IPv6 DAD and Neighbor Solicitation PCAP Analysis: Duplicate Address Detection, SLAAC, Missing NA, and No IPv6 Connectivity

IPv6 failures often begin before TCP, TLS, DNS, or HTTP. Users search for "IPv6 DAD packet capture", "Neighbor Solicitation no response", "missing Neighbor Advertisement", "duplicate IPv6 address", "SLAAC not working", and "no IPv6 connectivity pcap" when a host has an address but cannot communicate reliably.

PCAP Surgery is useful because IPv6 Neighbor Discovery depends on small ICMPv6 exchanges that are easy to trim away by mistake. The packets before the application failure often explain everything.

What DAD does

Duplicate Address Detection checks whether an IPv6 address is already in use before assigning it to an interface. During DAD, the host sends Neighbor Solicitation for the tentative address.

If another node responds, the address is duplicate and should not be used. If no duplicate is found, the address can become usable.

Searchers often see only "IPv6 address tentative" or "dadfailed" in OS output. The pcap can show the actual Neighbor Solicitation and any reply.

Neighbor Solicitation and Neighbor Advertisement

Neighbor Solicitation asks who has an IPv6 address. Neighbor Advertisement answers.

Common packet evidence:

• ICMPv6 Neighbor Solicitation.
• Solicited-node multicast destination.
• Target address.
• Source address may be unspecified during DAD.
• ICMPv6 Neighbor Advertisement response.
• Link-layer address options.

If NS packets are sent but NA never returns, the issue may be L2 reachability, multicast filtering, firewall policy, duplicate address handling, or wrong on-link assumptions.

SLAAC and Router Advertisement context

SLAAC relies on Router Advertisements to learn prefixes and flags. DAD then checks the generated address.

A useful IPv6 startup trace includes:

• Router Solicitation.
• Router Advertisement.
• Prefix Information option.
• Generated address.
• DAD Neighbor Solicitation.
• Any Neighbor Advertisement.
• DNS options if relevant.

If you only capture the later failed TCP connection, the autoconfiguration cause may be invisible.

Duplicate address symptoms

Duplicate IPv6 address problems show up as:

• Address stays tentative.
• Address becomes deprecated or dadfailed.
• Connectivity works briefly then fails.
• Neighbor cache flips between MAC addresses.
• Two VMs cloned from one image conflict.
• Containers reuse stable addresses.
• Router logs duplicate detection.

Packet captures can prove whether another node responded to DAD or whether the host incorrectly believed a duplicate existed.

Missing Neighbor Advertisement

If a host sends NS for a gateway or peer and receives no NA, application connectivity fails.

Possible causes:

• Target is offline.
• Wrong VLAN.
• Multicast filtering.
• Firewall blocks ICMPv6.
• Switch snooping issue.
• Hypervisor bridge problem.
• Address is not actually on-link.
• NAT or proxy design confuses neighbor discovery.

Blocking ICMPv6 often breaks IPv6 in ways that look unrelated.

Capture point and multicast

Neighbor Discovery uses multicast heavily. Capture point matters.

Check:

• Is the capture on the correct interface?
• Does it see multicast frames?
• Is the VM bridge passing ICMPv6?
• Are VLAN tags present?
• Is Wi-Fi multicast being filtered or converted?
• Is the switch mirror capturing both directions?

One-sided captures can make NDP look broken when the capture is incomplete.

False application diagnoses

IPv6 NDP failures are often misdiagnosed as:

• DNS problem.
• TLS problem.
• Web server problem.
• TCP timeout.
• Firewall port block.
• VPN routing problem.

Those may be downstream symptoms. If Neighbor Solicitation fails, the host may never reach the peer at L2.

Debug checklist

Use this workflow:

1. Capture from interface startup.
2. Preserve Router Solicitation and Router Advertisement.
3. Find DAD Neighbor Solicitation.
4. Check tentative address target.
5. Look for Neighbor Advertisement.
6. Check solicited-node multicast destination.
7. Compare MAC addresses in options.
8. Check gateway neighbor resolution.
9. Verify VLAN and capture point.
10. Preserve NDP packets with the failed application flow.

Final diagnosis

IPv6 DAD and Neighbor Solicitation failures happen before the application layer. The important evidence is ICMPv6 Neighbor Solicitation, Neighbor Advertisement, Router Advertisement context, multicast delivery, duplicate address responses, and capture placement.

PCAP Surgery helps keep those small but decisive packets attached to the failed flow so "no IPv6 connectivity" becomes a specific DAD, SLAAC, NDP, firewall, or L2 diagnosis.