(futuristic music)
- So here we're gonna talk
about something called the IPv6 Neighbor Discovery process,
which is actually a combination of several IPv6 packets
working together to perform special roles.
In the previous video, I talked about five special
or distinguishable types of IPv6 addresses.
We talked about link-local.
We talked about multicast, and a couple of others,
and I mentioned that there was one more special one
that I want to get to,
but in order to understand that last one,
we have to understand this first.
And then once I go through this,
then my last video on sort of IPv6 general theory
will be on that final, special address
I've been holding back.
So lets talked about IPv6 Neighbor Discovery.
We've talked, as far as layer four protocols are concerned,
we've really focused pretty much exclusively
on TCP and UDP, but I have hinted in some previous slides
that there were others, as well.
Well, one of them that you definitely need to be aware of,
that's a layer four and above protocol, is ICMP,
the internet control messaging protocol, ICMP,
internet control messaging protocol.
So the most common usage of ICMP
is when people issue the ping command.
For example, and you can do this
on your own laptop, as well.
If I open up my command prompt,
bring it over here.
And a lot of times, if you wanna figure out
if you have network connectivity to something,
for example, I know that Google's DNS server,
a server that Google owns that can resolve websites
to IP addresses, is 8.8.8.8.
That's very common knowledge.
It's public knowledge.
And so if I wanna see if I can actually have connectivity
to that, I can type ping and then type in that IP address
and hit enter.
So clearly, now I'm getting a reply.
So what was just happening right there?
So when you type ping, what's actually happening is the CPU
of your device, of my laptop in this case,
is creating an ICMP message,
and ICMP has several different kinds of messages,
depending on what the objective is.
So in this particular case, my laptap was creating
what was called an ICMP echo request, echo request.
Basically, it sending out an echo request to 8.8.8.8,
and if that server is also running ICMP,
which most devices do by default,
it will turn around and send back
to me what's called an ICMP echo reply,
and that's what we see right here.
We see that the first one timed out for some reason,
but then I got three echo replies.
So this was an echo request going out from me.
I actually send four echo requests,
and I got a response back from three of them.
So that was just an example of ICMP in action.
Now, there are other ICMP messages, as well.
I don't have time to get into all of them in this course,
but I would definitely recommend that you Google
the term ICMP and just be familiar with the,
there's about maybe five,
four or five different ICMP messages,
and I've just talked about the top two,
echo request, echo reply.
What does that have to do with this?
Well, just like I mentioned a couple slides back
or a couple videos back, that DHCP had been upgraded for v6,
that there's a DHCPv6.
Well, there's an ICMPv6.
Now, this is kind of interesting when you think about it
because ICMP, because it's layer four,
rides behind an IP header.
So in other words, you've got your IP header here,
and then ICMP is like in the payload of the IP packet.
So one would wonder why did they have to update ICMP?
Well, for one thing, if they had not updated it,
there'd be no way to ping an IPv6 address
because within the body of the ICMP message,
it says who am I trying to talk to?
So not only is the destination in the header
of the IP packet itself,
but the destination you're trying to ping
is also in the body of the ICP message,
saying I'm trying to do an echo request to you.
Can you please respond back?
It's in the body of the packet.
So they had to upgrade ICMP, as well,
in order to be able to handle IPv6 addresses.
In addition to doing that, when they updated ICMP,
they actually added some new ICMP message types
that did not exist before.
So in addition to echo request and echo reply,
which still exist,
they also created four new types of ICMPv6 messages,
which are only applicable for IPv6,
and those are Neighbor Solicitation, Neighbor Advertisement,
Router Solicitation, and Router Advertisement.
All four of those are in the body of an ICMPv6 packet.
In the header of the ICMPv6 packet, in the header,
there's a little type code, and the type code indicates
what kind of ICMP message is this.
Is this an echo request?
Is it an echo reply?
Or there are other type codes for these things right here.
So these specific ICMPv6 message types together,
we call them the Neighbor Discovery Protocol.
So if you hear that term, which you most likely will,
the IPv6 Neighbor Discovery Protocol,
that should key off in your head, oh, okay,
they're talking about how we use these four different kinds
of ICMPv6 messages.
So lets talk about how this process works.
And what I'm gonna specifically gonna refer to
is back when I was talking about IPv6 addresses,
and I was first introducing the concept of an IPv6 address,
I said that a device could have
a statically configured IPv6 address.
I said it could learn about it from a DHCPv6 server
or there was something special in IPv6
called stateless address automatic configuration,
or SLAAC, S-L-A-A-C,
and this, these messages that we see right here
are how our stateless address automatic configuration works.
Let's whiteboard that process,
so you can see what's going on.
Okay, so lets start with our laptop.
And the laptop has a network interface card, a NIC.
And then all of a sudden, it's connected to a cable.
And there's something at the other end of this cable here.
I'm not gonna tell you what it is,
but whatever it is, it's generating electrical signal
so the NIC card on this PC says, aha, okay,
I've been connected to a network.
I know I'm connected to a network.
Now, this NIC card is enabled for IPv6.
That's one of the protocols that's on it.
As a matter of fact, all Windows devices these days
have IPV6 enabled on their NIC cards.
You probably didn't even know it,
but you're running IPv6.
Now we know that a NIC card, because it's connected
to an ethernet segment,
has a burned in address called a MAC address.
So let's put my MAC address on here.
0002.1111.2222.
Alright, so that's the MAC address of this NIC card.
So very first thing this NIC card has to do,
once it enables itself for IPv6,
is it has to create a link-local address for itself.
Do you remember, review question,
how do we recognize link-local addresses in IPv6?
Well, hopefully you said, ah, those are the addresses
that begin with fe80.
You're absolutely right.
So we'll begin with fe80, but before I add that,
we have to convert this into an EUI-64 interface ID.
I'm not gonna explain it.
We already did that in a previous video,
so all I'll say is that my link-local address
will end up being fe80::0202:11ff:fe11:2222.
So that's gonna be my link-local address.
Starts out with fe80,
and then we use the EUI-64 format to convert this
into an interface ID.
Now, one thing I wanna make you aware of right now.
Several years back, there were some engineers
from various different disciplines and companies
who decided that creating an interface ID
out of a MAC address might be kind of insecure
because they said, hey, if somebody was monitoring
your traffic and they always saw
the exact same interface ID,
they could track where you were.
They could say, oh, we can see this guy moved
around through the building throughout the day
because we can see this link-local,
we can see this interface ID,
this same interface ID moving around.
So because, just like IP version 4 right?
When you move from one subnet to the other,
you get a new address via DHCP.
Well, same thing is true with IPv6.
If I'm sitting in Payroll right now,
I'll have some sort of IPv6 network
that belongs to Payroll, but my interface ID
will still be based off of my MAC address
if I'm using EUI-64.
Now if I pick up my laptop and I go over
to the Marketing Department, well, now my IPv6 prefix
has changed because I did DHCP,
and now I'm sitting in their subnet,
but my interface ID has not changed.
If it's using EUI-64, it is still the same
'cause my MAC address goes with me wherever I go.
So some people said, huh,
well, that means if somebody has
some network monitoring equipment set up
like in a building or something,
watching all the packets everywhere,
they could say, oh, interesting.
We see the interface ID here of Joe.
It's his MAC address, and we see it traveling
throughout the building.
Even though the prefix is changing, we can track
where Joe is going because we can see that same interface ID
never changing as it moves around through the network.
So these engineers came up with a different,
I don't know what the RFC is.
It's not off the top off my head,
but there's an RFC that's been out for a while now
that says basically, when a device dynamically comes up
with an interface ID, it should just be
some like random number,
and it should change it every once in a while.
Like every hour or so, it should change it,
so that it can't be tracked.
So the reason I'm saying that to you
is because if you look at the IPv6 address on your laptop,
chances are your interface ID will probably not be
the EUI-64 format.
It probably will not be related to your MAC address.
It's probably running this newer standard
that says it needs to be some random number
that changes over time.
But you do need to know
how EUI-64 interface IDs are created,
especially on Cisco devices
because it's a keyword that you can use on a Cisco device,
and every single Cisco device,
when it creates a link-local address for itself,
it's always based off of the EUI-64 format.
Cisco routers and switches,
they don't use this randomized interface ID thing
that Microsoft Windows and other hosts do.
They always use EUI-64.
So enough said about that.
This device right here creates a link-local address
for itself, and it says, alright, first thing I need to do
is I need to make sure that on this segment
there's nobody else that's using
this exact same link-local address.
I have to make sure that there are no duplicates,
that this is unique.
So he'll send out his very first type
of Neighbor Discovery Packet,
which is an ICMPv6.
We call it Neighbor Solicitation,
and the source will be his link-local,
and the destination,
the destination will be something called
a solicited node multicast address.
Now, that is that special type of address
I have not talked to you about.
I said there was one remaining address that was unique,
that we hadn't talked about.
That's it, and in the next video, I'll talk about this.
But I want to start out by explaining
where this special address is used,
and then we can look at how is it created.
Now, if anybody did have this link-local address here,
what I will tell you
is that the solicited node multicast address
is actually derived from this.
It's derived from that,
so that if somebody on this wire actually did have
this exact same link-local address,
which is highly unlikely,
then they would actually listen to this packet,
and they would respond back.
So hopefully, nobody does,
and so he says, okay.
Now if somebody did respond back,
I'm gonna erase this,
somebody would respond back with a Neighbor Advertisement.
So that's another part of the Neighbor Discovery Process,
Neighbor Solicitation and Neighbor Advertisement.
But in this particular case, we don't wanna see
a Neighbor Advertisement come back
because that would mean uh-oh, somebody's got our address.
So this process right now
of where we're basically sending out a packet saying,
hey, is anybody using my address?
It actually goes by a name that you should be familiar with.
It's called Duplicate Address Detection,
Duplicate Address Detection.
So whenever an IPv6 node either dynamically comes up
with an address for itself
or you statically configure one on there,
it always does this.
It sends out a Neighbor Solicitation packet,
basically for itself, saying,
hey, is anybody out there using this?
Most of the time, probably 99.99% of the time,
nothing should come back.
So you have completed
the Duplicate Address Detection process.
Okay, now, this PC says, okay, great,
I've got a link-local address.
So the next thing it says is I need to get a global prefix.
If I'm ever gonna get off this link and send IPv6 packets
to other departments or even the internet,
I need a global address to do that.
And he says, well, I've been configured for SLAAC,
for stateless address automatic configuration.
So what he does is now he sends out
another type of ICMP message, ICMPv6,
which is called a Router Solicitation,
Solicit, Solicitation.
And once again, the source is gonna be his link-local,
and the destination is gonna be FF02::2.
Now, FF, you should be able to recognize that.
That's one of those patterns I said you should recognize.
That is a multicast address,
and this multicast address has special meaning.
This is called the All IPv6 Routers multicast,
so any router that's enabled to IPv6 is listening
for packets going to this address.
So let' say there is a router.
Hopefully there is one.
Let's put him right here,
and let's say that on that router's interface,
I have configured the following IPv6 address.
Okay?
So looking at that, remember,
how much of this IPv6 address is the prefix, the network?
The first 64 bits.
That's what this subnet mask is telling us,
which is all of this right there.
That's the prefix.
So when this router receives
this Router Solicitation message,
he responds back with, you can probably guess what it is.
A Router-Advertisement.
And he sends it back to that node.
I'm trying to make some room here.
Destination= fe80::0202:11ff:fe11:2222.
So it's going back to that host.
And the source is, see if I can fit it in here,
the router's link-local address
because this router also has one.
So whatever his link-local address is,
that is what the source of this will be.
And here's the great thing.
Inside this Router-Advertisement, in the body of it,
he says, hey, let me tell you what prefixes I have
on this interface.
Now that the host sees that, that Router-Advertisement,
he says, oh, very cool.
I know what the global prefix is that lives on this wire,
so I can use stateless address automatic configuration
to come up with my own global address.
I'll just use that 'cause after all,
that's what the router's using,
and I gotta be on the same thing as the router,
and then, I will use the same interface ID
that I got in my link-local.
I'll just do the EUI-64 process again,
which will end up with the same thing.
And then, once he has this,
he will do Duplicate Address Detection on this.
He'll send out a Neighbor Solicitation message for this.
Shouldn't hear anything back,
and now he knows that it is unique.
So this is how stateless address automatic configuration
works, or Address Autoconfig.
Basically, you gotta come up with a link-local address
for yourself first, verify that there's no duplicates
by sending a Neighbor Solicitation message
to yourself essentially.
Then you send out a Router Solicitation
to this reserved address of FF02::2.
All routers are supposed to listen to that.
When the router hears it,
he sends a Router-Advertisement back.
He sends it to you, your link-local address,
and in the body of that message, he says,
here's the global prefix at everybody on this wire,
here's the group that you're a part of, the subnet,
and now the PC can use that prefix,
once again, create his own interface ID,
and now he has a global prefix that he can use
to speak to the rest of the world.
Now, there is one other,
there's a couple of additional things about this here
that I wanna talk about.
This address is special.
Let me put a red circle around it.
Definitely wanna memorize that.
And every single IPv6 host is also listening
to another special multicast address.
I'll write that on the bottom, I suppose.
That would be FF02::1.
That is the All IPv6 Hosts Address,
and the router's listening to that,
so actually this router is listening to
four addresses, right?
The router's got his link-local.
He's listening to anybody who wants to talk to him
on his global prefix.
He's listening to anybody who wants to send something
to him specifically as just a generic router,
and he is considered a host.
Any NIC card that has IPv6 on it is considered a host,
so he's listening to the All Hosts Address.
So everybody at minimum, at minimum,
devices are listening to three IPv6 addresses,
their link-local, the All Hosts Address,
and the solicited node multicast address.
Now, I know that I haven't defined that one for you yet.
That'll be in the next video.
But every device has a solicited node multicast address,
and that's derived from the link-local address,
and they're also listening
to the All Hosts multicast address.
Now, whether or not they have a global prefix,
they may or they may not.
I mean, if they wanna get off of their subnet,
they're gonna need one, but it's not mandatory.
And routers also listen to this other special address
of the All IPv6 router's address.
(futuristic music)