Tech Stuff - IPv6 Message Formats

This section defines the message format and usage of ICMP and the Discovery processes used in Version 6 of the IP Protocol. IPv6 address and header formats.

You need to be fairly comfortable with Hex stuff to handle IPv6 [quick overview of Hexadecimal, Binary and Decimal]

IPv6 Discovery

An IPv6 host or router can use the IPv6 Discovery process, a Multicasting service, to obtain information about its local environment.

IPv6 Discovery Messages comprise the following set:

Router Solicitation - requests local routers to transmit information (in a Router Advertisement).
Router Advertisement - routers periodically transmit information to local hosts.
Neighbor Solicitation - requests local hosts to send information (in a Neighbor Advertisement).
Neighbor Advertisement - response to a Neighbor Solicitation.
Redirect - used by routers to notify a host of a better route for any destination.

Router Solicitation

A Router Solicitation message may be issued by a host to cause local routers to transmit information - a Router Advertisement - from which it can obtain information about local routing or perform stateless autoconfiguration. While Router Advertisements are transmitted periodically a host may prompt an immediate Router Advertisement using a Router Solicitation such as when it boots or following a restart operation. Router Solicitation messages are part of the ICMPv6 set.

Message Format

Name	Length	Value	Description/Notes
Type	8 bits	133	Router Solicitation
Code	8 bits	0	-
Checksum	16 bits	-	ICMPv6 checksum. Format.
Reserved	32 bits	0	Field must be set to zero and ignored by receiver.
Options	variable	-	Options format. The only valid option is the Source Link-Layer which MUST be included if known e.g. the EUI-64 value of the interface else no option field should be included.

A Router Advertisement message is issued periodically by a router or in response to a Router Solicitation message from a host. The information contained in these messages may be used by hosts to perform stateless autoconfiguration and modify its routing table. Defined by RFC 4861

Message Format

Name	Length	Value	Description/Notes
Type	8 bits	134	Router Advertisement
Code	8 bits	0	-
Checksum	16 bits	-	ICMPv6 checksum. Format.
Cur Hop Limit	8 bits	Variable	The hop limit to be used in the IP header when sending via this router. The value 0 = not defined for this router.
M	1 bit	-	Managed Address Configuration flag. If set indicates host should use stateful configuration (e.g. DHCPv6) for address data.
O	1 bit	-	Other Configuration flag. Indicates "other" information (such as DNS server addresses) is available using stateful configuration (e.g. DHCPv6).
Reserved	6 bits	0	Should be zero and ignored by receiver.
Router Lifetime	16 bits	-	Unsigned integer. The lifetime associated with the default router in seconds. The maximum value corresponds to 18.2 hours. A Lifetime of 0 indicates that the router is not a default router and SHOULD NOT appear on the default router list.
Reachable Time	32 bits	-	Unsigned integer. The time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation. Used by the Neighbor Unreachability Detection algorithm. A value of zero means unspecified (by this router).
Retrans Timer	32 bits	-	Unsigned integer. The time, in milliseconds, between retransmitted Neighbor Solicitation messages. Used by address resolution and the Neighbor Unreachability Detection algorithm. A value of zero means unspecified (by this router).
Options	variable	-	Options format. The valid options are the Source Link-Layer, MTU and Prefix Information.

Neighbor Solicitation

A Neighbor Solicitation message may be issued by a host to cause local hosts to transmit information - a Neighbor Advertisement - from which it can obtain information about the local environment. The result of this process generates the equivalent of the Address Resolution Protocol (ARP) table of IPv4 but is more efficient - uses generally fewer messages.

Message Format

Name	Length	Value	Description/Notes
Type	8 bits	135	Neighbor Solicitation
Code	8 bits	0	-
Checksum	16 bits	-	ICMPv6 checksum. Format.
Target Address	128 bits	-	Defines the target address of the soliciation and must not be a multicast address but can be the unspecified address (::).
Options	variable	-	Options format. The only valid option is the Source Link-Layer which MUST be included if known e.g. the EUI-64 value of the interface else the entry should be set to empty.

A Neighbor Advertisement message is issued by a host in response to a Neighbor Solicitation or spontaneously if the IPv6 link-layer address of the host changes.

Message Format

Name	Length	Value	Description/Notes
Type	8 bits	136	Neighbor Advertisement
Code	8 bits	0	-
Checksum	16 bits	-	ICMPv6 checksum. Format.
R	1 bit	-	Router flag. If set indicates the device is a router.
S	1 bit	-	Solicited flag. When set, the S-bit indicates that the advertisement was sent in response to a Neighbor Solicitation from the Destination address. The S-bit is used as a reachability confirmation for Neighbor Unreachability Detection. It MUST NOT be set in multicast advertisements or in unsolicited unicast advertisements.
O	1 bit	-	Override flag. When set, the O-bit indicates that the advertisement should override an existing cache entry and update the cached link-layer address. When it is not set the advertisement will not update a cached link-layer address though it will update an existing Neighbor Cache entry for which no link-layer address is known. It SHOULD NOT be set in solicited advertisements for anycast addresses and in solicited proxy advertisements. It SHOULD be set in other solicited advertisements and in unsolicited advertisements.
Reserved	29 bits	0	Field must be set to zero and ignored by receiver.
Target Address	128 bits	-	For solicited advertisements, the Target Address field in the Neighbor Solicitation message that prompted this advertisement. For an unsolicited advertisement, the address whose link-layer address has changed. Must not be a multicast address but can be the unspecified address (::).
Options	variable	-	Options format. The only valid option is the Target Link-Layer which MUST be returned if known e.g. the EUI-64 value of the interface.

Redirect

A Redirect message may be issued by a router to notify hosts of a better route to the destination.

Message Format

Name	Length	Value	Description/Notes
Type	8 bits	137	Redirect
Code	8 bits	0	-
Checksum	16 bits	-	ICMPv6 checksum. Format.
Reserved	32 bits	0	Field must be set to zero and ignored by receiver.
Target Address	128 bits	-	An IP address that is a better first hop to use for the ICMP Destination Address. When the target is the actual endpoint of communication, i.e., the destination is a neighbor, the Target Address field MUST contain the same value as the ICMP Destination Address field. Otherwise the target is a better first-hop router and the Target Address MUST be the router's link-local address so that hosts can uniquely identify routers.
Destination Address	128 bits	-	The IP address of the destination which is redirected to the target.
Options	variable	-	Options format. The valid options are the Target Link-Layer and the Redirected Header.

Generic Options Format

Each Option is carried in a classic TLD (Type, Length, Data) format message as shown below.

Name	Length	Description/Notes
Type	8 bits	The type field may be: 1 = Source link-layer 2 = Target link-layer 3 = Prefix Informationr 4 = Redirected Header 5 = MTU Each of which is described below.
Length	8 bits	The length of the option including the Type and Length field in multiples of 8 octets. The value 0 is invalid.
Data	variable	Length and content defined by the Type field.

Source Link-layer

The Source Link-Layer Address option contains the link-layer address of the sender of the packet. It is used only in the Neighbor Solicitation, Router Solicitation, and Router Advertisement packets. The field may be a variable number of octets depending on the link-layer type, for example, if Ethernet it is 48 bits as shown below:

Name	Length	Description/Notes
Type	8 bits	1 = Source link-layer
Length	8 bits	1 = 8 octets
Data	48 bits	Ethernet 48 bit MAC

Target Link-layer

The Target Link-Layer Address option contains the link-layer address of the target. It is used only in Neighbor Advertisement and Redirect packets. The field may be a variable number of octets depending on the link-layer type, for example, if Ethernet it is 48 bits as shown below:

Name	Length	Description/Notes
Type	8 bits	2 = Target link-layer
Length	8 bits	1 = 8 octets
Data	48 bits	Ethernet 48 bit MAC

Prefix Information

Prefix Information is used during stateless autoconfiguration and defines the top bits to be added to the low order interface address to create a global unicast address. The Prefix Information option only appears in Router Advertisement packets and must be silently ignored for other messages.

Name	Length	Description/Notes
Type	8 bits	3 = Prefix Information
Length	8 bits	4 = 32 octets
Prefix Length	8 bits	No. of leading bits valid bits in the prefix - valid range 0 - 128.
L	1 bit	1-bit on-link flag. When set, indicates that this prefix can be used for on-link determination. When not set the advertisement makes no statement about on-link or off-link properties of the prefix. For instance, the prefix might be used for address configuration with some of the addresses belonging to the prefix being on-link and others being off-link.
A	1 bit	1-bit autonomous address-configuration flag. When set indicates that this prefix can be used for stateless autoconfiguration.
Reserved	6 bits	Must be set to zero and ignored by receiver.
Valid Lifetime	32 bits	32-bit unsigned integer. The length of time in seconds (relative to the time the packet is sent) that the prefix is valid for the purpose of on-link determination. A value of all one bits (0xffffffff) represents infinity. The Valid Lifetime is also used by stateless autoconfiguration.
Preferred Lifetime	32 bits	32-bit unsigned integer. The length of time in seconds (relative to the time the packet is sent) that addresses generated from the prefix via stateless address autoconfiguration remain preferred. A value of all one bits (0xffffffff) represents infinity.
Reserved	32 bits	Field must be set to zero and ignored by receiver.
Prefix	128 bits	An IP address or a prefix of an IP address. The Prefix Length field contains the number of valid leading bits in the prefix. The bits in the prefix after the prefix length are reserved and MUST be initialized to zero by the sender and ignored by the receiver. Should not be used to send link-local information.

Redirected Header

Can only appear in Redirect Messages.

Name	Length	Description/Notes
Type	8 bits	4 = Redirected Header
Length	8 bits	variable - multiple of 8 octets in range 1 to 161
Reserved	48 bits	Set to zero and ignored by receiver.
IP Header + Data	variable octets	The original packet truncated to ensure that the size of the redirect message does not exceed 1280 octets.

MTU

Allows a router to define for a given route the maximum Message Transfer Unit (MTU or what we used to call a block size!). Only valid on Router Advertisements and ignored for all other messages.

Name	Length	Description/Notes
Type	8 bits	5 = MTU
Length	8 bits	1 = 8 octets
Reserved	16 bits	Set to zero and ignored by receivers.
MTU	32 bits	Unsigned integer defining the maximum number of octets that may be sent to this router for this route.Packets larger than defined by the MTU option will result in 'Packet Too Big' ICMP messages.

ICMPv6

ICMPv6 messages are carried in the Upper Layer of an IPv6 message and are identified by a Next Header value of x'3A (decimal 58). ICMPv6 messages comprise those listed below together with those defined by the Discovery process.

Generic Message Format

The ICMPv6 generic message format is:

Name	Length	Description/Notes
Type	8 bits	Values in the range 0 to 127 indicate error messages and comprise: 1 = Destination Unreachable 2 = Packet too Big 3 = Time exceeded 4 = Parameter Problem Values in the range 128 to 255 indicate informational messages and comprise: 128 = Echo Request (Ping) 129 = Echo Response 130 = Multicast Listener Query 131 = Multicast Listener Report 132 = Multicast Listener Done 133 = Router Solicitation 134 = Router Avertisement 135 = Neighbor Solicitation 136 = Neighbor Advertisement 137 = Redirect
Length	8 bits	1 = 8 octets
Checksum	16 bits	-
Data	variable	Data content is defined by the Type field.

ICMPv6 Error Messages

Destination Unreachable

Name	Length	Description/Notes
Type	8 bits	1 = Destination Unreachable
Code	8 bits	0 = no route to destination 1 = communication prohibited administratively 2 = not assigned 3 = address unreachable 4 = port unreachable
Checksum	16 bits	-
reserved	32 bits	field set to zero and ignored by receiver
Data	variable	as much of the packet as will fit while keeping to a maximum of 1280 octets.

Packet too Big

Name	Length	Description/Notes
Type	8 bits	2 = Packet too Big
Code	8 bits	0
Checksum	16 bits	-
MTU	32 bits	MTU for the next-hop link
Data	variable	as much of the packet as will fit while keeping to a maximum of 1280 octets.

Time Exceeded

Name	Length	Description/Notes
Type	8 bits	3 = Time exceeded
Code	8 bits	0 = hop limit exceedded in transit 1 = fragment reassembly time exceeded
Checksum	16 bits	-
Reserved	32 bits	set to zero ingnored by receiver
Data	variable	as much of the packet as will fit while keeping to a maximum of 1280 octets.

Parameter Problem

Name	Length	Description/Notes
Type	8 bits	4 = Parameter Problem
Code	8 bits	0 - erroneous header field encountered 1 - unrecognized Next Header type encountered 2 - unrecognized IPv6 option encountered
Checksum	16 bits	-
Pointer	32 bits	offset in octets where the problem was found.
Data	variable	as much of the packet as will fit while keeping to a maximum of 1280 octets.

ICMPv6 Informational Messages

Echo Request (Ping)

IPv6 Ping (Echo Request) is similar in function to its IPv4 equivalent. But ICMPv6 Pings may eb sent to a multicast address in which case all nodes addressed should respond - thus it is possible to verify the entire neighborhood in a single ping command.

Name	Length	Description/Notes
Type	8 bits	128 = Echo Request (Ping)
Code	8 bits	0
Checksum	16 bits	-
Identifier	16 bits	unsigned integer. Arbitrary identifier may be used to identify responses.
Sequence	16 bits	unsigned integer. Arbitrary value may be used to identify responses.
Data	variable	arbitrary data which will be returned unmodified in the Echo Response.

Echo Response

Name	Length	Description/Notes
Type	8 bits	129 = Echo Response
Code	8 bits	0
Checksum	16 bits	-
Identifier	16 bits	unsigned integer. Value from the initiating Echo Request - returned unmodified.
Sequence	16 bits	unsigned integer. Value from the initiating Echo Request - returned unmodified.
Data	variable	Value from the initiating Echo Request - returned unmodified.

ICMPv6 Multicast Listener Discovery

ICMPv6 format messages are used for the IPv6 Multicast Listener Discovery Protocol which allows routers to find all nodes that wish to receive specific multicast messages. All MLD messages are sent with a link-local IPv6 Source Address, an IPv6 Hop Limit of 1, and an IPv6 Router Alert option in a Hop-by-Hop Options header. The Router Alert option is necessary to cause routers to examine MLD messages sent to multicast addresses in which the routers themselves have no interest. Three messages are defined in the MLD protocol as described below.

ICMPv6 Multicast Listener Query

Sent by routers on a periodic basis to discovery which hosts are listening to specific or general multicast addresses.

Name	Length	Description/Notes
Type	8 bits	130 = Multicast Listener Query
Code	8 bits	0
Checksum	16 bits	-
Max. Reponse Delay	16 bits	unsigned integer. The Maximum Response Delay field is meaningful only in Query messages, and specifies the maximum allowed delay before sending a responding Report, in units of milliseconds. In all other messages, it is set to zero by the sender and ignored by receivers.
Reserved	16 bits	Set to zero and ignored by sender.
Multicast	128 bits	The multicast address. In a Query message, the Multicast Address field is set to zero when sending a General Query, and set to a specific IPv6 multicast address when sending a Multicast-Address-Specific Query.

ICMPv6 Multicast Listener Report

May be sent in response to a Multicast Listener Query or spontaneously when the host starts listening on particular address.

Name	Length	Description/Notes
Type	8 bits	131 = Multicast Listener Report
Code	8 bits	0
Checksum	16 bits	-
Max. Reponse Delay	16 bits	Set to zero by the sender and ignored by receivers.
Reserved	16 bits	Set to zero and ignored by sender.
Multicast	128 bits	The multicast address. In the Report message, the Multicast Address field holds a specific IPv6 multicast address to which the message sender is listening or is ceasing to listen, respectively.

ICMPv6 Multicast Listener Done

Sent by a host to indicate it is no longer listening to a particular multicast address.

Name	Length	Description/Notes
Type	8 bits	132 = Multicast Listener Done
Code	8 bits	0
Checksum	16 bits	-
Max. Reponse Delay	16 bits	Set to zero by the sender and ignored by receivers.
Reserved	16 bits	Set to zero and ignored by sender.
Multicast	128 bits	The multicast address. In the Done message, the Multicast Address field holds a specific IPv6 multicast address to which the message sender is ceasing to listen, respectively

The Ping6 Command

Ping6 is the IPv6 version of Ping - the following notes apply to ping6 command on FreeBSD - since this uses the KAME stack (www.kame.net) which has been ported to Linux and other OS's it has become the defacto version with minor differences for windows (surprise, surprise) and has a bewildering number of options as shown below.

ping6 [-dfHmnNqtvwW] [-a addr] [-b size] [-c count] [-g gateway] [-h hops]
      [-I iface] [-i wait] [-l pre] [-p pattern] [-P policy] [-S srcaddr]
      [-s size] hops ... host

Where:

Option	Parameter	Description/Notes
a	address type	Uses a ICMPv6 Node Infomation Node address query rather than a echo request. Address type may take any of the following values:
b	buffer size	The socket buffer size which defaults to the packet size (-s option) (56 bytes).
s	packet size	The number of data bytes sent in the ping command. Default is 56 bytes which when added to the ICMPv6 header gives 64 bytes.

The traceroute6 Command

One Day Real Soon Now™

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.