:47.664538 2002:0102:0304:1:2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6:
╛ neighbor sol: who has 3ffe:ffff:0:1::10(src lladdr: 0:e0:18:90:92:5) (len 32,
╛ hlim 255)

• Node looks for "fe80::10" now

13:11:20.870070 fe80::2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6: neighbor
╛ sol: who has fe80::10(src lladdr: 0:e0:18:90:92:5) (len 32, hlim 255)