- [Instructor] The IP version six neighbor discovery
inspection feature, otherwise known as IP
version six snooping, is another way that we can mitigate
threats in our neighbor discovery process on a network.
IP version six nodes use the neighbor discovery protocol
or NDP to discover the presence and link layer addresses
of other nodes that reside on the same link.
This is used by both routers and hosts.
With hosts, NDP is leveraged in order to find
neighboring routers that can forward the packets.
And routers use that to advertise their own presence
on the network.
The NDP process is based on the exchange
of neighbor solicitation and advertisement messages.
And these NDP messages are unsecure,
meaning that they are susceptible to attacks.
And that's the reason that IP version six
snooping was developed.
With IP version six snooping, a device learns and populates
a binding table called the DHCP version six snooping table.
This is built by snooping DHCP
version six message exchanges.
The information learned and populated into the table
includes IP version six addresses,
VLAN and interface numbers, and the MAC address.
IP version six neighbor discovery inspection can be used
to verify five different message types,
which are router solicitation messages,
router advertisement messages,
neighbor solicitation messages,
neighbor advertisement messages, and redirect messages.
This feature helps to protect against attacks
such as cache poisoning attacks, denial of service attacks,
and redirect attacks.
Similar to other IP version six security features
that we've examined, this would involve first creating
a policy and then applying that to an interface
or VLAN of your choosing.
So that's a look at IP version six neighbor
discovery inspection or IP version six snooping.