---
name: "ndpmon"
section: "8"
platform: "linux"
package: "ndpmon"
version: "1.4.0-2.1+b2"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/ndpmon"
---

# ndpmon(8)

Neighbor Discovery Protocol Monitor

## NAME

ndpmon - Neighbor Discovery Protocol Monitor

## SYNOPSIS

**ndpmon** \[ **-i** *interfacename* \] \[ **-f** *configfile* \] \[ **-d** *dtd\_file* \] \[ **-F** *filter* \]\
 \[ **-n** *number* \] \[ **-L** \] \[ **-v** \] \[ **-h** \] \[ **-d** *dtd\_file* \]\
 \[ **-g** *neighbor\_file* \]

## DESCRIPTION

**NDPMon** is  a monitoring software for ipv6 Neighbor Discovery. It syslogs activity and reports by email malicious ND message. **NDPMon** uses **libpcap** to listen for icmp6 packets and  **libxml2** to use configuration and neighbor cache files.

The **-i** flag is used to change the default interface eth0.

The **-f** flag is used to change the path of the configuration file. The default is */etc/ndpmon/config\_ndpmon.xml*

The  **-e** flag is used to change the path to the DTD file for the configuration file. The default is */etc/ndpmon/config\_ndpmon.dtd*

The **-n** flag uses libpcap to specify a limited number of packet to capture.

The **-F** flag allows one to change the default icmp6 filter.

The **-L** flag is used to disable syslog and mail reports. This is used to do a learning phase and constitue the neighbor cache.

The **-v** is used to enable the DEBUG mode.

The  **-d** flag is used to change the path to the DTD file for the neighbor cache. The default is */var/lib/ndpmon/neighbor\_list.dtd*

The **-g** flag is used to change the path to the neighbor cache. The default is  */var/lib/ndpmon/neighbor\_list.xml*

Note that an empty *neighbor\_cache.xml* file must be created before the first time you run **ndpmon.**

**NDPMon** must be run with **root** rights to work.

## REPORT MESSAGES

Here's the list of the report messages generated by **ndpmon:**

- **wrong couple MAC/IP**

  Separately, the MAC and IP addresses are valid, but not as a couple.

- **wrong router mac**

  The ethernet address of the RA message is not specified in the  configuration file.

- **wrong router ip**

  The ip address of the RA message is not specified in the  configuration file.

- **wrong prefix**

  The prefix announced in the RA message is not specified in the  configuration file.

- **wrong router redirect**

  The RD message does'nt come from a router specified in the configuration file.

- **NA router flag**

  The NA specifies a router but isn't one according to the configuration file.

- **DAD DOS**

  The NA answer to NS to avoid it to get an ip address.

- **changed ethernet address**

  The host switched to a new ethernet address.

- **flip flop**

  The ethernet address has changed from the most recently seen address to the second most recently seen address.

- **reused old ethernet address**

  The ethernet address has changed from the most recently seen address to the third (or greater) least recently seen address.

## SYSLOG MESSAGES

Here are some of the syslog messages; note that messages that are reported are also sysloged.

- **new activity**

  This ethernet/ip6 address pair has been announced for last time two months or more.

- **new station**

  The ethernet address has not been seen before on the link.

- **ethernet broadcast**

  The mac ethernet address of the host is a broadcast address.

- **ip broadcast**

  The ip address of the host is a broadcast address.

- **bogon**

  The source ip address is not local to the local subnet.

- **ethernet mismatch**

  The source mac ethernet address didn't match the address announced in option of the ND message.

## FILES

```
config_ndpmon.xml - contains settings which must be fill by the administrator
neighbor_list.xml - neighbor cache: all neighbors known to be on the link
```

## SEE ALSO

[**arpwatch**(8)](/arpwatch/8.md) [**ipv6**(7)](/ipv6/7.md), [**pcap**(3)](/pcap/3.md), [**libxml**(3)](/libxml/3.md).

## AUTHOR

Thibault Cholez and Frederic Beck for MADYNES Project, Loria, Fr.

## BUGS

- Please send bug reports to frederic.beck@loria.fr

  or thibault.cholez@esial.uhp-nancy.fr