We are primarily focused on two different NS messages here, the
one used for DAD and the one used for ND.
The DAD NS is always the first IPv6 message sent whenever an interface
comes up. The source is the unspecified address of :: since the client
cannot just assume it's IPv6 address is unique.
The destination is the solicited node multicast group for the address the node
wants to use. In this case, the client wants to use fe80::4.
I won't cover how to compute this in detail since
it's not directly related to ICMP.
The short answer is to use the first 104 bits from the prefix ff02::1:ff00
and then append the last 24 bits of the specific address to check. The
relevance of this NS is that if it goes unanswered,
then there are no other nodes on the local network using
the same IPv6 address. Like IPv4, ICMP for IPv6 also has
types and codes for its messages.
The NS uses type 135 and code 0, as shown below.
The target address to be checked for duplication is carried in the ICMP header.
The last chunk is an IPv6 option that adds a single‑use value
called a nonce to ensure that if this NS somehow gets looped back
to the client that it is discarded.
This avoids the false positive of the client thinking
there is a duplicate address when there isn't. The next NS
is very similar to the first.
The target is a different solicited node multicast group, this time
representing the target of the ICMP ping we kicked off.
This was the Globomantics router with address
fe80::1 connected to our test client.
The type and code remained the same, not surprisingly. The target address
changes to fe80::1 since this is the target of the ping.
Notice that there is an ICMP option included, which carries the source MAC.
Just like ARP, the source MAC is carried in the header.
Why can't ND just use the source MAC on the Ethernet frame?
Good question.
Sometimes a router maybe hosting a virtual IP address and will
want to use that virtual IP source MAC for discovery rather
than the physical Ethernet MAC.
This is true for IPv4 as well, which is why ARP payloads carry source MACs too. Next up, let's see how the router replies.