Global InformationNDPMon information
 | The topic of this article may not meet Wikipedia's general notability guideline. (May 2016) |
 | A major contributor to this article appears to have a close connection with its subject. (May 2016) |
The Neighbor Discovery Protocol Monitor (NDPMon) is a diagnostic software application used by network administrators for monitoring ICMPv6 packets in Internet Protocol version 6 (IPv6) networks.[1][2] NDPMon observes the local network for anomalies in the function of nodes using Neighbor Discovery Protocol (NDP) messages, especially during the Stateless Address Autoconfiguration.[3] When an NDP message is flagged, it notifies the administrator by writing to the syslog or by sending an email report. It may also execute a user-defined script. For IPv6, NDPMon is an equivalent of Arpwatch for IPv4, and has similar basic features with added attacks detection.[4]
NDPMon runs on Linux distributions, Mac OS X, FreeBSD, NetBSD and OpenBSD. It uses a configuration file containing the expected and valid behavior for nodes and routers on the link. This includes the router addresses (MAC and IP) and the prefixes, flags and parameters announced.
NDPMon also maintains a list of neighbors on the link and monitors all advertisements and network changes. It permits tracking the usage of cryptographically generated interface identifiers or temporary global addresses when Privacy extensions are enabled.
NDPMon is free software published under the GNU Lesser General Public License version 2.1.
- ^ RFC 4861, Neighbor Discovery for IP version 6 (IPv6), T. Narten et al. (September 2007)
- ^ Monitoring the Neighbor Discovery Protocol F. Beck, T. Cholez, I. Chrisment and O. Festor - The Second International Workshop on IPv6 Today - Technology and Deployment - IPv6TD 2007 (2007)
- ^ RFC 4862 IPv6 Stateless Address Autoconfiguration, S. Thomson, T. Narten, T. Jinmei (September 2007)
- ^ RFC 3756 IPv6 Neighbor Discovery (ND) Trust Models and Threats P. Nikander, Ed.,J. Kempf, E. Nordmark (May 2004)