ICMPv6
Control Messages for IPv6ICMPv6 does far more than its IPv4 namesake. It carries the errors and diagnostics you expect, but it also absorbed ARP, router discovery and multicast membership — so on IPv6 a host cannot function without it at all.
ICMPv6 is IPv6’s nervous system — errors, neighbour discovery and autoconfiguration all ride on it.
How it works
No DHCP, no ARP, no broadcast: a host learns the prefix from the router, builds its own address, and resolves neighbours over multicast ICMPv6 — which is why filtering it blindly breaks IPv6 entirely.
What ICMPv6 does, step by step
A Router Solicitation asks who routes here; the Router Advertisement answers with the prefix and options.
The host builds an address from the advertised /64 and its own interface identifier — SLAAC.
Duplicate Address Detection solicits its own candidate address; no answer means it is safe to use.
Neighbour Solicitation/Advertisement replace ARP, and error types report unreachable, too big and time exceeded.
In cybersecurity
Because ICMPv6 carries configuration as well as diagnostics, spoofing it is far more powerful than spoofing ICMP was — and blocking it outright breaks the network.
A forged Router Advertisement makes an attacker the default router for the whole segment.
Switches drop advertisements arriving on ports where no router should be — the core defence.
Neighbour Advertisements are as forgeable as ARP replies; SEND and ND inspection help.
Dropping Packet Too Big silently breaks Path MTU Discovery and connections hang.
Answering every duplicate check stops any host on the link from claiming an address.
Permit types 1–4, 128/129 and the link-local NDP set; drop the rest at the border.