IPv6 Binding Table and ND Inspection

With RA Guard and DHCPv6 Guard, you closed two doors on the Hacker.
A third door is still open: the way hosts resolve an IPv6 address into a MAC address.

Neighbor Solicitation

PC1 wants to send traffic to R1, your gateway.
It knows R1's IPv6 address, but not the MAC address behind it, so it cannot build the frame yet.

Figure 1 – PC1 sends a Neighbor Solicitation to find R1's MAC

PC1 sends a Neighbor Solicitation (NS), asking who owns that IPv6 address.
This is the IPv6 replacement for the ARP request you already know.

Neighbor Advertisement

R1 answers with a Neighbor Advertisement (NA), carrying its own MAC address.

Figure 2 – PC1 stores the mapping in its neighbor cache

PC1 stores the pair in its neighbor cache, the IPv6 version of the ARP table.
From now on, PC1 sends every packet for R1 to that MAC address.

The Spoofed NA

But who checks that the NA really came from R1?
Nobody on your segment.

Imagine a hacker sends a forged NA claiming R1's IPv6 address and using its own MAC address.

Figure 3 – A spoofed NA from the Hacker

The NA carries the Override flag, which orders PC1 to overwrite the entry it already has.

PC1 has no way to tell the difference, so it believes it.
Its neighbor cache now maps R1's address to the Hacker's MAC.

Figure 4 – PC1's traffic now flows through the Hacker

Every packet PC1 sends to your gateway now reaches the Hacker first.

To reject a lie, your switch first needs to know the truth.
It records who really owns each address, before any attacker shows up.

What the Switch Memorizes

SW1 keeps a binding table: one line per IPv6 address it sees on the segment.
PC1 alone takes two lines: its link-local and its global unicast address.

Figure 5 – The binding table: one line per IPv6 address

Each entry ties four things together:

• the IPv6 address of the device

• its MAC address

• the switch port it lives behind

• its VLAN

You already met this idea in IPv4: the DHCP snooping binding table.

Filling the Table

SW1 fills the table by listening to the traffic that already crosses it.

It watches three sources:

• the NS and NA messages devices exchange to resolve each other

• the DAD (Duplicate Address Detection) messages, a special NS a device sends when it first claims an address

• the DHCPv6 exchange, when a server hands out the address

When PC1 first spoke on the segment, SW1 saw it and wrote the line down.
Your honest devices fill the table simply by being there first.

Imagine ND inspection is already configured on SW1.
Follow the story from the first honest message to the dropped lie.