IPv6 - destination guard

Destination guard is a feature that works with IPv6 neighbor discovery to ensure that a device performs address resolution only for those addresses that are known to be active on the link.

It uses what is known as address glean functionality. Address gleaning involves snooping Neighbor Discovery Protocol (NDP) and DHCP messages on the link to populate the binding table. When a packet reaches the device and there is not yet an adjacency for the destination or for the next hop, the NDP consults the device binding table to verify that the destination or the next hop has been previously gleaned. If the destination is not found in the binding table, the packet is dropped. Otherwise, neighbor discovery resolution is performed.