ICMPv6 is the unsung hero of IPv6, responsible for everything from telling you your packet got dropped to helping devices find each other on the network.
Let’s see it in action. Imagine two machines, fe80::1 and fe80::2, on the same link. fe80::1 wants to send a packet to fe80::2. It knows the link-local address but needs the MAC address to actually put on the wire.
# On fe80::1, before sending a ping to fe80::2
ping6 fe80::2%eth0
# On fe80::2, you'll see this in tcpdump (or Wireshark)
tcpdump -i eth0 icmp6
What you’ll observe is fe80::1 sending an ICMPv6 Neighbor Solicitation (NS) message to the all-nodes multicast address ff02::1 (or more specifically, to a derived multicast address based on fe80::2’s address). This message is essentially asking, "Who has fe80::2? Tell fe80::1." fe80::2 will then respond with an ICMPv6 Neighbor Advertisement (NA) message, including its MAC address, directly back to fe80::1’s link-local address. Once fe80::1 has this MAC address, it can construct the Ethernet frame and send the ping.
This process is called Neighbor Discovery, and it’s a core function of ICMPv6, replacing ARP in IPv4. Neighbor Discovery handles several critical tasks:
- Address Resolution: As seen above, mapping an IPv6 address to a MAC address.
- Router Discovery: When a host boots up, it sends a Router Solicitation (RS) to the all-routers multicast address
ff02::2. Routers on the link respond with Router Advertisements (RA) that tell hosts the prefix(es) for the network, default gateway(s), and other configuration parameters like whether to use DHCPv6. - Duplicate Address Detection (DAD): Before a host assigns an address to an interface, it sends an NS for that address. If another host already uses it, it will respond with an NA, and the first host knows it can’t use that address.
- Redirects: If a router knows a better path to a destination, it can send an ICMPv6 Redirect message to a host.
The ICMPv6 protocol is defined in RFC 4861 (Neighbor Discovery) and RFC 4443 (Basic ICMPv6 Messages). Unlike IPv4’s ICMP, ICMPv6 has a stronger relationship with the IPv6 layer. ICMPv6 messages are carried directly within IPv6 packets, with the IPv6 header’s Next Header field set to 58 (indicating ICMPv6). This tight integration means that ICMPv6 messages are crucial for the very operation of IPv6. Without ICMPv6, IPv6 hosts wouldn’t be able to find each other, discover routers, or even configure themselves.
The surprising thing is how much critical network infrastructure functionality is bundled into what looks like a simple "error reporting" protocol. When you see an ICMPv6 packet, don’t just think "ping failed." Think "this packet is telling me something fundamental about how these two devices can communicate or how the network is configured." The vast majority of ICMPv6 traffic you’ll see in a healthy network isn’t error-related; it’s Neighbor Discovery messages keeping the network alive and functional.
The next logical step is understanding how these Neighbor Discovery messages are used for stateless address autoconfiguration (SLAAC), where hosts can generate their own global IPv6 addresses without a DHCP server.