Summary

  • RFC 4620 offered IPv6 diagnostic tools a direct way to ask a node for selected name or address information, especially on links where DNS or global routing might not be available.
  • The responder could refuse, had to limit disclosure by default, and did not turn its answer into an authenticated identity or authoritative directory record.

Analysis

An automatically configured IPv6 address can be valid and still be difficult for a human to use while bringing up a link or diagnosing a peer. DNS may not be available on a local segment, and a link-local address may never appear in a public DNS zone. Yet a network operator may need to know which node is answering, or which other addresses it associates with a name.

In August 2006, RFC 4620 proposed a direct question for that narrow setting. Michael Crawford and Brian Haberman described IPv6 Node Information Queries as an Experimental protocol for diagnostic tools, debugging and network management. The document explicitly said that DNS remained the authoritative source for names and addresses on the global Internet. The new mechanism was not a second global naming system: it was a way to ask a reachable node for information that might be useful on a link or in a serverless environment.

The exchange used ICMPv6 message type 139 for a query and 140 for a reply. A query identified the responder to contact and the subject to ask about; the two addresses could differ. Its defined Qtypes covered a no-op, node name, IPv6 node addresses and IPv4 addresses; the address query had flags to select address scopes and whether to request all addresses. A diagnostic program could therefore ask a live endpoint what it reported, instead of treating a registry or DNS answer as a complete description of every local interface.

The protocol also made refusal a defined outcome. A response code could mean success, refusal, or an unknown query type. A successful reply could still contain no data. Those distinctions matter: an empty result is not proof that a machine is absent, and refusal is not a malformed exchange. The responder first checked whether the packet was addressed to one of its own unicast or anycast addresses, or to a joined link-local multicast group. The RFC allowed local policy to discard queries.

A 64-bit nonce was copied from query to reply so that the requester could match the response and make blind spoofing harder. But the authors did not mistake correlation for authentication. They warned that an observer able to eavesdrop could defeat that protection, recommended IPsec when communication security was required, and said returned information should not drive security-relevant decisions without some separate authentication mechanism.

Disclosure was bounded too. The default configuration had to refuse queries from global-scope addresses; implementations were encouraged to rate-limit replies. The RFC called out IPv6 Privacy Addresses specifically: software should let operators control their disclosure, should normally withhold them, and must not mix them into certain responses that also reveal public addresses. The IANA registry still assigns types 139 and 140 and the associated query and response codes. That continuing registration records protocol numbers; it does not show that a random host will answer.

The authors placed the idea in practical context without claiming broad adoption. RFC 4620 pointed to ping6 in KAME, USAGI and other IPv6 implementations as an example of diagnostic use. Current Nmap documentation also describes a discovery script that can issue these queries. Such examples establish that tools can use the mechanism, not how many networks permit it or how often it succeeds. That boundary is especially important for a protocol whose expected responder behavior includes silence and refusal.

RFC 4620’s historical contribution is therefore a modest one: it made a node’s local self-report queryable for troubleshooting while keeping the answer optional and explicitly weaker than an authoritative record. A node could help an operator identify a peer, but the exchange did not grant the operator a right to inventory every address, establish who controlled the node, or prove that the reported name matched an organization. Discovery was useful precisely because its scope and evidentiary limits remained visible.

Sources