Why Is an IPv6 Address Still Tentative? Duplicate Address Detection Explained

After an IPv6 address is configured, the system may first show it as tentative and only allow normal use a little later. It is usually not waiting for the switch to allocate network speed. It is performing Duplicate Address Detection, or DAD: checking whether another node on the same link is already using that address. This article explains classic DAD; settings, exceptions and extensions depend on the actual protocol stack.

An address in the configuration is not necessarily ready to use

Imagine putting a number on a room, but first asking the neighbors whether that number is already taken. The analogy explains checking before use; it does not mean IPv6 has an administrator registering every device. The protocol stack of the node that intends to use the address performs the check. The switch mainly forwards the relevant link-layer frames.

A tentative address has been selected but has not yet completed the normal checks for use. In classic DAD, it cannot carry ordinary communication in the same way as an established unicast address. When an address appears in a management screen, inspect its state as well as the address string.

One interface may have more than one IPv6 address. The check concerns a particular address on its link, rather than giving the whole device a permanent certificate of correctness. Passing the check for one address does not prove that other addresses, the gateway configuration or application services are correct.

The question is carried inside an NS message

IPv6 Neighbor Discovery uses ICMPv6 messages. NS stands for Neighbor Solicitation, with a type value of 135. During DAD, the node puts its candidate address in the Target Address field. In plain language, it asks: I intend to use this address; is someone on this link already using it? This is neither a DNS name query nor a request to a server for a new address.

The IPv6 source is the unspecified address, commonly written as two colons, ::. The candidate is still tentative, so the node cannot simply treat it as an ordinary established source address. The destination is the solicited-node multicast address corresponding to the candidate. The check stays within this link. This is IPv6 multicast, not IPv4-style broadcast.

An unspecified source describes the IPv6 layer. It does not mean the Ethernet frame has no source MAC address. Packet-capture tools show fields from several layers, and those meanings must be kept separate. Also distinguish the Target Address inside the NS from the multicast destination carrying that query.

How an NA provides evidence that the address is in use

If a node on the link already uses the candidate address, it can respond under the Neighbor Discovery rules with an NA, or Neighbor Advertisement, type 136. For this query with an unspecified source, the response goes to the all-nodes multicast address on the link. It is not unicast to ::. The orange message in the illustration therefore represents a multicast notification within the link.

If the node preparing to enable the address receives valid duplicate evidence concerning its tentative address, it must not proceed as though that address were unique. Two nodes might also test the same candidate at the same time. DAD processing therefore involves more than looking for an ordinary NA; relevant NS messages and implementation rules also matter.

Not every observed packet should be treated as trustworthy proof. Messages have to pass the protocol validity checks, and networks can experience loopback or abnormal messages. Extensions such as Enhanced DAD help identify queries that have looped back. The illustration does not show every option or state transition. Interpret a real incident using system logs, the applicable implementation and the original packets.

No duplicate detected does not mean unique forever

After completing the required process without detecting a duplicate, the node can advance the address state according to the rules. The result says that no conflict was observed within the scope and conditions of that check. It is not a permanent guarantee covering every future wiring change or startup sequence. A device joining later or a configuration change can alter the situation.

Nor does a DAD pass mean nobody on the Internet uses the same address. It primarily checks the same link. Ordinary routers do not forward the relevant link-local messages to other links. The two networks marked with the symbolic candidate X in the illustration explain this boundary; they do not give permission to duplicate globally scoped addresses arbitrarily.

If the network separates nodes that should be able to observe one another, or filters messages needed by the check, the result has limitations. Verify the actual Layer 2 scope and whether messages can reach their intended destinations. Receiving no objection is not a substitute for establishing that the expected check could actually take place.

Address readiness and application connectivity are different gates

DAD concerns duplicate addresses. Routing determines where packets go. The application depends on the remote service running and returning valid responses. These tasks do not replace one another. Even with a normal address state, an industrial data exchange may fail because of the path, return route, security policy, listening interface or application configuration.

Conversely, a normal link indicator does not prove DAD has passed. The indicator generally concerns the physical link; it cannot confirm a particular IPv6 address state on behalf of the endpoint protocol stack. Repeatedly restarting the switch simply because the light is on can leave the actual address or policy problem untouched.

Do not casually disable the check or shorten its wait just to make a screen show usable sooner. A system may offer special modes, exceptions or adjustable parameters, but their suitability depends on the design and documentation. A simplified educational flow is not a universal change instruction for a production network.

Identify who handles IPv6 in an industrial communication link

The mini DIN-rail five-port Fast Ethernet electrical switch listed on the Feichang website provides a real industrial connectivity context. It illustrates the link-carrying role here. Its name alone does not establish that it has an IPv6 endpoint stack, a DAD log screen or configurable multicast controls. Check the relevant product documentation for specific capabilities.

In a common transparent Layer 2 transport arrangement, the devices that actually use IPv6 addresses perform the address check. A switch or optical transport device does not automatically become a DAD proxy for every endpoint. Where routing, proxies or special multicast features are involved, re-establish the message boundary from the actual configuration rather than the appearance of the cable.

During procurement or acceptance, establish which device creates and uses the address, which only carries frames, and which inspects, filters or proxies Neighbor Discovery messages. IPv6 endpoint capability, transparent forwarding and IPv6 access to a management interface are different claims. Do not combine them under a vague label such as network support.

State the capture location and time window as well. Not seeing an advertisement at one port only tells you it was not recorded there during that capture; it cannot establish that the entire network will never have a conflict. Correlate address-state changes, interface identity and packet times, and confirm that the observation covered the detection window before use. Mark incomplete evidence as unconfirmed.

Turn the waiting state into evidence you can inspect

First preserve the address string, interface name, current state and event time. Then, in an authorized test environment, observe NS and NA messages alongside system logs. Inspect the ICMPv6 type, IPv6 source and destination, Target Address, and the interface link together. Avoid drawing a conclusion from a single name in the packet list.

If a duplicate is found, trace the real configuration source and device ownership. If the address remains tentative or a failure occurs, check the link, multicast delivery and implementation logs. One advertisement alone does not prove a device is under attack, and an address-conflict log does not automatically mean a particular switch has a hardware fault.

The practical approach is to understand the address state, understand the checking messages, and then verify the actual application. DAD helps a node avoid blindly enabling a duplicate address on its link. It is neither device authentication, encryption, nor a complete network connectivity test. Keeping those limits visible makes the protocol behavior easier to explain.

Translated from the Chinese technical article: Read the original Chinese article.