Summary

  • RFC 9898 reduces a scattered body of IPv6 Neighbor Discovery experience to three causes: multicast, trusting all nodes on a link and creating router NCEs on demand.
  • A REACHABLE NCE supports forwarding to an on-link address at a moment in time. It does not prove address ownership, subscriber identity, authorization throughout an incident window or application success.

The incident review began with a green line from the first-hop router. At the relevant minute, its neighbor table contained the IPv6 address, a link-layer address and a REACHABLE state. Packets had moved. The next question was not a routing question: which subscriber was accountable for the address?

The green line could not answer. It was produced by working code, but the code had been asked to maintain a forwarding relationship, not a legal or commercial identity ledger. Turning that entry into an identity conclusion would not make the evidence stronger. It would only hide the missing witnesses.

RFC 9898 is valuable because it collects more than twenty earlier documents and organizes fifteen Neighbor Discovery problems around three causes. ND uses multicast for several operations. Its original model assumes nodes on a link can be trusted. Routers may also create Neighbor Cache Entries on demand when packets arrive for on-link destinations. Those design choices work, but their cost changes with wireless loss, public access, address scale and hostile traffic.

The base semantics are in RFC 4861. A node conceptually maintains a Neighbor Cache, Destination Cache, Prefix List and Default Router List. The Neighbor Cache is keyed by an on-link unicast IP address and can hold a link-layer address, an IsRouter flag, queued packets and Neighbor Unreachability Detection state. The Destination Cache answers a different question: the next hop for a destination. The Prefix List describes prefixes considered on-link. The Default Router List identifies candidate routers.

An implementation may merge those structures internally, but an evidence model should preserve their separate claims. A destination selected by routing is not yet a resolved neighbor. A resolved neighbor is not yet a verified subscriber. A router selected as reachable is not proof that the remote application completed a request.

When link-layer information is absent, the sending node creates an NCE in INCOMPLETE state, multicasts a Neighbor Solicitation and queues the packet. A valid solicited Neighbor Advertisement can install the link-layer address, move the entry to REACHABLE and release queued traffic. Later, the entry can move through STALE, DELAY and PROBE as the implementation tests whether the neighbor remains usable.

These states are deliberately operational. REACHABLE says that the forward path to the neighboring IP layer has recently been confirmed under ND's rules. STALE says the link-layer address is known but reachability has not been recently confirmed. Neither state contains an entitlement field. Neither records who bought, leased, delegated or was contractually assigned the address. Neither preserves a complete history after eviction or reset.

RFC 9898 exposes the consequence through “Router-NCE-on-Demand.” When a router receives a packet for an on-link address it does not know, it creates an INCOMPLETE entry and begins resolution. The target may be real. It may also be nonexistent. A remote attacker can send traffic toward many unused addresses and make the router allocate many incomplete entries without ever joining the local link.

That fact is decisive for interpretation. The table is a bounded work queue as well as a set of useful mappings. Occupancy does not equal a census of real hosts. An INCOMPLETE entry can be the residue of an unanswered question. An absent entry can mean eviction, timeout, restart, lack of recent traffic or a limit, not absence of the host.

RFC 9898 names three consequences. First is exhaustion: CPU or memory can be consumed by unresolved targets. Second is first-packet delay and possible loss while the router buffers traffic and performs resolution. Third is lack of address accountability. With SLAAC, the host forms addresses; the router may learn them only when an NCE is needed. Even DHCPv6 does not automatically give the forwarding router a complete view unless the deployment adds observation such as snooping or registration.

The remedies answer different questions. RFC 6583 recommends filtering unused address space, rate limiting ND work and prioritizing existing entries over new resolution. Those controls preserve capacity. A configured cap prevents unbounded growth, but if the number of legitimate addresses exceeds it, valid traffic can still encounter a missing entry and be dropped. A protected cache is not a subscriber registry.

RFC 9131 addresses the first-packet problem from another direction. Gratuitous Neighbor Discovery can let a first-hop router create a STALE entry before return traffic arrives. That can avoid waiting for multicast resolution when the first packet is already queued. It improves readiness. It does not convert STALE into proof of current reachability, much less lawful control of the address.

Security controls have similarly bounded jurisdictions. RFC 9099 reviews ND threats and protections. SAVI can bind an address to a switch port and reject claims from other ports. RA-Guard can constrain which ports originate Router Advertisements. DHCPv6 address registration can record a host's self-generated or static address. Each adds useful evidence. None is interchangeable with the others, and a dashboard labelled “ND secure” should not erase which control supplied which fact.

RFC 9898's strongest architectural observation concerns isolation. L3 and L2 isolation place hosts in separate subnets and links, shrinking multicast and trust domains and eliminating the need for Router-NCE-on-Demand for host routes. L3-only isolation gives each host or client a unique prefix while a medium may remain shared. Partial L2 isolation divides multicast domains with proxy mechanisms. Non-isolating solutions mitigate individual symptoms.

The ranking is not a universal mandate. Stronger isolation demands more capability and may mean many logical interfaces, router bottlenecks or disruption to host-to-host multicast services. RFC 8273 also warns that assigning the same unique prefix to the same link-layer address can make a host easier to track. RFC 9663 shows how DHCPv6 Prefix Delegation can allocate unique client prefixes at large scale, but operational feasibility does not remove the need for privacy and retention choices.

A defensible investigation therefore joins independent events. Preserve the prefix assignment or delegation, including validity interval and assigning authority. Record the access circuit, subscriber or device session and authentication result. Capture the switch-port, radio bearer or attachment binding. Retain any SAVI or DHCPv6 registration event. Then add the NCE transition with interface, IP address, link-layer address, state, reason and clock quality. Packet observations and application records close later boundaries.

Time is part of the key. A mapping observed after an incident cannot silently stand in for a mapping during it. A reused privacy address, randomized MAC, reconnect, failover or cache refresh can change one component while leaving the printed IPv6 address familiar. The evidence chain should state its retention gaps and clock uncertainty instead of manufacturing continuity.

This is where Heng Lu's Running-Code Primacy is stricter than a dashboard. The router's running code has authority over the cache transition it executed. The access system has authority over the session it authenticated. The delegation service has authority over the prefix it issued. The application has authority over the transaction it committed. No observer gains jurisdiction over all the others merely because its table is easy to query.

Reality Layers supplies the same discipline in another form: a symbol becomes dangerous when it is allowed to substitute for the layer it only describes. Data Sovereignty distinguishes practical technical control from larger claims of authority. An NCE is practical control data. Calling it ownership would be a category error.

The protocol need not become a universal identity system. Minimum Initial Specification points toward a thinner settlement: keep interoperable discovery and reachability semantics common; let operators select cache budgets, isolation strength, address registration, privacy controls, logging, retention and rollback according to the topology they actually run.

The useful executive question is not “did the router have the address?” It is: which system observed which relationship, for what interval, under which failure mode, and what independent record connects local forwarding state to the accountable principal?

Sources