395 Free Cisco Lessons - No credit card neededSign up for Free
You are here: Home » Packet Captures

DHCPv6 Solicit, Advertise, Request, Reply Packet Capture

This packet capture shows a client getting an IPv6 address from a stateful DHCPv6 server. DHCPv4 has DORA (Discover, Offer, Request, Ack). DHCPv6 has SARR: Solicit, Advertise, Request, Reply on UDP 546 and 547. The idea is the same, but almost every detail on the wire is different: multicast to ff02::1:2 instead of broadcast, DUIDs instead of MAC addresses, an “identity association” that holds the address, and no default gateway option.

To set up the server side, see Cisco DHCPv6 server configuration. DHCPv6 can also hand out whole prefixes, which is covered in DHCPv6 prefix delegation, and DHCPv6 guard shows how to block rogue servers that send Advertise and Reply messages like the ones below. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File ipv6-dhcpv6-stateful.pcap
Packets 4
Protocol DHCPv6 (RFC 8415)
Transport UDP: client port 546, server port 547. Client to ff02::1:2
Devices Client fe80::5054:ff:fe19:da5c, server fe80::5054:ff:fe11:9e2e
Wireshark filter dhcpv6

Packets in this capture

No. Time      Source                    Destination               Info
1   0.000000  fe80::5054:ff:fe19:da5c   ff02::1:2                 Solicit   XID: 0x2334b6
2   0.006556  fe80::5054:ff:fe11:9e2e   fe80::5054:ff:fe19:da5c   Advertise XID: 0x2334b6 IAA: 2001:1111:1111:1111:5979:4f18:45bc:7f44
3   1.179488  fe80::5054:ff:fe19:da5c   ff02::1:2                 Request   XID: 0x233d84 IAA: 2001:1111:1111:1111:5979:4f18:45bc:7f44
4   1.210650  fe80::5054:ff:fe11:9e2e   fe80::5054:ff:fe19:da5c   Reply     XID: 0x233d84 IAA: 2001:1111:1111:1111:5979:4f18:45bc:7f44

All four messages use link-local source addresses. The client doesn’t have a global address yet, and the server answers on the link. The client sends to ff02::1:2, the All_DHCP_Relay_Agents_and_Servers multicast address. There’s no broadcast in IPv6.

Packet walkthrough

Solicit (packet 1)

User Datagram Protocol, Src Port: 546, Dst Port: 547
DHCPv6
    Message type: Solicit (1)
    Transaction ID: 0x2334b6
    Elapsed time
        Option: Elapsed time (8)
        Elapsed time: 0ms
    Client Identifier
        Option: Client Identifier (1)
        DUID: 0003000152540019da5c
        DUID Type: link-layer address (3)
        Hardware type: Ethernet (1)
        Link-layer address: 52:54:00:19:da:5c
    Option Request
        Option: Option Request (6)
        Requested Option code: DNS recursive name server (23)
        Requested Option code: Domain Search List (24)
    Identity Association for Non-temporary Address
        Option: Identity Association for Non-temporary Address (3)
        IAID: 00020001
        T1: 0
        T2: 0
  • UDP 546 → 547: clients listen on 546 and servers and relays on 547. DHCPv4 uses 68 and 67.
  • Transaction ID: 3 bytes (DHCPv4 uses 4). The server copies it into the Advertise so the client can match the two.
  • Client Identifier (DUID): DHCPv6 identifies clients by a DUID, not by their MAC address. This client uses DUID type 3 (DUID-LL), which is built from the link-layer address. Other types are DUID-LLT (link-layer plus time), DUID-EN (enterprise number) and DUID-UUID. The server keys the binding on the client’s DUID plus the IA type and IAID.
  • Option Request: the client asks for DNS servers (option 23) and a domain search list (option 24).
  • IA_NA (option 3): an Identity Association for Non-temporary Addresses, the container that will hold the address. The IAID identifies this IA, usually one per interface. T1 and T2 are 0. Clients are supposed to send 0 here: the server ignores these fields and picks T1 and T2 itself.

Advertise (packet 2)

DHCPv6
    Message type: Advertise (2)
    Transaction ID: 0x2334b6
    Server Identifier
        Option: Server Identifier (2)
        DUID: 00030001525400119e2e
        DUID Type: link-layer address (3)
        Link-layer address: 52:54:00:11:9e:2e
    Client Identifier
        Option: Client Identifier (1)
        DUID: 0003000152540019da5c
    Identity Association for Non-temporary Address
        Option: Identity Association for Non-temporary Address (3)
        IAID: 00020001
        T1: 43200
        T2: 69120
        IA Address
            Option: IA Address (5)
            IPv6 address: 2001:1111:1111:1111:5979:4f18:45bc:7f44
            Preferred lifetime: 86400
            Valid lifetime: 172800
    DNS recursive name server
        Option: DNS recursive name server (23)
        1 DNS server address: 2001:4860:4860::8888
    Domain Search List
        Option: Domain Search List (24)
        Domain name suffix search list
            List entry: NETWORKLESSONS.LOCAL.
  • Same transaction ID as the Solicit.
  • Server Identifier: the server’s own DUID. The client copies it into its Request to say which server it picked. That matters when more than one server answers.
  • IA Address: the offered address with two lifetimes. After the preferred lifetime (86400 s, 1 day), the address is deprecated: existing sessions keep working, but new ones shouldn’t use it. After the valid lifetime (172800 s, 2 days), the address is removed.
  • T1 43200 and T2 69120: 50% and 80% of the preferred lifetime. At T1 the client sends a Renew to this server. At T2 it sends a Rebind to any server.
  • DNS server and domain search list: the options the client requested.

Request (packet 3)

DHCPv6
    Message type: Request (3)
    Transaction ID: 0x233d84
    Elapsed time
        Option: Elapsed time (8)
        Elapsed time: 0ms
    Client Identifier
        Option: Client Identifier (1)
        DUID: 0003000152540019da5c
    Option Request
        Option: Option Request (6)
        Requested Option code: DNS recursive name server (23)
        Requested Option code: Domain Search List (24)
    Server Identifier
        Option: Server Identifier (2)
        DUID: 00030001525400119e2e
    Identity Association for Non-temporary Address
        Option: Identity Association for Non-temporary Address (3)
        IAID: 00020001
        T1: 0
        T2: 0
        IA Address
            Option: IA Address (5)
            IPv6 address: 2001:1111:1111:1111:5979:4f18:45bc:7f44
            Preferred lifetime: 86400
            Valid lifetime: 172800
  • New transaction ID (0x233d84): Solicit/Advertise and Request/Reply are two separate exchanges, each with its own transaction ID. This is different from DHCPv4, where the whole DORA exchange uses one XID.
  • Still multicast to ff02::1:2: even though the client knows the server, the Request goes to the multicast address. The Server Identifier option tells the other servers to ignore it.
  • IA Address: the client asks for the exact address it was offered.

Reply (packet 4)

The Reply has the same content as the Advertise, with transaction ID 0x233d84. When the client receives it, the binding is complete and the client can use 2001:1111:1111:1111:5979:4f18:45bc:7f44. The client still runs Duplicate Address Detection on the address before it uses it.

What’s not in the capture

DHCPv6 doesn’t provide a default gateway. There is no “router” option like option 3 in DHCPv4. The client learns its default gateway from ICMPv6 Router Advertisements. The RA’s M flag (managed) is also what tells a host to use stateful DHCPv6 in the first place. The prefix length doesn’t come from DHCPv6 either: hosts get on-link prefixes from the RA.

Ask a question or start a discussion by visiting our Community Forum