IPv6 Router Advertisement with Router Lifetime 0 Packet Capture

Lesson Contents

This packet capture contains two ICMPv6 Router Advertisements (RAs) from the same Cisco router. The first one is a normal RA: “I’m a default router for the next 30 minutes, and here’s the prefix to build your addresses from.” The second one, two minutes later, is the router saying goodbye: router lifetime 0 and prefix lifetimes 0. Hosts that receive it stop using the router as their default gateway right away, instead of waiting for the old lifetime to expire.

Comparing the two packets field by field shows exactly which values hosts use for their default gateway and for SLAAC. The IPv6 Neighbor Discovery lesson explains router solicitations and advertisements, and IPv6 Router Advertisement preference covers the Prf field you’ll see set to High here. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	ipv6-router-advertisement-leaving.pcapng
Packets	2 (regular RA, final RA 128 seconds later)
Protocol	ICMPv6 Router Advertisement, type 134 (RFC 4861), SLAAC (RFC 4862)
Transport	IPv6 from link-local fe80::f816:3eff:fe75:545e to ff02::1 (all nodes), hop limit 255
Devices	Cisco IOS router advertising 2001:db8:123:123::/64
Wireshark filter	`icmpv6.type == 134` or `icmpv6.nd.ra.router_lifetime == 0`

Packets in this capture

No. Time        Source                     Destination  Length  Info
1   0.000000    fe80::f816:3eff:fe75:545e  ff02::1      118     Router Advertisement from fa:16:3e:75:54:5e
2   127.922599  fe80::f816:3eff:fe75:545e  ff02::1      102     Router Advertisement

Packet walkthrough

Regular Router Advertisement (packet 1)

Internet Protocol Version 6, Src: fe80::f816:3eff:fe75:545e, Dst: ff02::1
    Next Header: ICMPv6 (58)
    Hop Limit: 255
Internet Control Message Protocol v6
    Type: Router Advertisement (134)
    Code: 0
    Checksum: 0xd6c8 [correct]
    Cur hop limit: 64
    Flags: 0x08, Prf (Default Router Preference): High
        0... .... = Managed address configuration: Not set
        .0.. .... = Other configuration: Not set
        ..0. .... = Home Agent: Not set
        ...0 1... = Prf (Default Router Preference): High (1)
        .... .0.. = ND Proxy: Not set
    Router lifetime (s): 1800
    Reachable time (ms): 0
    Retrans timer (ms): 0
    ICMPv6 Option (Source link-layer address : fa:16:3e:75:54:5e)
        Type: Source link-layer address (1)
        Length: 1 (8 bytes)
        Link-layer address: fa:16:3e:75:54:5e
    ICMPv6 Option (MTU : 1500)
        Type: MTU (5)
        Length: 1 (8 bytes)
        MTU: 1500
    ICMPv6 Option (Prefix information : 2001:db8:123:123::/64)
        Type: Prefix information (3)
        Length: 4 (32 bytes)
        Prefix Length: 64
        Flag: 0xc0, On-link Flag (L), Autonomous Address Configuration Flag (A)
            1... .... = On-link Flag (L): Set
            .1.. .... = Autonomous Address Configuration Flag (A): Set
        Valid Lifetime: 2592000 (30 days)
        Preferred Lifetime: 604800 (7 days)
        Prefix: 2001:db8:123:123::

Link-local source, ff02::1 destination, hop limit 255: RAs always come from the router’s link-local address and are normally sent to all nodes on the link (a reply to a Router Solicitation may also be unicast). Hosts drop any RA with a hop limit lower than 255, so an RA can’t come from beyond the local link. The link-local address is also what hosts install as their default gateway.
Router lifetime 1800: “use me as a default router for the next 1800 seconds (30 minutes)”. This is the only field that makes a router a default gateway. A router that advertises a router lifetime of 0 can still hand out prefixes, but hosts won’t send traffic to it as their default gateway. Cisco IOS sends an RA every 200 seconds by default, and every RA resets this timer.
M and O flags not set: hosts shouldn’t use DHCPv6 for addresses (M) or for other information like DNS servers (O). They configure their address with SLAAC only.
Prf High: when a host receives RAs from several routers, it prefers the one with the highest preference. The default is Medium. Packet 2 still says High, although RFC 4191 says a router must set Prf to Medium (00) when the router lifetime is 0. Hosts ignore Prf in that case.
Reachable time and retrans timer 0: zero means “unspecified”, so hosts keep their own defaults for Neighbor Unreachability Detection.
Source link-layer address option: the router’s MAC address. Hosts can put the router in their neighbor cache right away, without a Neighbor Solicitation first.
MTU 1500: the link MTU hosts should use.
Prefix 2001:db8:123:123::/64 with flags L and A: L (on-link) tells hosts that addresses in this prefix are directly reachable on the link. A (autonomous) tells them to build their own address from it with SLAAC. The valid lifetime (30 days) and preferred lifetime (7 days) are the Cisco defaults.

Final Router Advertisement (packet 2)

128 seconds later, the router stops advertising and sends one last RA:

Internet Control Message Protocol v6
    Type: Router Advertisement (134)
    Code: 0
    Checksum: 0x3e5a [correct]
    Cur hop limit: 64
    Flags: 0x08, Prf (Default Router Preference): High
    Router lifetime (s): 0
    Reachable time (ms): 0
    Retrans timer (ms): 0
    ICMPv6 Option (Prefix information : 2001:db8:123:123::/64)
        Type: Prefix information (3)
        Length: 4 (32 bytes)
        Prefix Length: 64
        Flag: 0xc0, On-link Flag (L), Autonomous Address Configuration Flag (A)
        Valid Lifetime: 0 (0 seconds)
        Preferred Lifetime: 0 (0 seconds)
        Prefix: 2001:db8:123:123::

Router lifetime 0: “I’m no longer a default router”. Hosts remove this router from their default router list right away. RFC 4861 asks routers to send a few of these final RAs when they stop advertising on an interface, so hosts don’t keep sending traffic to a router that isn’t forwarding anymore for up to 30 minutes.
Preferred lifetime 0: SLAAC addresses from 2001:db8:123:123::/64 become deprecated immediately. Existing connections keep working, but hosts won’t pick these addresses for new connections.
Valid lifetime 0: this does not remove the addresses right away. RFC 4862 protects hosts against a spoofed RA that kills their addresses: an unauthenticated RA can’t lower the remaining valid lifetime of an existing address below 2 hours. Hosts keep the address for two more hours, unless they hear a new RA for the prefix.
No source link-layer address or MTU option: that’s why this RA is 16 bytes shorter (102 instead of 118 bytes). A goodbye message doesn’t need them.

This is also why rogue RAs are dangerous: any host on the link can send an RA with router lifetime 0 for the real router’s link-local address and take away everyone’s default gateway. That’s one of the attacks RA Guard on switches protects against.