IPv6 addressing: longer numbers, simpler rules

IPv6 looks intimidating for about twenty minutes, mostly because the addresses are long and written in hex. Underneath, it is a simpler protocol than IPv4: the header has fewer fields, routers never fragment, there is no broadcast, and a host can configure itself without a server. The length is the point — 128 bits is enough that you can stop rationing addresses and go back to designing networks.

The map

Read this first when short on time. Every branch is a section below.

Why a second internet protocol exists

IPv4 has 32 bits, so 4.3 billion addresses, and the free pool ran dry in 2011. The world did not stop, because NAT let thousands of hosts share one public address — but NAT bought time at a price that gets steeper the longer you pay it.

• There is no end-to-end path. A device behind NAT cannot be reached from outside unless something forwards a port, which is why peer-to-peer software carries elaborate hole-punching machinery.
• The middle keeps state. Every translation is a row in a table with a timer. Reboot the router and every conversation through it dies.
• Layers get violated. NAT rewrites layer 3 addresses and layer 4 ports, so any protocol that mentions its own address inside the payload — FTP, SIP — needs a special helper to work at all.

IPv6 uses 128 bits. That is 340 undecillion addresses, a number with 39 digits, and the practical consequence is that address scarcity stops being a design constraint. Every subnet gets a /64 whether it holds two hosts or two thousand, and nobody counts.

Along the way the header was cleaned up. The IPv6 header is a fixed 40 bytes with eight fields, against IPv4's variable header with fourteen. The checksum is gone, because layer 2 and layer 4 already check integrity. Fragmentation by routers is gone: if a packet is too big, the router drops it and sends back an ICMPv6 packet too big, and the sender adjusts. Options moved out into optional extension headers that routers can skip.

Reading and writing an address

An IPv6 address is 128 bits written as eight groups of four hexadecimal digits, separated by colons. Each hex digit is 4 bits, so 32 digits make 128 bits.

2001:0db8:0000:0000:0000:ff00:0042:8329

Nobody writes them that way, because two rules shorten almost every address dramatically.

Rule 1: drop leading zeros within each group. 0db8 becomes db8, 0000 becomes 0, 0042 becomes 42. Note "leading" — ff00 stays ff00, because those zeros trail.

2001:db8:0:0:0:ff00:42:8329

Rule 2: replace one run of consecutive all-zero groups with ::.

2001:db8::ff00:42:8329

The double colon may appear only once per address. If it appeared twice, there would be no way to know how many zero groups belong to each gap — the whole point is that a reader can count the groups that are present and infer the rest. When two runs of zeros are equally long, convention shortens the first.

Prefix length works exactly as in IPv4: a slash and a count of leading network bits. The difference is that in practice you only ever see a few lengths.

• /64 — one subnet. Effectively mandatory, because SLAAC assumes 64 host bits.
• /48 — the block a site typically receives, which contains 65,536 /64 subnets.
• /56 — a common allocation to a home from an ISP: 256 subnets.
• /128 — a single address, used for loopbacks.

Address types, and the death of broadcast

IPv4 has unicast, multicast and broadcast. IPv6 drops broadcast entirely and replaces it with well-known multicast groups, so a host that does not care about a message never has to process it.

Link-local is not optional

The one that surprises people: every IPv6 interface has a link-local address, always, whether you configured anything or not. It is generated the moment the interface comes up, it starts with fe80::, and it is never routed off the link.

This is not a curiosity. Link-local addresses are what neighbour discovery uses, what routers use to advertise prefixes, and what routing protocols use as the next-hop address. An OSPFv3 adjacency forms over link-local addresses, so two routers can exchange routes before either has a global address configured. In IPv4 nothing works until addressing is done; in IPv6 the link works first and addressing follows.

The consequence is that one interface normally carries several addresses at once — a link-local, one or more global addresses, and membership in several multicast groups — and that is completely normal rather than a misconfiguration.

The multicast groups worth memorising

The solicited-node group is the clever part. Instead of shouting at everyone the way ARP does, a host derives a multicast group from the last 24 bits of the address it is looking for and sends there. Statistically almost no other host shares those 24 bits, so almost nobody else's network card even wakes up. Broadcast replaced by targeted multicast is one of the quiet wins of IPv6 on a busy network.

Global unicast

A publicly routable IPv6 address, currently allocated from 2000::/3.

Unique local address

Private IPv6 space, fc00::/7. The fd half is used with a randomly generated 40-bit site identifier so two organisations that merge rarely collide.

Solicited-node multicast

A group derived from the low 24 bits of a target address, used by neighbour discovery so only the intended host is disturbed.

How a host gets an address without a server

IPv4 hosts wait for DHCP. IPv6 hosts can configure themselves, and the mechanism is SLAAC — stateless address autoconfiguration.

sequenceDiagram
  autonumber
  participant H as Host
  participant R as Router
  H->>R: Router solicitation to ff02::2
  R-->>H: Router advertisement to ff02::1
  Note over H,R: prefix 2001:db8:acad:7::/64, A flag set
  Note over H: builds its own 64-bit host part
  H->>H: Duplicate address detection on the new address
  Note over H: silence means nobody else has it, address goes live

1. The interface comes up and immediately gets its fe80:: link-local address.
2. The host sends a router solicitation to the all-routers group, ff02::2, rather than waiting for the next scheduled advertisement.
3. A router replies with a router advertisement: here is the prefix on this link, here is my link-local address as your default gateway, here is the MTU, and here are flags saying how you should get the rest.
4. The host builds a 64-bit host part and appends it to the prefix.
5. It runs duplicate address detection — a neighbour solicitation for its own new address. No answer means the address is free.

Where the host part comes from

Two methods, and modern hosts use both at once.

EUI-64 derives the host part from the interface MAC address: split the 48-bit MAC in half, insert fffe in the middle, and flip the seventh bit of the first byte. A MAC of 00:1b:44:aa:bb:cc becomes 021b:44ff:feaa:bbcc. It is deterministic, which is convenient for a server and terrible for a laptop — the MAC-derived half of your address follows you between networks and identifies you across all of them.

So hosts also generate privacy addresses: a random host part, regenerated periodically, used as the source address for outbound connections. This is why a phone or laptop typically shows several global addresses at once — a stable one and one or more temporary ones.

The flags that decide everything

Three bits in the router advertisement control how the host proceeds, and troubleshooting IPv6 addressing almost always comes down to reading them.

The combination in most networks is A and O: hosts self-assign addresses and ask a DHCPv6 server only for DNS servers and a search domain. Stateful DHCPv6 (M) is used where an organisation needs a record of which host holds which address.

Neighbour discovery: ARP's replacement

IPv4 finds a MAC address with ARP, a protocol of its own that broadcasts to the whole link. IPv6 folds the same job — and several others — into neighbour discovery, which runs on top of ICMPv6.

Neighbour solicitation is sent to the solicited-node multicast group rather than to everyone, so only the target host — and possibly one or two unlucky others sharing its last 24 bits — is interrupted. The same message type also performs duplicate address detection: a host asks for its own address and takes silence as permission.

Turning it on, and running both at once

Almost nobody runs IPv6 alone. The normal deployment is dual stack: every interface has both an IPv4 and an IPv6 address, both protocols run independently, and applications choose.

On IOS, IPv6 routing is off until you enable it, which is the single most common reason a correctly addressed router refuses to forward anything.

Router(config)# ipv6 unicast-routing
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ipv6 address 2001:db8:acad:1::1/64
Router(config-if)# ipv6 address fe80::1 link-local
Router(config-if)# no shutdown

Setting the link-local address by hand to something short like fe80::1 is a common convention, because that address becomes the default gateway every host on the link will use, and it is far easier to recognise in output than an EUI-64 value.

The checking commands mirror their IPv4 counterparts:

Router# show ipv6 interface brief
Router# show ipv6 route
Router# show ipv6 neighbors
Router# ping 2001:db8:acad:2::1

On the client side, dual stack raises the question of which protocol to use for a name that resolves to both. Browsers implement happy eyeballs: start both connections a few milliseconds apart, keep whichever completes first, and drop the other. It means a broken IPv6 path costs a small delay instead of a total failure, which is what made turning IPv6 on safe enough to do by default.

What happens to NAT

NAT was a response to scarcity, and scarcity is gone, so IPv6 hosts normally carry globally routable addresses end to end. This worries people who had come to think of NAT as a security feature. It is worth being precise about that: NAT never provided security, it provided the side effect that unsolicited inbound traffic had nowhere to go. A stateful firewall provides that property directly, deliberately, and with rules you can read. IPv6 networks run stateful firewalls at the edge that default to denying inbound connections; what they no longer do is rewrite addresses to achieve it.

SLAAC

Stateless address autoconfiguration: the host builds its own address from a prefix advertised by the router, with no server keeping records.

EUI-64

The method of deriving a 64-bit interface identifier from a 48-bit MAC by inserting fffe and flipping the universal/local bit.

Dual stack

Running IPv4 and IPv6 simultaneously on the same interfaces, with applications choosing per connection.

Happy eyeballs

The client algorithm that races IPv4 and IPv6 connections and keeps whichever answers first, so a broken path costs latency rather than availability.

Recap