ARP vs NDP — neighbour discovery at Layer 2 / Layer 3, IPv4 and IPv6 side by side

ARP and NDP do the same job for two different address families. ARP turns an IPv4 next-hop into a MAC. NDP turns an IPv6 next-hop into a MAC. Both produce an entry in the Linux neighbour table that the kernel reads on every outgoing packet. Both can fail in ways that look like routing failures but are not.

The routing engineer needs both. An estate running IPv4 only needs ARP. An estate running dual-stack needs both. An estate running IPv6 only — increasingly common in operator circles — needs only NDP but still needs to understand why the link-local multicast behaves the way it does.

ARP for IPv4

ARP is a two-message protocol. The host broadcasts an ARP request asking “who has IP X?” The owner of X replies with an ARP reply containing its MAC. The kernel caches the result in the neighbour table.

sequenceDiagram
  autonumber
  participant H as Host (sender)
  participant N as Next-hop host

  H->>N: ARP Request (broadcast: who has 192.0.2.1? tell 192.0.2.50)
  N->>H: ARP Reply (unicast: 192.0.2.1 is at aa:bb:cc:11:22:33)
  Note over H: kernel caches aa:bb:cc:11:22:33 for 192.0.2.1

The ARP packet is encapsulated directly in an Ethernet frame with ethertype 0x0806. There is no IP header. The ARP message carries the sender IP and MAC, the target IP and MAC (unknown in the request, filled in the reply), and the operation code (request = 1, reply = 2).

ARP is a broadcast protocol. The request goes to the broadcast MAC ff:ff:ff:ff:ff:ff, which every host on the segment receives. The reply is unicast. This is the source of one of ARP’s biggest limitations: ARP requests scale linearly with the number of hosts on a segment, and the broadcast is unbounded.

NDP for IPv6

NDP replaces ARP for IPv6. NDP uses ICMPv6 messages (ethertype 0x86DD for IPv6, protocol 58 for ICMPv6) carried over multicast — not broadcast. The five NDP messages:

sequenceDiagram
  autonumber
  participant H as Host (sender)
  participant N as Next-hop host

  H->>N: NS (multicast to ff02::1 / solicited-node multicast of 2001:db8::1)
  N->>H: NA (unicast: 2001:db8::1 is at aa:bb:cc:11:22:33)
  Note over H: kernel caches aa:bb:cc:11:22:33 for 2001:db8::1

The NS is sent to the solicited-node multicast address, which is ff02::1:ffXX:XXXX where the last 24 bits are the last 24 bits of the target IPv6 address. This is more efficient than broadcast: only hosts whose address ends in those bits actually process the NS.

The NA is unicast back to the requester. The kernel caches the result in the neighbour table.

Reading the neighbour table for both families

The Linux kernel maintains a single neighbour table that contains entries for both IPv4 and IPv6. The ip neigh command shows both:

ip -s neigh show dev eth0

The output looks like:

192.0.2.1 dev eth0 lladdr aa:bb:cc:11:22:33 REACHABLE
fe80::1 dev eth0 lladdr 00:11:22:33:44:55 router STALE
2001:db8::1 dev eth0 lladdr aa:bb:cc:11:22:33 REACHABLE
192.0.2.254 dev eth0 lladdr dd:ee:ff:00:11:22 STALE

The columns are family-agnostic: the state, the device, the link-layer address (MAC), and the state.

The IPv6-specific information is in ip -6 neigh show. The Linux kernel also exposes ndisc6 for explicit IPv6 neighbour discovery from the operator’s shell.

ndisc6 fe80::1 eth0
ndisc6 2001:db8::1 eth0

These send an NS for the target and report what came back. The result is the equivalent of arping for IPv4.

VyOS configuration knobs

VyOS exposes per-interface knobs for both families:

configure
# IPv4
set interfaces ethernet eth0 ip enable-arp
set interfaces ethernet eth0 ip arp-cache-timeout 1800
set interfaces ethernet eth0 ip proxy-arp
set interfaces ethernet eth0 ip alias-address 192.0.2.65

# IPv6
set interfaces ethernet eth0 ipv6 address autoconfig
set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 1
set interfaces ethernet eth0 ipv6 router-advert cur-hop-limit 64
commit
save

The IPv4 knobs:

• enable-arp — whether the interface answers ARP requests (defaults to true)
• arp-cache-timeout — kernel neigh_unreachable_time for entries on this interface
• proxy-arp — whether the interface responds to ARP requests for IPs it does not own (a security-sensitive setting)
• alias-address — secondary IP address on the interface

The IPv6 knobs:

• ipv6 address autoconfig — enable SLAAC
• dup-addr-detect-transmits — DAD attempts before claiming an address
• router-advert — Router Advertisement configuration (prefix, lifetime, DNS server, etc.)

Failure modes

ARP failures

NDP failures

What the routing engineer has to remember

The routing engineer who knows the IPv4 column but not the IPv6 column will struggle to diagnose IPv6 incidents. The two columns look similar but the failure modes are different — especially the multicast-based NDP, which behaves subtly differently from broadcast-based ARP.

Validation

The diagnostic sequence when IPv4 or IPv6 traffic is not flowing on the local segment:

# Both families
ip -s neigh show dev eth0
tcpdump -nei eth0 -c 20

# IPv4 specifically
arping -c 3 -I eth0 192.0.2.1

# IPv6 specifically
ndisc6 fe80::1 eth0
tcpdump -nei eth0 -c 20 'icmp6'

arping and ndisc6 are the canonical debug tools for sending a single ARP or NS and reporting the result. The tcpdump captures the wire-level evidence.

Cross-course references

• The Linux course’s XIX-Linux-NetFoundations covers the neighbour subsystem from the host perspective.
• The OPNsense course covers the FreeBSD-specific arp and ndp tools, with the equivalent FreeBSD behaviour for proxy-ARP and NDP.
• The lesson on Ethernet, MAC and ARP (Part I, lesson 01) covers the kernel neighbour subsystem in greater depth.

Quiz

Production discipline

ARP and NDP are the two protocols that make routing work. Either failing makes routing look broken even when the routing table is correct. The operator who diagnoses routing incidents without first reading the neighbour table is the operator who opens the wrong ticket every time.

Plan the neighbour-table configuration once. Document the proxy-arp decisions. Validate the IPv6 accept_ra settings on hosts. Then routing and neighbour resolution either work or fail predictably.