How To “arp -a” In IPv6

When migrating to IPv6 you may wonder the equivalent of arp is when you are trying to match MAC addresses with IP addresses.

IPv6 uses Neighbor Discovery Protocol in place of IPv4’s arp. On Windows use netsh int ipv6 show neigh, and on Linux use ip -6 neigh in place of arp -a.

IPv6 ‘arp’ For Windows: netsh int ipv6 show neigh

The full command is netsh interface ipv6 show neighbors, but the Windows built-in netsh allows you to abbreviate commands. netsh i ipv6 sh n works, too.

netsh int ipv6 show neigh

# Interface 1: Loopback Pseudo-Interface 1
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# ff02::c                                                          Permanent
# ff02::16                                                         Permanent
# Interface 12: Teredo Tunneling Pseudo-Interface
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# ff02::16                              Permanent
# Interface 10: Local Area Connection
# Internet Address                              Physical Address   Type
# --------------------------------------------  -----------------  -----------
# 2001:db8:192:0:24b8:55b8:eb04:c651            40-61-86-e1-6e-1c  Reachable
# 2001:db8:192:0:3c15:852:f73e:4467             1c-4b-d6-fb-5e-99  Stale
# 2001:db8:192:0:3dcc:ff5d:fe1f:faef            1c-4b-d6-fb-5e-99  Reachable
# 2001:db8:192:0:4261:86ff:fee1:6c83            40-61-86-e1-6c-83  Reachable
# 2001:db8:192:0:a0cc:55f4:170e:499b            1c-4b-d6-6b-31-1c  Stale
# 2001:db8:192:0:a539:c48e:4c21:2f17            Unreachable        Unreachable
# fe80::24b8:55b8:eb04:c651                     40-61-86-e1-6e-1c  Stale
# fe80::3dcc:ff5d:fe1f:faef                     1c-4b-d6-fb-5e-99  Stale
# fe80::4261:86ff:fee1:6c83                     40-61-86-e1-6c-83  Stale
# fe80::6a7f:74ff:fe91:9a4                      68-7f-74-91-09-a4  Stale (Router)
# fe80::a539:c48e:4c21:2f17                     1c-4b-d6-6b-31-1c  Stale
# ff02::c                                       33-33-00-00-00-0c  Permanent
# ff02::16                                      33-33-00-00-00-16  Permanent
# ff02::1:3                                     33-33-00-01-00-03  Permanent
# ff02::1:ff04:c651                             33-33-ff-04-c6-51  Permanent
# ff02::1:ff0e:499b                             33-33-ff-0e-49-9b  Permanent
# ff02::1:ff1f:faef                             33-33-ff-1f-fa-ef  Permanent
# ff02::1:ff21:2f17                             33-33-ff-21-2f-17  Permanent
# ff02::1:ff3e:4467                             33-33-ff-3e-44-67  Permanent
# ff02::1:ff91:9a4                              33-33-ff-91-09-a4  Permanent
# ff02::1:ffe1:6c83                             33-33-ff-e1-6c-83  Permanent

You may notice some duplicate and unreachable physical (MAC)  addresses. The unreachables are due to privacy addresses. My Windows boxes by default use temporary IPv6 addresses than change periodically to attempt some measure of privacy. I think this is dumb, and it can be turned off by “netsh interface ipv6 set privacy state=disabled” on each machine. The duplicates are because each MAC has multiple IPv6 address scopes. Most machines will have the public IPv6 address and a link-local IPv6 address, usually starting with fe80.

I will also draw your attention to the fact that the physical MAC address is transliterated and somewhat recognizable in the internet address for link local addresses and most non-private addresses. Current Ethernet MAC’s are 48-bit addresses. IPv6 is geared for 64-bit unique identifiers, and there is a standard conversion to represent MACs as EIU-64 addresses.

The ff02: addresses are multicast addresses. In IPv6 there is no broadcast, but there are various multicast scopes to address the link-local domain, the site-local domain and other domains.

IPv6 ‘arp’ For Linux: ip -6 neigh

The ip command is /sbin/ip which is part of the iproute or iproute2 package in most distributions.

The full command is ip -6 neigh show, but the show is implied if omitted.

You can also leave off the -6 to include IPv4 to MAC info.

ip -6 neigh show
# 2001:db8:192:0:3c15:852:f73e:4467 dev eth0 lladdr 1c:4b:d6:fb:5e:99 STALE
# 2001:db8:192:0:711d:422b:3cfe:d06 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE
# fe80::24b8:55b8:eb04:c651 dev eth0 lladdr 40:61:86:e1:6e:1c REACHABLE
# fe80::6a7f:74ff:fe91:9a4 dev eth0 lladdr 68:7f:74:91:09:a4 router STALE
# 2001:db8:192:0:24b8:55b8:eb04:c651 dev eth0 lladdr 40:61:86:e1:6e:1c REACHABLE
# 2001:db8:192:0:3dcc:ff5d:fe1f:faef dev eth0 lladdr 1c:4b:d6:fb:5e:99 STALE
# fe80::3dcc:ff5d:fe1f:faef dev eth0 lladdr 1c:4b:d6:fb:5e:99 REACHABLE
# fe80::6470:6fb9:76c7:aa85 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE
# 2001:db8:192:0:6470:6fb9:76c7:aa85 dev eth0 lladdr 00:21:9b:16:a0:42 REACHABLE

Recent Content

© 2021 Copyright Practical Code Use