What is the use of IPv6 snooping?
Describe IPv6 First Hop security features (RA guard, DHCP guard, binding table, ND inspection/snooping, source guard)
What is the use of IPv6 snooping?
Answer
Correct answer: D — IPv6 snooping captures user traffic to create and populate the binding table for IPv6 first-hop security.
Community Insight
IPv6 snooping populates the binding table by capturing control and data traffic, and it is NOT required for the operation of RA Guard or DHCPv6 Guard.
IPv6 snooping inspects neighbor discovery and DHCP messages to build a binding table, providing foundational security for features like IPv6 Source Guard. This page clarifies its exact function and distinguishes it from other first-hop security mechanisms.
Choosing C because RA Guard seems related, but RA Guard operates independently and does not rely on the binding table populated by IPv6 snooping.
Community Discussion (13 comments)
Luongchacha1
👍 1
Selected: C
I go with C. D. captures any type of user traffic to create a binding table --> you guy should notice the "any type of user traffic".
Brahim90
👍 1
Selected: D
Given answer is correct per cisco book page 864. IPv6 Neighbor Discovery Inspection/IPv6 Snooping IPv6 neighbor discovery inspection/snooping is a feature that learns and populates the binding table for stateless autoconfiguration addresses. It analyzes ND (neighbor discovery) messages and places valid bindings in the binding table and drops all messages that do not have valid bindings. A valid ND message is one where the IPv6-to-MAC mapping can be verified.
bk989
👍 2
so the answer is D
bk989
👍 2
The data traffic relates to destination guard: IPv6 Destination Guard 11. If an attacker attempts to spoof many IPv6 destinations in a short time, the router can get overwhelmed while trying to store temporary cache entries for each destination. The ______________feature blocks data traffic from an unknown source and filters IPv6 traffic based on the destination address. It populates all active destinations into the IPv6 first-hop security binding table, and it blocks data traffic when the destination is not identified. IPv6 Destination Guard https://quizlet.com/533167094/chapter-6-infrastructure-security-flash-cards/
bk989
👍 2
A: Obviously it doesn't inspect OSPF packets. Any type of layer 3 pakets are DHCP packets. FALSE B:No it doesn't. This isn't the point of IPv6 snooping, it's for IPv6 security on the switch. C: According to the link I provided C is false (see below) D: By capturing any type of user traffic: ND packets, DHCP packets, and some data packets I guess this is the answer.
bk989
👍 3
You also stated: “IPv6 Snooping is tightly integrated in the various IPv6 guard features (e.g. DHCPv6 guard and RA guard) as explained above.” While this is true in general you unfortunately just picked the two exceptions from this general rule: For DHCPv6 guard and RA guard this is not true, because both features are operating independent from IPv6 snooping and don’t rely on the binding table, which is only needed for other IPv6 FHS features like source guard, destination guard, IPv6 device tracking or optimization features like RA throttler or ND multicast suppress. https://insinuator.net/2014/01/configuring-ipv6-snooping-and-dhcpv6-guard-on-cisco-ios/#:~:text=This%20is%20the%20default%20option,Reply
amir_lotfy
👍 1
Selected: C
IPv6 Snooping Enabled: IPv6 RA Guard relies on IPv6 snooping to inspect and filter IPv6 Router Advertisement (RA) messages received on Layer 2 interfaces. Therefore, IPv6 snooping must be enabled on the switch where RA Guard is configured.
bk989
👍 1
no wrong
Pietjeplukgeluk
👍 2
Selected: D
D is wrong answer, but the best of all options as it does NOT capture "ANY" traffic, it only capture DHCPV6 traffic to create binding table entries
bk989
👍 2
It captures DHCP, ND packets, and some data traffic (I believe the data traffic is related to source guard, and I'm not sure how this actually relates to populating the binding table)
bk989
👍 1
Doesn't RA Guard rely on IPv6 Snooping? Why not C
dapardo
👍 2
Selected: D
Agree on TonyTe0 explanation
TonyTe0
👍 2
D: correct IPv6 Snooping IPv6 snooping captures the IPv6 traffic and helps in populating the binding table. It gathers addresses in control messages such as Neighbor Discovery Protocol (NDP) or Dynamic Host Configuration Protocol (DHCP) packets. Depending on the security level, it blocks unwanted messages such as Router Advertisements (RA) or DHCP replies. This feature is a pre-requisite to the remaining security features mentioned here. https://www.cisco.com/c/en/us/td/docs/routers/7600/ios/15S/configuration/guide/7600_15_0s_book/IPv6_Security.html
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is correct because the primary function of IPv6 snooping (also known as ND inspection) is to learn and populate the binding table. It captures various types of user traffic, including Neighbor Discovery (ND) and DHCP packets, to extract binding information (MAC, IP, VLAN, interface) and build this table. This binding table is then used by dependent features like IPv6 Source Guard to prevent address spoofing.Why the Other Options Are Wrong
Option A is incorrect because IPv6 snooping does not capture or analyze routing protocol packets; it focuses on data plane and control plane messages relevant to address assignment (NDP, DHCPv6). Option B is incorrect because IPv6 snooping is an internal switch feature and does not require an external packet analyzer. Option C is a common trap; while IPv6 snooping is required for Source Guard and Destination Guard, RA Guard and DHCPv6 Guard operate independently and do not rely on the binding table generated by IPv6 snooping.Community Comment Notes
Commenters highlighted that C is false because RA Guard and DHCPv6 Guard do not rely on the binding table, as bk989 noted: "both features are operating independent from IPv6 snooping". TonyTe0 confirmed that "IPv6 snooping captures the IPv6 traffic and helps in populating the binding table." While some like Pietjeplukgeluk pointed out that "any type" in option D is slightly misleading since it primarily captures control traffic, D remains the best available option.Official Reference
Exam Strategy
Memorize which IPv6 first-hop security features depend on the binding table (Source Guard, Destination Guard) versus those that operate independently (RA Guard, DHCPv6 Guard). Knowing this distinction immediately eliminates common distractors like RA Guard dependency.
Related Analysis
Practice All 300-410 Questions
Access 159 questions with complete answers and detailed explanations.
View Full 300-410 Practice Test →