I've spent a few hours tonight to add a feature I wanted to NDPMon - make it be able to listen on trunk interfaces.
1) only the monitoring part is supported for now, I did not even start
looking to the counter-measures.
2) "VLAN<n>:" is prepended to all the messages; "4095" signifying the
untagged frames, the other numbers mean the vlan# in the tagged frame.
3) obviously this is alpha - it can kill the newborn
kitten, cause lightning strikes and do other outrageous things.
If you're brave enough to mess around with it, head here:
https://github.com/ayourtch/ndpmon-dot1q and give it a shot in your lab.
And then tell me something about your experiences.