Skip to main content
duenlim
Staff
Staff
March 5, 2026

Troubleshooting Tip: IPv6 local link-layer address resolution troubleshooting (similar to ARP in IPv4)

  • March 5, 2026
  • 0 replies
  • 252 views
Description This article describes how to troubleshoot IPv6 local link-layer address resolution (similar to ARP in IPv4).
Scope FortiGate v7.4/v7.6.
Solution

To troubleshoot the issue it can be used built-in Sniffer Packet via CLI commands.

 

diagnose sniffer packet port1 "icmp6 and (ip6[40] == 135 or ip6[40] == 136)" 4 0

 

Sniffer Packet filter string details:
icmp6: Filters for Internet Control Message Protocol for IPv6.
ip6[40]: Checks the 41st byte of the IPv6 packet (index 40), which is the first byte of the ICMPv6 header, containing the Type field.
135: Neighbor Solicitation (NS).
136: Neighbor Advertisement (NA).

 

This Sniffer Packet filter captures IPv6 Neighbor Discovery traffic, specifically Neighbor Solicitation (Type 135) and Neighbor Advertisement (Type 136) messages. It is used to monitor local link-layer address resolution (similar to ARP in IPv4). 

 

Samples of Sniffer Packet outputs 1 - There were no Neighbor Advertisement messages in reply to the Neighbor Solicitation:

 

diagnose sniffer packet port1 "icmp6 and (ip6[40] == 135 or ip6[40] == 136)" 4
Using Original Sniffing Mode
interfaces=[port1]
filters=[icmp6 and (ip6[40] == 135 or ip6[40] == 136)]
0.937501 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1
1.920469 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1
2.935876 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1
4.944005 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1
5.925137 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1
6.928549 port2 -- 2001:db8:1:1::100 -> ff02::1:ff00:1: icmp6: neighbor sol: who has 2001:db8:1:1::1

 

Samples of Sniffer Packet outputs 2 - There were Neighbor Advertisement messages in reply to the Neighbor Solicitation:

 

diagnose sniffer packet port1 "icmp6 and (ip6[40] == 135 or ip6[40] == 136)" 4
Using Original Sniffing Mode
interfaces=[port1]
filters=[icmp6 and (ip6[40] == 135 or ip6[40] == 136)]

13.734079 port2 -- 2001:db8:1:1::100 -> 2001:db8:1:1::1: icmp6: neighbor sol: who has 2001:db8:1:1::1
13.734157 port2 -- 2001:db8:1:1::1 -> 2001:db8:1:1::100: icmp6: neighbor adv: tgt is 2001:db8:1:1::1
14.007232 port2 -- fe80::24c:6fff:fe74:3802 -> 2001:db8:1:1::100: icmp6: neighbor sol: who has 2001:db8:1:1::100
14.008057 port2 -- 2001:db8:1:1::100 -> fe80::24c:6fff:fe74:3802: icmp6: neighbor adv: tgt is 2001:db8:1:1::100
18.731938 port2 -- fe80::2bc3:757e:5f33:799d -> fe80::24c:6fff:fe74:3802: icmp6: neighbor sol: who has fe80::24c:6fff:fe74:3802
18.732060 port2 -- fe80::24c:6fff:fe74:3802 -> fe80::2bc3:757e:5f33:799d: icmp6: neighbor adv: tgt is fe80::24c:6fff:fe74:3802
23.767247 port2 -- fe80::24c:6fff:fe74:3802 -> fe80::2bc3:757e:5f33:799d: icmp6: neighbor sol: who has fe80::2bc3:757e:5f33:799d
23.768100 port2 -- fe80::2bc3:757e:5f33:799d -> fe80::24c:6fff:fe74:3802: icmp6: neighbor adv: tgt is fe80::2bc3:757e:5f33:799d

 

Note: The firewall Port2 IPv6 address is 2001:db8:1:1::1/64, and the Link-Local IPv6 address is fe80::24c:6fff:fe74:3802.


diagnose ipv6 address list
dev=4 devname=port2 flag=P scope=0 prefix=64 addr=2001:db8:1:1::1 preferred=4294967295 valid=4294967295 cstamp=7639543 tstamp=7639544
dev=4 devname=port2 flag=P scope=253 prefix=64 addr=fe80::24c:6fff:fe74:3802 preferred=4294967295 valid=4294967295 cstamp=2288 tstamp=2288

 

Note: The Windows test machine IPv6 address is 2001:db8:1:1::100/64.


IPv6 Address. . . . . . . . . . . : 2001:db8:1:1::100
Link-local IPv6 Address . . . . . : fe80::2bc3:757e:5f33:799d

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!