Neighbor Discovery Protocol

What Neighbor Discovery Protocol Does

Neighbor Discovery Protocol, or NDP, is the IPv6 control plane that lets hosts discover local peers, learn which routers are present, and obtain the network information needed to communicate on the local link. It replaces several IPv4-era functions and sits on the critical path for address resolution, router discovery, and first-hop reachability.

Because NDP is part of normal IPv6 operation, it is often assumed to be trustworthy by default. That assumption is dangerous: if a device accepts forged neighbor or router messages, the attacker can redirect traffic, disrupt connectivity, or influence how hosts choose addresses and gateways.

How NDP Works on an IPv6 Link

NDP uses ICMPv6 messages to perform practical network housekeeping that IPv4 handled with ARP and related mechanisms. Hosts use it to map IP-layer neighbors to link-layer addresses, detect whether a neighbor is reachable, and identify routers that can forward traffic off-link.

It also supports configuration behaviors that affect how an IPv6 node joins and uses the network. In many environments, NDP is tightly coupled with SLAAC, router advertisement processing, and default gateway selection, so a compromise in NDP handling can influence both connectivity and routing decisions.

The protocol is local by design, which makes the trust boundary important. A malicious system on the same segment can often see or inject the same message types as legitimate peers unless the network has first-hop protections and the hosts validate messages carefully.

Why Weak Validation Makes NDP Dangerous

NDP is security-sensitive because it controls how nodes decide who is on-link, which routers to trust, and where to send traffic. If those decisions are based on unauthenticated or poorly validated advertisements, an attacker can poison neighbor state, mislead hosts about the default router, or create denial-of-service conditions by causing stale or incorrect mappings.

Those failures matter most at the first hop, where one forged message can affect many systems on the same subnet. The practical result is not just packet loss, but traffic interception, redirection, and network instability that can be hard to distinguish from ordinary IPv6 misconfiguration.

This is why IPv6 deployments are typically paired with controls such as RA filtering, switch-level inspection, and tight ICMPv6 policy. The protocol itself is not broken; the danger comes from trusting unauthenticated local control messages in an environment where local injection is possible.

Operational Controls and Defenses for NDP

Defending NDP starts with knowing where IPv6 is actually enabled, because many issues arise when IPv6 is partially deployed or monitored less carefully than IPv4. Networks should treat router advertisements, neighbor solicitations, and neighbor advertisements as security-relevant control traffic, not just background protocol noise.

First-hop protections matter most when the local segment is shared or only partially trusted. Filtering rogue router advertisements, constraining who can send control-plane messages, and monitoring for abnormal neighbor churn all reduce the chance that a forged message can change host behavior. For a practical IPv6 hardening baseline, see the IPv6 Security Guide.

Operators should also verify that packet capture, IDS, and switch telemetry can actually see ICMPv6 control traffic. If NDP anomalies are invisible, the environment may look healthy while hosts are quietly learning bad neighbor or router state.

What to Review After Suspected NDP Abuse

When NDP abuse is suspected, the question is not only whether traffic was intercepted, but whether host state was altered. Review recent router advertisements, neighbor cache changes, gateway changes, and any unexplained IPv6 connectivity loss or rerouting on affected subnets.

Hosts that accepted forged control messages may need more than a simple network reset. If traffic may have been redirected, inspect for secondary compromise of sessions, exposed credentials, or tampered internal traffic, especially on systems that rely on the local IPv6 segment for authentication or management access.

Because NDP is a low-level protocol, post-incident review should focus on the path the attacker used to inject or observe control traffic. That includes local segment access, misconfigured switch protections, and any place where IPv6 control messages were allowed without validation.

Related resources from NHI Mgmt Group

• What breaks when discovery tools do not detect Model Context Protocol endpoints and exposed AI tooling?
• What are the signs that a discovery protocol is failing in a rotating proxy environment?
• What is the difference between a naive discovery protocol and a greedy discovery protocol for proxy reachability?
• How do you patch or mitigate CVE-2020-3118 (Cisco IOS XR Software Discovery Protocol Format String)?