show ipv6 neighbors
Displays the IPv6 neighbor discovery cache, showing the mapping of IPv6 addresses to MAC addresses on directly connected links, used to verify neighbor reachability and troubleshoot IPv6 connectivity.
Definition: show ipv6 neighbors is a Cisco IOS privileged exec command. Displays the IPv6 neighbor discovery cache, showing the mapping of IPv6 addresses to MAC addresses on directly connected links, used to verify neighbor reachability and troubleshoot IPv6 connectivity.
Overview
The `show ipv6 neighbors` command is a critical diagnostic tool for any network engineer working with IPv6. It displays the IPv6 neighbor discovery cache, which is the IPv6 equivalent of the ARP cache in IPv4. This cache maps IPv6 addresses to their corresponding MAC addresses on directly connected links. The command is essential for verifying neighbor reachability, troubleshooting connectivity issues, and understanding the state of the IPv6 neighbor discovery process.
IPv6 uses Neighbor Discovery Protocol (NDP) to determine the link-layer address of neighbors on the same link, to find neighboring routers, and to keep track of which neighbors are reachable. The neighbor cache is a key component of NDP, storing entries for each neighbor. Each entry includes the IPv6 address, the MAC address, the interface, and the state of the neighbor (e.g., REACH, STALE, DELAY, PROBE). The state indicates the confidence in the reachability of the neighbor.
You would reach for this command when you suspect IPv6 connectivity issues, such as when a host cannot reach another host on the same subnet, or when you need to verify that a router has learned the MAC address of a next-hop router. It is also useful after configuring IPv6 on an interface to confirm that the router is discovering neighbors. Alternatives include `ping ipv6` to test reachability, `traceroute ipv6` to trace the path, and `show ipv6 interface` to verify interface status and address. However, `show ipv6 neighbors` provides the direct mapping, which is crucial for layer 2 to layer 3 resolution.
In the broader workflow, this command is often used after configuring IPv6 on interfaces and before testing end-to-end connectivity. It helps isolate issues to layer 2 or layer 3. For example, if a ping fails but the neighbor cache shows the destination as REACH, the problem might be higher up the stack. If the neighbor is missing or in an incomplete state, the issue is likely at layer 2 or with NDP.
Important IOS behavior: The command output can be lengthy on networks with many neighbors, so you may want to use filters like `show ipv6 neighbors | include <pattern>`. The command requires privileged EXEC mode (enable). It does not affect the running configuration; it is a show command only. The output is refreshed periodically as NDP updates the cache. Entries can be cleared with `clear ipv6 neighbors` if needed for troubleshooting.
show ipv6 neighborsWhen to Use This Command
- Verify that a neighboring device's IPv6 address has been resolved to its MAC address after pinging the neighbor.
- Troubleshoot IPv6 connectivity issues by checking if the neighbor's MAC address is present and its state (REACH, STALE, DELAY, PROBE).
- Monitor the IPv6 neighbor table for potential spoofing or duplicate address detection issues.
- Confirm that a static IPv6 neighbor entry has been configured correctly.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface | interface-type interface-number | Specifies a particular interface to display neighbors learned on that interface only. For example, 'GigabitEthernet0/0'. If omitted, all neighbors on all IPv6-enabled interfaces are shown. Common mistake: using an interface that does not have IPv6 enabled, which results in no output. |
| ipv6-address | X:X:X:X::X | Displays the neighbor cache entry for a specific IPv6 address. This is useful for quickly checking the state of a particular neighbor. If the address is not in the cache, no output is shown. Common mistake: using an address that is not on a directly connected link; the cache only contains neighbors on the same link. |
| | | | {begin | include | exclude | section} expression | Output modifier to filter the command output. For example, 'show ipv6 neighbors | include REACH' shows only entries in REACH state. This is not a parameter of the command itself but a common IOS feature to refine output. |
Command Examples
Basic show ipv6 neighbors output
show ipv6 neighborsIPv6 Address Age Link-layer Addr State Interface 2001:db8:acad:1::1 0 aabb.cc00.0100 REACH GigabitEthernet0/0 2001:db8:acad:1::2 12 aabb.cc00.0200 STALE GigabitEthernet0/0 fe80::1 0 aabb.cc00.0100 REACH GigabitEthernet0/0 fe80::2 30 aabb.cc00.0200 DELAY GigabitEthernet0/0
IPv6 Address: The IPv6 address of the neighbor. Age: Number of minutes since the entry was last refreshed (0 means just updated). Link-layer Addr: The MAC address of the neighbor. State: Reachability state (REACH = recently confirmed reachable, STALE = not confirmed in a while, DELAY = waiting for confirmation, PROBE = actively sending NS). Interface: The local interface through which the neighbor is reachable.
Show IPv6 neighbors on a specific interface
show ipv6 neighbors interface gigabitethernet 0/1IPv6 Address Age Link-layer Addr State Interface 2001:db8:acad:2::1 5 aabb.cc00.0300 REACH GigabitEthernet0/1 2001:db8:acad:2::2 45 aabb.cc00.0400 STALE GigabitEthernet0/1 fe80::3 0 aabb.cc00.0300 REACH GigabitEthernet0/1
This filters the output to show only neighbors on GigabitEthernet0/1. The fields are the same as the basic output. Note that link-local addresses (fe80::) are also displayed. A STALE state indicates the entry has not been refreshed recently; the router will attempt to verify reachability when sending traffic.
Understanding the Output
The 'show ipv6 neighbors' command displays the IPv6 neighbor discovery cache. Each row represents a neighbor that the router has learned about through Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. The 'IPv6 Address' column shows the neighbor's IPv6 address, which can be global unicast, unique local, or link-local.
The 'Age' column indicates how many minutes have passed since the entry was last updated; a value of 0 means the entry was just learned or refreshed. The 'Link-layer Addr' is the MAC address of the neighbor. The 'State' column is critical for troubleshooting: 'REACH' means the neighbor is reachable and recently confirmed; 'STALE' means reachability has not been confirmed recently but the entry is still valid; 'DELAY' means the router is waiting for a confirmation after sending a unicast NS; 'PROBE' means the router is actively sending NS messages to verify reachability.
'INCOMPLETE' indicates that the router has not received a response to an NS. The 'Interface' shows which local interface connects to that neighbor. In a healthy network, most entries should be in REACH or STALE state.
A large number of INCOMPLETE entries may indicate connectivity issues or misconfigured devices. Watch for duplicate MAC addresses or unexpected entries that could indicate spoofing.
Configuration Scenarios
Verify IPv6 Neighbor Discovery on a Point-to-Point Link
Two routers are connected directly via GigabitEthernet interfaces and have IPv6 addresses configured. You need to verify that each router has discovered the other's MAC address and that the neighbor state is REACH.
Topology
R1(Gi0/0)---2001:db8:12::/64---(Gi0/0)R2Steps
- 1.Step 1: On R1, enter privileged EXEC mode: enable
- 2.Step 2: Display the IPv6 neighbor cache: show ipv6 neighbors
- 3.Step 3: Verify that R2's IPv6 address (2001:db8:12::2) appears with a MAC address and state REACH.
- 4.Step 4: If not REACH, ping R2's IPv6 address to trigger neighbor discovery: ping ipv6 2001:db8:12::2
- 5.Step 5: Re-check the neighbor cache.
! On R1 interface GigabitEthernet0/0 ipv6 address 2001:db8:12::1/64 no shutdown ! ! On R2 interface GigabitEthernet0/0 ipv6 address 2001:db8:12::2/64 no shutdown
Verify: R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface 2001:db8:12::2 0 aaaa.bbbb.cccc REACH Gi0/0 Expected: R2's MAC address appears with state REACH.
Watch out: If the interface is not up/up, the neighbor cache will be empty. Always verify interface status with 'show ipv6 interface brief' first.
Troubleshoot Missing IPv6 Neighbor on a Multi-Access Segment
A router and a host are on the same VLAN (GigabitEthernet0/0.10). The host cannot ping the router's IPv6 address. You suspect the router has not discovered the host's MAC address.
Topology
R1(Gi0/0.10)---2001:db8:10::/64---Host (2001:db8:10::100)Steps
- 1.Step 1: On R1, enter privileged EXEC mode: enable
- 2.Step 2: Check the neighbor cache for the host's IPv6 address: show ipv6 neighbors 2001:db8:10::100
- 3.Step 3: If no entry or state INCOMPLETE, the host may not be responding to Neighbor Solicitations.
- 4.Step 4: Verify the host's IPv6 configuration and that it is on the same VLAN.
- 5.Step 5: From the host, ping the router's IPv6 address to trigger neighbor discovery.
- 6.Step 6: On R1, re-check the neighbor cache.
! On R1 interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ipv6 address 2001:db8:10::1/64 no shutdown
Verify: R1# show ipv6 neighbors 2001:db8:10::100 IPv6 Address Age Link-layer Addr State Interface 2001:db8:10::100 0 xxxx.yyyy.zzzz REACH Gi0/0.10 Expected: The host's MAC address appears with state REACH.
Watch out: If the host has a firewall blocking ICMPv6 Neighbor Solicitations, the neighbor will never be discovered. Check host firewall settings.
Troubleshooting with This Command
When troubleshooting IPv6 connectivity issues, the `show ipv6 neighbors` command is your first stop for layer 2 resolution problems. A healthy output shows entries with state REACH for active neighbors. The Age field indicates how long ago the entry was last refreshed (in seconds). A low age (e.g., 0-10) is typical for active communication. The Link-layer Addr field should show a valid MAC address (e.g., aaaa.bbbb.cccc).
Problem indicators include: - **Missing entry**: If a neighbor you expect to see is not in the cache, it means the router has not received a Neighbor Advertisement from that host. This could be due to the host being down, a layer 2 issue (e.g., wrong VLAN, cable problem), or the host not responding to Neighbor Solicitations. - **State INCOMPLETE**: The router has sent a Neighbor Solicitation but has not received a Neighbor Advertisement. This often indicates a layer 2 problem or the host not being reachable. Check if the host is powered on and connected. - **State STALE**: The entry has not been used for a while (default 30 seconds). This is normal for idle neighbors, but if you are actively trying to communicate, the state should transition to REACH after a successful exchange. - **State DELAY or PROBE**: The router is in the process of verifying reachability. If it stays in these states, there may be intermittent connectivity.
Step-by-step diagnostic flow: 1. Identify the problem: e.g., ping from R1 to host 2001:db8:10::100 fails. 2. Run `show ipv6 neighbors 2001:db8:10::100` on R1. 3. If no entry or INCOMPLETE, check the interface status with `show ipv6 interface brief` to ensure it is up/up. 4. Verify layer 2 connectivity: check the switchport, VLAN, and cable. 5. From the host, ping the router's IPv6 address to trigger NDP. 6. Re-run `show ipv6 neighbors` to see if the entry appears. 7. If still missing, capture packets with `debug ipv6 nd` (use with caution in production) to see if Neighbor Solicitations are being sent and received.
Correlate with other commands: `show ipv6 interface` shows the interface's link-local address and multicast groups, which are used for NDP. `show ipv6 route` shows the routing table; if a route points to a next-hop that is not in the neighbor cache, traffic will fail. `ping ipv6` tests end-to-end reachability. `traceroute ipv6` can show where packets stop. The combination of these commands helps isolate whether the problem is at layer 2 (neighbor cache), layer 3 (routing), or higher.
CCNA Exam Tips
CCNA exam tip: The neighbor state 'INCOMPLETE' means the router sent an NS but hasn't received an NA yet; this is common when pinging a new address for the first time.
CCNA exam tip: Remember that link-local addresses (fe80::/10) are also displayed; they are automatically generated and used for neighbor discovery and routing protocols.
CCNA exam tip: The 'Age' field resets to 0 when the entry is refreshed; a high age with STALE state is normal for idle neighbors.
CCNA exam tip: Static IPv6 neighbor entries can be configured with 'ipv6 neighbor' and will show state 'REACH' with age '-'; they are used for security or to map addresses without ND.
Common Mistakes
Mistake 1: Confusing 'show ipv6 neighbors' with 'show ip neighbors' (which is for IPv4 ARP). The IPv6 command is specifically for IPv6 ND cache.
Mistake 2: Assuming a STALE state indicates a problem; STALE is normal for entries not recently used. The router will verify reachability when needed.
Mistake 3: Forgetting that the output includes link-local addresses; these are essential for IPv6 operations but can clutter the output if not filtered.
show ipv6 neighbors vs show ipv6 route
Both 'show ipv6 neighbors' and 'show ipv6 route' are essential for IPv6 troubleshooting, but they address different layers: the former maps IPv6 to MAC addresses on local links, while the latter shows how to reach remote networks. They are often confused because both involve IPv6 prefixes and are used together to diagnose connectivity problems.
| Aspect | show ipv6 neighbors | show ipv6 route |
|---|---|---|
| Scope | Local link neighbors only | All known routes (local, connected, dynamic) |
| Information Provided | IPv6-to-MAC address mappings | IPv6 route prefixes, next-hop, metric, interface |
| Layer | Layer 2 (Data Link) | Layer 3 (Network) |
| Use Case | Verify neighbor reachability and duplicate address detection | Verify routing paths and locate missing routes |
| Output Fields | IPv6 address, MAC address, state, interface | Prefix, next-hop, metric, interface, age |
| Typical Troubleshooting Issue | Neighbor not reachable or duplicate IPv6 address | Route missing or suboptimal path selection |
Use show ipv6 neighbors when troubleshooting connectivity to a directly connected neighbor or verifying neighbor unreachability detection (NUD).
Use show ipv6 route when verifying the IPv6 routing table to confirm routes are present and the next-hop is reachable.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `show ipv6 neighbors` command syntax and output are very similar to classic IOS. However, on some IOS-XE platforms, the output may include additional fields like 'Platform' or 'Port' for switch interfaces. The command is available in privileged EXEC mode.
On NX-OS (e.g., Nexus switches), the equivalent command is `show ipv6 neighbor` (note: singular 'neighbor' vs plural 'neighbors' in IOS). The output format differs: it includes columns like 'IPv6 Address', 'Age', 'MAC Address', 'Interface', 'State', and 'Flags'. The state values are similar (REACH, STALE, etc.). NX-OS also supports `show ipv6 neighbor detail` for more information.
On ASA firewalls, IPv6 neighbor discovery is supported, but the command is `show ipv6 neighbors` in ASA 9.x and later. The output is similar to IOS but may be limited to interfaces configured with IPv6.
In IOS-XR (e.g., ASR 9000), the command is `show ipv6 neighbors` as well, but the output format is different, often showing the neighbor address, interface, MAC, and state in a tabular format. The command is available in EXEC mode.
Behavior differences between IOS versions: In older IOS 12.x, the neighbor cache might not show the 'Age' field in seconds but in minutes. In IOS 15.x and 16.x, the output is more consistent. The `clear ipv6 neighbors` command is available in all versions to flush the cache. Always check the specific platform documentation for exact syntax and output fields.
Related Commands
show ipv6 interface [interface]
Displays detailed IPv6 configuration and status for an interface, including all IPv6 addresses, link-local address, NDP settings, RA flags (M/O), and whether the interface is forwarding IPv6 packets.
show ipv6 route
Displays the IPv6 routing table on a Cisco router, showing all known IPv6 routes and their next-hop information for troubleshooting and verification of IPv6 routing.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions