ARP vs NDP
Side-by-side comparison of ARP (IPv4) and NDP (IPv6) for address resolution and neighbor discovery.
Purpose and Function
Both ARP (Address Resolution Protocol) and NDP (Neighbor Discovery Protocol) solve the same fundamental problem: how to find the MAC address (link-layer address) when you only know the IP address. However, NDP is much more capable than ARP, handling not just address resolution but also router discovery, address autoconfiguration, and duplicate address detection.
Side-by-Side Comparison
Aspect | ARP (IPv4) | NDP (IPv6) |
---|---|---|
Primary Purpose | Find MAC address from IPv4 address | Find MAC address from IPv6 address + much more |
Protocol Layer | Separate protocol (EtherType 0x0806) | Uses ICMPv6 (part of IPv6) |
Broadcast/Multicast | Uses broadcast (ff:ff:ff:ff:ff:ff) | Uses specific multicast addresses |
Security | No built-in security (vulnerable to spoofing) | Can use IPSec for security |
Address Space Efficiency | Broadcasts to all hosts on subnet | Multicasts only to likely neighbors |
ARP (Address Resolution Protocol)
ARP Message Types
ARP Process
- Host A wants to send packet to Host B (knows IP, needs MAC)
- Host A checks its ARP table for cached entry
- If no entry, Host A broadcasts ARP Request
- Host B (owner of target IP) sends ARP Reply with its MAC
- Host A caches the IP/MAC mapping in ARP table
- Host A can now send packets to Host B
ARP Limitations
- No built-in security (ARP spoofing attacks)
- Broadcasts create network noise
- No duplicate address detection
- No router discovery mechanism
- Cache entries can become stale
NDP (Neighbor Discovery Protocol)
NDP Message Types
ICMPv6 Type 135
ICMPv6 Type 136
ICMPv6 Type 133
ICMPv6 Type 134
ICMPv6 Type 137
NDP Process
- Host A wants to communicate with Host B (IPv6 address known)
- Host A checks its neighbor cache for cached entry
- If no entry, Host A sends Neighbor Solicitation to solicited-node multicast
- Only hosts with matching addresses process the NS
- Host B sends Neighbor Advertisement with its MAC address
- Host A caches the IPv6/MAC mapping in neighbor cache
- Periodic reachability confirmation keeps entries fresh
NDP Advantages Over ARP
- More efficient (multicast vs broadcast)
- Built-in duplicate address detection
- Router discovery and autoconfiguration
- Neighbor unreachability detection
- Can use IPSec for security
- Supports mobile IPv6
Practical Differences
Troubleshooting Commands
Purpose | IPv4 (ARP) | IPv6 (NDP) | Windows |
---|---|---|---|
View ARP Table | arp -a | ip -6 neighbor show | netsh interface ipv6 show neighbors |
Clear Cache | arp -d [ip] | ip -6 neighbor del [ipv6] dev [interface] | netsh interface ipv6 delete neighbors |
Send Manual Request | arping [ip] | ndisc6 [ipv6] [interface] | ping [address] (triggers resolution) |
Monitor Traffic | tcpdump arp | tcpdump icmp6 and ip6[40] >= 133 and ip6[40] <= 137 | Wireshark filter: arp or (icmpv6.type >= 133 and icmpv6.type <= 137) |
Common Issues
Description: Attacker sends fake ARP replies to redirect traffic
Detection: Monitor for duplicate MAC addresses or unusual ARP traffic
Mitigation: Use ARP inspection, static ARP entries, or 802.1X
Description: Too many entries cause legitimate entries to be dropped
Detection: Intermittent connectivity to some hosts
Mitigation: Increase ARP table size or implement rate limiting
Description: IPv6 address conflicts not properly detected
Detection: Intermittent IPv6 connectivity
Mitigation: Check DAD configuration and timing
Description: Rogue RAs cause network disruption
Detection: Hosts getting wrong IPv6 configuration
Mitigation: Use RA Guard on switches, monitor for rogue RAs
Best Practices
ARP Best Practices
- Monitor for ARP spoofing attacks
- Use static ARP entries for critical servers
- Implement Dynamic ARP Inspection on switches
- Set appropriate ARP cache timeouts
- Monitor ARP table sizes on routers
NDP Best Practices
- Enable RA Guard on access switches
- Monitor for rogue Router Advertisements
- Configure proper DAD timing
- Use IPSec for NDP security in sensitive environments
- Monitor neighbor cache sizes