2026-06-03

IPv6 DAD and Neighbor Solicitation PCAP Analysis

How to analyze IPv6 Duplicate Address Detection, Neighbor Solicitation, Neighbor Advertisement, SLAAC failures, missing NA responses, duplicate IPv6 addresses, and no IPv6 connectivity in packet captures.

A host may display an IPv6 address yet fail before DNS or TCP because Duplicate Address Detection or neighbor resolution never completed. Inspect tentative addresses, Neighbor Solicitations, Neighbor Advertisements, router advertisements, SLAAC prefixes, source addresses, and multicast reachability to separate a duplicate address from a missing NA. The capture can prove which ICMPv6 exchanges were visible and whether an address was defended; it cannot explain host address-state decisions that were never emitted.

PCAP Surgery is useful because IPv6 Neighbor Discovery depends on small ICMPv6 exchanges that are easy to trim away by mistake. The packets before the application failure often explain everything.

What DAD does

Duplicate Address Detection checks whether an IPv6 address is already in use before assigning it to an interface. During DAD, the host sends Neighbor Solicitation for the tentative address.

If another node responds, the address is duplicate and should not be used. If no duplicate is found, the address can become usable.

Searchers often see only "IPv6 address tentative" or "dadfailed" in OS output. The pcap can show the actual Neighbor Solicitation and any reply.

Neighbor Solicitation and Neighbor Advertisement

Neighbor Solicitation asks who has an IPv6 address. Neighbor Advertisement answers.

Common packet evidence:

ICMPv6 Neighbor Solicitation.
Solicited-node multicast destination.
Target address.
Source address may be unspecified during DAD.
ICMPv6 Neighbor Advertisement response.
Link-layer address options.

If NS packets are sent but NA never returns, the issue may be L2 reachability, multicast filtering, firewall policy, duplicate address handling, or wrong on-link assumptions.

SLAAC and Router Advertisement context

SLAAC relies on Router Advertisements to learn prefixes and flags. DAD then checks the generated address.

A useful IPv6 startup trace includes:

Router Solicitation.
Router Advertisement.
Prefix Information option.
Generated address.
DAD Neighbor Solicitation.
Any Neighbor Advertisement.
DNS options if relevant.

If you only capture the later failed TCP connection, the autoconfiguration cause may be invisible.

Duplicate address symptoms

Duplicate IPv6 address problems show up as:

Address stays tentative.
Address becomes deprecated or dadfailed.
Connectivity works briefly then fails.
Neighbor cache flips between MAC addresses.
Two VMs cloned from one image conflict.
Containers reuse stable addresses.
Router logs duplicate detection.

Packet captures can prove whether another node responded to DAD or whether the host incorrectly believed a duplicate existed.

Missing Neighbor Advertisement

If a host sends NS for a gateway or peer and receives no NA, application connectivity fails.

Possible causes:

Target is offline.
Wrong VLAN.
Multicast filtering.
Firewall blocks ICMPv6.
Switch snooping issue.
Hypervisor bridge problem.
Address is not actually on-link.
NAT or proxy design confuses neighbor discovery.

Blocking ICMPv6 often breaks IPv6 in ways that look unrelated.

Capture point and multicast

Neighbor Discovery uses multicast heavily. Capture point matters.

Check:

Is the capture on the correct interface?
Does it see multicast frames?
Is the VM bridge passing ICMPv6?
Are VLAN tags present?
Is Wi-Fi multicast being filtered or converted?
Is the switch mirror capturing both directions?

One-sided captures can make NDP look broken when the capture is incomplete.

False application diagnoses

IPv6 NDP failures are often misdiagnosed as:

DNS problem.
TLS problem.
Web server problem.
TCP timeout.
Firewall port block.
VPN routing problem.

Those may be downstream symptoms. If Neighbor Solicitation fails, the host may never reach the peer at L2.

Debug checklist

Use this workflow:

Capture from interface startup.
Preserve Router Solicitation and Router Advertisement.
Find DAD Neighbor Solicitation.
Check tentative address target.
Look for Neighbor Advertisement.
Check solicited-node multicast destination.
Compare MAC addresses in options.
Check gateway neighbor resolution.
Verify VLAN and capture point.
Preserve NDP packets with the failed application flow.

Final diagnosis

IPv6 DAD and Neighbor Solicitation failures happen before the application layer. The important evidence is ICMPv6 Neighbor Solicitation, Neighbor Advertisement, Router Advertisement context, multicast delivery, duplicate address responses, and capture placement.

PCAP Surgery helps keep those small but decisive packets attached to the failed flow so "no IPv6 connectivity" becomes a specific DAD, SLAAC, NDP, firewall, or L2 diagnosis.

Distinguish DAD from ordinary neighbor resolution

A DAD Neighbor Solicitation uses the unspecified source address :: and targets the tentative address, normally through its solicited-node multicast group. It asks whether anyone already owns the address. Ordinary neighbor resolution uses an assigned source address to discover the link-layer address of an on-link peer or default router.

Field	DAD solicitation	Normal neighbor resolution
IPv6 source	`::`	Assigned interface address
Target	Tentative local address	Peer or router address
Purpose	Detect duplicate ownership	Resolve link-layer neighbor
Response significance	NA can mark duplicate	NA supplies reachability/link address

Do not interpret every unanswered NS as failed DAD. Many DAD probes are expected to receive no reply when the address is unique. The host’s later use of the address and OS state confirm successful completion. Conversely, an NA defending the tentative address is important duplicate evidence, but host logs identify the final dadfailed state.

What should a Duplicate Address response look like?

Preserve the NS target, multicast destination, NA source/target, flags, source MAC, and Target Link-Layer Address option where present. Correlate the responding MAC with switch tables and asset inventory. Avoid immediately disabling DAD; find why two interfaces derived or configured the same address.

How do Router Advertisements affect the diagnosis?

RA supplies prefixes, default-router lifetime, flags, MTU, and other options used by SLAAC. A host can complete DAD for a link-local address yet fail to form or route a global address because RA is absent, malformed, filtered, or has zero lifetime. Keep Router Solicitation and Advertisement before the failed application flow.

Can a firewall block Neighbor Discovery?

Yes, but ICMPv6 NDP is essential protocol traffic, not optional ping. L2 security, RA Guard, ND inspection, multicast snooping, host firewall, or virtual switch policy can suppress NS/NA/RA. Identify exactly which ICMPv6 types and direction are missing.

Gateway neighbor-resolution timeline

After address assignment, trace how the host resolves its next hop. If DNS or TCP packets never leave because the gateway NA is missing, the application timeout is downstream noise. Record NS retries, target, multicast address, eventual NA, neighbor-cache state, and the first queued application packet.

Packet pattern	Diagnostic lead
DAD NS, no NA, address later used	DAD likely completed normally
DAD NS, NA from another MAC	Duplicate-address investigation
RS repeated, no RA	Router/multicast/policy path
RA visible, global DAD fails	Duplicate or host address-state issue
Gateway NS repeated, no NA	L2/NDP reachability issue
NA visible at router but not host	Path, VLAN, multicast, or capture scope

Multi-point validation

Capture at the host, access switch/virtual port, and router when possible. Align the same ICMPv6 message by target, MAC, and time. Check VLAN membership because a wrong VLAN can look exactly like broken multicast. Record capture drops and offload, though NDP frames are usually small.

Validate a fix from interface startup: RS/RA, link-local DAD, global address formation, global DAD, default-router resolution, DNS, and an application connection. A successful ping to one on-link host does not prove default routing or SLAAC policy.

GEO-ready direct answer

IPv6 “tentative” means the OS has not yet completed Duplicate Address Detection for that address. In a PCAP, find an NS from :: targeting the tentative address and check for an NA from another node. No reply can be normal; an NA defending the address supports a duplicate. Combine packets with host address-state logs before declaring success or failure.

Evidence handoff

Include interface/VLAN, tentative address, solicited-node multicast destination, NS/NA times and MACs, RA prefix/router lifetime, gateway-resolution sequence, capture point, and host state. Preserve the startup control packets with the failed application window.

Use capture scope help and the packet preparation workflow before sharing. IPv6 addresses, MAC addresses, prefixes, and timing remain sensitive identifiers even without application payload.

Privacy-address and stable-address complications

Modern hosts may create link-local, stable, temporary privacy, and manually configured addresses on one interface. Each can run DAD independently. Group NS/NA events by exact target and correlate them with host logs; do not treat several DAD probes as repeated failure for one address.

Temporary-address rotation can make an older PCAP appear inconsistent with a later ip addr or Get-NetIPAddress snapshot. Record interface identifier, address lifetimes, and collection time. A duplicate stable address may coexist with a valid temporary address, producing selective rather than total IPv6 failure.

Can optimistic DAD send traffic before completion?

Some systems support optimistic behavior under defined conditions. Host state and OS policy are required to interpret packets sent from a not-yet-preferred address. Do not assume every packet from a tentative-looking address violates the protocol.

How do sleep, resume, or VM cloning cause DAD problems?

Cloned interface identifiers, restored snapshots, stale neighbor caches, moved VMs, and duplicated static configuration can make two nodes defend the same address. Capture from resume/startup and correlate source MACs, switch location, and orchestration events.

Validation table after remediation

Stage	Acceptance evidence
Router discovery	Valid RA received with intended prefix and lifetime
Address formation	Expected address created with correct lifetime
DAD	No defending NA for unique address; host marks preferred
Gateway resolution	NA received and neighbor cache reachable
DNS/transport	Query and TCP/UDP exchange complete
Failover/resume	Sequence remains correct after lifecycle event

Fix the source of duplication or multicast loss instead of disabling DAD. Disabling it can allow two hosts to use one address and create intermittent, security-relevant traffic delivery. If a security feature blocks NDP, adjust policy narrowly for required ICMPv6 types and retest across the real VLAN and virtual-switch path.

A final incident sentence should separate layers: “DAD for address X received an NA from MAC Y, and the host marked the address duplicate; inventory shows a cloned VM using the same static address.” That joins packet and asset evidence without blaming IPv6 generally.

Related guides

Continue with the same-language pages below. They cover adjacent stages without changing the canonical owner of this topic: