How To “arp -a” In IPv6

 

When migrating to IPv6 you may wonder the equivalent of arp is when you are trying to match MAC addresses with IP addresses.

IPv6 uses Neighbor Discovery Protocol in place of IPv4’s arp. On Windows use netsh int ipv6 show neigh, on Linux use ip -6 neigh , and in MacOS use ndp -a in place of arp -a.

IPv6 ‘arp’ For Windows: netsh int ipv6 show neigh

The full command is netsh interface ipv6 show neighbors, but the Windows built-in netsh allows you to abbreviate commands. netsh i ipv6 sh n works, too.

netsh int ipv6 show neigh

# Interface 1: Loopback Pseudo-Interface 1
# 
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# ff02::c                                                          Permanent
# ff02::16                                                         Permanent
# 
# Interface 12: Teredo Tunneling Pseudo-Interface
# 
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# ff02::16                                      255.255.255.255:65535  Permanent
# 
# Interface 10: Local Area Connection
# 
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# 2001:db8:192:0:24b8:55b8:eb04:c651            40-61-86-e1-6e-1c  Reachable
# 2001:db8:192:0:3c15:852:f73e:4467             1c-4b-d6-fb-5e-99  Stale
# 2001:db8:192:0:3dcc:ff5d:fe1f:faef            1c-4b-d6-fb-5e-99  Reachable
# 2001:db8:192:0:4261:86ff:fee1:6c83            40-61-86-e1-6c-83  Reachable
# 2001:db8:192:0:a0cc:55f4:170e:499b            1c-4b-d6-6b-31-1c  Stale
# 2001:db8:192:0:a539:c48e:4c21:2f17            Unreachable        Unreachable
# fe80::24b8:55b8:eb04:c651                     40-61-86-e1-6e-1c  Stale
# fe80::3dcc:ff5d:fe1f:faef                     1c-4b-d6-fb-5e-99  Stale
# fe80::4261:86ff:fee1:6c83                     40-61-86-e1-6c-83  Stale
# fe80::6a7f:74ff:fe91:9a4                      68-7f-74-91-09-a4  Stale (Router)
# fe80::a539:c48e:4c21:2f17                     1c-4b-d6-6b-31-1c  Stale
# ff02::c                                       33-33-00-00-00-0c  Permanent
# ff02::16                                      33-33-00-00-00-16  Permanent
# ff02::1:3                                     33-33-00-01-00-03  Permanent
# ff02::1:ff04:c651                             33-33-ff-04-c6-51  Permanent
# ff02::1:ff0e:499b                             33-33-ff-0e-49-9b  Permanent
# ff02::1:ff1f:faef                             33-33-ff-1f-fa-ef  Permanent
# ff02::1:ff21:2f17                             33-33-ff-21-2f-17  Permanent
# ff02::1:ff3e:4467                             33-33-ff-3e-44-67  Permanent
# ff02::1:ff91:9a4                              33-33-ff-91-09-a4  Permanent
# ff02::1:ffe1:6c83                             33-33-ff-e1-6c-83  Permanent

You may notice some duplicate and unreachable physical (MAC)  addresses. The unreachables are due to privacy addresses. My Windows boxes by default use temporary IPv6 addresses than change periodically to attempt some measure of privacy. I think this is dumb, and it can be turned off by “netsh interface ipv6 set privacy state=disabled” on each machine. The duplicates are because each MAC has multiple IPv6 address scopes. Most machines will have the public IPv6 address and a link-local IPv6 address, usually starting with fe80.

I will also draw your attention to the fact that the physical MAC address is transliterated and somewhat recognizable in the internet address for link local addresses and most non-private addresses. Current Ethernet MAC’s are 48-bit addresses. IPv6 is geared for 64-bit unique identifiers, and there is a standard conversion to represent MACs as EIU-64 addresses.

The ff02: addresses are multicast addresses. In IPv6 there is no broadcast, but there are various multicast scopes to address the link-local domain, the site-local domain and other domains.

IPv6 ‘arp’ For Linux: ip -6 neigh

The ip command is /sbin/ip which is part of the iproute or iproute2 package in most distributions.

The full command is ip -6 neigh show, but the show is implied if omitted.

You can also leave off the -6 to include IPv4 to MAC info.

ip -6 neigh show
# 2001:db8:192:0:3c15:852:f73e:4467 dev eth0 lladdr 1c:4b:d6:fb:5e:99 STALE
# 2001:db8:192:0:711d:422b:3cfe:d06 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE
# fe80::24b8:55b8:eb04:c651 dev eth0 lladdr 40:61:86:e1:6e:1c REACHABLE
# fe80::6a7f:74ff:fe91:9a4 dev eth0 lladdr 68:7f:74:91:09:a4 router STALE
# 2001:db8:192:0:24b8:55b8:eb04:c651 dev eth0 lladdr 40:61:86:e1:6e:1c REACHABLE
# 2001:db8:192:0:3dcc:ff5d:fe1f:faef dev eth0 lladdr 1c:4b:d6:fb:5e:99 STALE
# fe80::3dcc:ff5d:fe1f:faef dev eth0 lladdr 1c:4b:d6:fb:5e:99 REACHABLE
# fe80::6470:6fb9:76c7:aa85 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE
# 2001:db8:192:0:6470:6fb9:76c7:aa85 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE

How to arp -a in IPv6
How to arp -a in IPv6

IPv6 ‘arp’ for MacOS: ndp -a

While the -a switch looks similar to the arp switch, the rest of the arp options are not the same in ndp, although there is similar information available. See man ndp for full documentation.

$ ndp -a
Neighbor                        Linklayer Address  Netif Expire    St Flgs Prbs
jims-macbook-pro.local          (incomplete)         lo0 permanent R      
fe80::aede:48ff:fe00:1122%en5   ac:de:48:0:11:22     en5 permanent R      
fe80::aede:48ff:fe33:4455%en5   ac:de:48:33:44:55    en5 5s        R      
rpi3-picam.local                b8:27:eb:94:3b:a7    en0 14h9m15s  S      
fe80::cd0:88cf:aac:1483%en0     52:fe:c0:79:4:64     en0 22h37m42s S      
jims-macbook-pro.local          38:f9:d3:9d:2e:23    en0 permanent R      
rpi3-picam.local                b8:27:eb:c1:6e:f2    en0 10h54m10s S      
rpi4-toothless.local            dc:a6:32:38:ac:e6    en0 10h54m10s S      
rpi4-toothless.local            dc:a6:32:38:ac:e8    en0 10h54m10s S      
fe80::48c9:e9ff:fe79:2980%awdl0 4a:c9:e9:79:29:80  awdl0 permanent R      
fe80::48c9:e9ff:fe79:2980%llw0  4a:c9:e9:79:29:80   llw0 permanent R      
jims-macbook-pro.local          (incomplete)       utun0 permanent R      
jims-macbook-pro.local          (incomplete)       utun1 permanent R

Similar Posts