advanced23 min studyLesson 193 in Engineering

The next hop still needs a reachable link neighbor

Follow IPv4 ARP and IPv6 Neighbor Discovery from route lookup to link-layer delivery, including cache states and first-packet delays.

On this page

What you’ll understand

  • Identify which next-hop address requires link-layer resolution.
  • Distinguish IPv4 ARP from IPv6 Neighbor Discovery functions.
  • Diagnose local adjacency failure separately from remote routing failure.

A route names where forwarding should go next; it does not automatically provide a usable frame destination on the outgoing link. On a typical Ethernet network, the sender must associate a next-hop IP address with a link-layer address. If that association fails, a perfectly plausible route can coexist with zero delivered packets. Treat this as a local adjacency problem before blaming distant routers. The same distinction helps explain why the first packet after an idle period can behave differently from later packets.

Resolve the next hop, not every remote host

After selecting a route, the sender determines the relevant next-hop address. For an on-link destination this may be the destination itself. For a remote destination it is generally the local router selected by the route. IPv4 ARP on Ethernet asks which link-layer address corresponds to that local IPv4 address. The request commonly uses link-layer broadcast; the resulting frame to the router still contains the original remote IP destination. Routers repeat local forwarding decisions on subsequent links.

Do not expect the remote server's Ethernet address to appear in the client's local neighbor cache. Link-layer addresses are meaningful on their link, and a router replaces the link envelope as it forwards. A subnet-mask error can make a client incorrectly treat a remote destination as on-link and send unanswered ARP requests instead of using its gateway. Comparing the selected route, chosen next hop, and actual ARP target often exposes that configuration error faster than inspecting application retries.

dIP=dremote,dframe=MAC⁡(hnext)d_{\rm IP}=d_{\rm remote},\qquad d_{\rm frame}=\operatorname{MAC}(h_{\rm next})
On an ordinary routed Ethernet hop, the IP destination remains the remote address while the frame destination is the resolved link-layer address of next hop h_next. This conceptual relation excludes tunnels, translation, and other transformations that change the packet representation.↔ Scroll wide equations horizontally.

IPv6 uses Neighbor Discovery, not ARP

IPv6 Neighbor Discovery uses ICMPv6 messages and performs more than address resolution. Neighbor Solicitation and Advertisement help discover link-layer addresses; Router Advertisements support router and prefix discovery; Neighbor Unreachability Detection checks the ability to reach neighbors. Resolution commonly uses solicited-node multicast rather than an IPv4-style broadcast. IPv6 has no broadcast address type. A firewall policy that indiscriminately blocks ICMPv6 can therefore remove mechanisms the network needs for ordinary operation.

A cached neighbor entry can be usable while no longer recently confirmed. In the Neighbor Discovery state machine, stale does not simply mean broken. Traffic can trigger transitions through delay and probe states before a neighbor is declared unreachable. Conversely, an entry that once resolved does not certify that the remote service is healthy now. Inspect timestamps, interface state, link segmentation, and solicitation responses. Cached evidence is about a particular adjacency and time, not the complete end-to-end path.

Tfirst=Tlookup+Tresolution+TtransmitT_{\rm first}=T_{\rm lookup}+T_{\rm resolution}+T_{\rm transmit}
This simplified serial latency budget uses seconds for each term and assumes the first packet waits for a needed neighbor resolution. Queueing, retransmissions, and parallel work can change the actual timing; subsequent packets may reuse cached state.↔ Scroll wide equations horizontally.

Bound pending work while resolution is incomplete

While a neighbor is unresolved, an implementation may retain a bounded number of packets and eventually drop them if resolution fails. A stream of new unknown neighbors can therefore consume resources even when the route table is stable. Observe unresolved-neighbor counts and drops, not just interface bandwidth. A capture should answer whether solicitations leave the correct interface and whether replies return on the expected link. An empty application response alone cannot distinguish these possibilities.

In the queue lab, interpret arrival rate as work awaiting local resolution and service rate as completed resolution work under a deliberately simplified aggregate model. For one fresh run, press Reset, set both λ=3 and μ=2, predict growing backlog, then Play or Step. For a separate draining case, press Reset again, set both λ=2 and μ=3, predict the time to drain the initial four items, then Play or Step. Parameter edits pause but retain elapsed time and recompute from the initial four; they do not switch rates on accumulated backlog. The model begins with four work items and has no ARP packets, per-neighbor cache states, timers, or multicast. Its purpose is to make the resource consequence of stalled adjacency work visible, while packet captures remain the evidence for the actual protocol fault.

Account for an uncached gateway

Assume route lookup takes 0.1 ms, successful uncached gateway resolution takes 2.4 ms, and frame transmission takes 0.5 ms. Compare the first packet with a later packet using a still-valid cache entry.

  1. For the first packet, sum the serial components: 0.1 + 2.4 + 0.5 = 3.0 ms. The resolution concerns the gateway, because the destination is remote under the selected route.

  2. For a later packet with a usable cached association, omit the resolution wait in this model: 0.1 + 0.5 = 0.6 ms. The illustrative difference is 2.4 ms, not a reduction in the distant server's processing time.

  3. If first-packet latency stays high, capture local resolution and inspect cache transitions. Repeated misses, lost replies, or wrong on-link classification would invalidate the assumed one-time successful lookup.

The result

The model predicts 3.0 ms for the first local forwarding operation and 0.6 ms for a cached one. It excludes all later hops and application latency.

Explore the model

Interactive lab

Interactive lab · queue

Unresolved work can accumulate

For each separate comparison, press Reset, set both arrival rate λ and service rate μ, predict the sign of backlog growth from max(0, 4+(λ−μ)t), then Play or Step. The display does not implement ARP, Neighbor Discovery, neighbor timers, or a per-address packet queue.

Unresolved work can accumulateFluid backlog starts at 4 and follows max(0, 4 + (λ − μ)t). The separate M/M/1 residence-time formula assumes Poisson arrivals, exponential service and λ < μ. Current readings: Fluid backlog: 4; Net rate · λ − μ: −1 /s; M/M/1 mean residence: 1 s. All parameters are adjustable with the labeled controls below.02.557.51001.534.56Elapsed time · sFluid backlogλ < μ
Fluid backlogCurrent time
Fluid backlog
4
Net rate · λ − μ
−1 /s
M/M/1 mean residence
1 s
t = 0 s

Fluid backlog starts at 4 and follows max(0, 4 + (λ − μ)t). The separate M/M/1 residence-time formula assumes Poisson arrivals, exponential service and λ < μ. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.

Look forAn adjacency failure can become a resource problem when pending work arrives faster than it can be resolved or discarded.

Check your understanding

A client sends to a remote IPv4 server through its local Ethernet gateway. Which address does it normally resolve with ARP?

Try it yourself

A host has a default route through 192.0.2.1 but repeatedly ARPs for remote address 198.51.100.20. What two pieces of local evidence should you inspect before assuming an upstream outage?

Take a moment to make a prediction or work it out on paper. Open a hint when you need one.

Give me a hint

Ask why the host believes that remote address belongs directly on its link, and compare that belief with the selected route.

Compare with the solution

Inspect the host's address and prefix configuration and its actual route lookup for 198.51.100.20, including any policy-selected table. A too-broad on-link route can cause direct ARP for the remote address despite the existence of a default. Then capture the outgoing interface to confirm the ARP target and any replies. Upstream forwarding has not yet been tested if the host never sends a frame to its intended gateway.

Take it with you

  • A usable route and a usable local neighbor association are separate requirements.
  • ARP resolves local IPv4 adjacencies; IPv6 Neighbor Discovery has broader ICMPv6 functions.
  • Cache state, packet captures, and pending-work metrics localize adjacency faults.

Read further

Original sources and deeper explanations to follow at your own pace.

Optional progress, saved in this browser when available. Revisit any lesson at any time.

Lesson not marked complete.