Internet Protocol v6

Haozhe Xie
11 min read
IPv6

Internet Protocol version 6 (IPv6) is the current version of the Internet Protocol (IP). The IETF developed it to solve IPv4 address exhaustion, which has since become reality: IANA handed out its last IPv4 blocks in 2011, and the regional registries followed soon after. IPv6 is no longer a future technology but a deployed one, carrying more than 40% of the traffic reaching Google by the mid-2020s.

IPv6 uses a 128-bit address, in theory allowing 2128 (about 3.4×1038) addresses, although a number of ranges are reserved or excluded from ordinary use. That is vastly more than the roughly 4.3 billion addresses of 32-bit IPv4. The two protocols are not interoperable on the wire, so hosts generally run both at once (dual stack) during the long transition.

An IPv6 address is written as eight groups of four hexadecimal digits separated by colons, for example 2001:19f0:6000:8f2a:5400:ff:fe20:ad5e, with shorthand rules described below.

This post focuses on IPv6 addressing: how addresses are written and structured, the types you will meet, and how a host ends up with them. The rest of the protocol (the streamlined header, extension headers, ICMPv6) is left for another day.

Note: This post has been updated for the current IPv6 addressing architecture (RFC 4291). The original 2016 version taught the obsolete aggregatable global unicast format (the TLA/NLA/SLA hierarchy from RFC 2374, made historic by RFC 3587), and presented site-local addresses, 6to4, and 6bone as if they were current. Those parts have been rewritten or flagged as the historical footnotes they now are.

Address Notation

The 128 bits of an address are split into eight groups of 16 bits, each written as four hexadecimal digits and separated by colons (:). Because spelling out all 32 digits is tedious, RFC 5952 defines a canonical shorthand:

  • Leading zeros in a group are dropped, so 0042 becomes 42.
  • One run of consecutive all-zero groups is replaced by a double colon (::). It may appear only once in an address, since two of them would make the length ambiguous; RFC 5952 also says it should not be used to shorten a single zero group.

For example:

  • Full form: 2001:19f0:0000:0000:0000:00ff:fe20:ad5e
  • After dropping leading zeros: 2001:19f0:0:0:0:ff:fe20:ad5e
  • After collapsing the zero run: 2001:19f0::ff:fe20:ad5e

The loopback address 0000:0000:0000:0000:0000:0000:0000:0001 collapses all the way down to ::1.

One more piece of notation appears throughout: a trailing /n, as in 2000::/3 or fde4:8dba:82e1::/48, is CIDR notation borrowed from IPv4. It means the first n bits are the network prefix, and the remaining bits identify subnets or interfaces within it.

Address Structure

A routable IPv6 unicast address splits into three logical parts (RFC 4291, §2.5.4):

Global Routing PrefixSubnet IDInterface ID
typically 48 bits16 bits64 bits
the network your ISP or RIR assigns to your sitewhich subnet within that sitewhich interface on the link

The 2016 version of this post broke the routing prefix into a fixed “reserved / provider-owned / provider-assigned” 16 + 16 + 16 hierarchy. That was the aggregatable global unicast (TLA/NLA/SLA) scheme of RFC 2374, and RFC 3587 retired it: prefixes are now handed out by the Regional Internet Registries under their own allocation policies, with no fixed internal subdivision. A site still typically receives a /48 and carves it into /64 subnets, which is why the column widths above are so common.

The interface ID, the low 64 bits, identifies a single interface on its link. Historically it was derived from the interface’s 48-bit MAC address in modified EUI-64 form: split the MAC into its 24-bit OUI and 24-bit device halves, insert FFFE between them, and flip the seventh bit. That made the address stable, but it also embedded the hardware address into every packet, which let a device be tracked as it moved between networks. Modern operating systems therefore default to randomized interface IDs instead: rotating temporary addresses (RFC 8981) for outbound connections, and stable, opaque per-network identifiers (RFC 7217) in place of the MAC-derived one. You will still meet EUI-64 in documentation and on some equipment, but it is no longer how a typical host picks its address.

Address Types

IPv6 classifies addresses by how they are routed and delivered: unicast (one interface), multicast (a group of interfaces), and anycast (the nearest of a group). Specific bit patterns at the front of the address mark each category.

Global Unicast

A global unicast address (GUA) is the IPv6 equivalent of a public IPv4 address: globally routable and reachable across the whole Internet. The first three bits are 001, so every GUA falls inside 2000::/3 (from 2000:: to 3fff::) and follows the structure above. Within that block the registries currently allocate from ranges such as 2001::/16, 2600::/12, and 2a00::/12.

Two ranges inside 2000::/3 are historical rather than current:

  • 2002::/16 was reserved for 6to4, a scheme for tunneling IPv6 packets over an IPv4 network. It is effectively obsolete: RFC 7526 deprecated the anycast relay prefix (192.88.99.0/24) that made it usable, and operators have switched it off in favor of native IPv6 and dual stack.
  • 3ffe::/16 was the 6bone, the experimental IPv6 testbed. It was shut down in 2006 and its prefix returned to IANA (RFC 3701).

Every IPv6 interface has a link-local address, even when it also has a routable one; IPv4 imposes no such requirement. They live in fe80::/10 and are valid only on the single link they are attached to, so routers never forward a packet with a link-local source or destination. They carry the low-level protocols that bring a link up: Neighbor Discovery (the IPv6 replacement for ARP), Stateless Address Autoconfiguration (SLAAC), and DHCPv6. Because they only need to reach neighbors on the same link, the nodes involved do not need a globally unique address to talk to each other.

If you have used IPv4, link-local addresses play the role of APIPA / AutoNet (169.254.0.0/16): an address a host configures for itself, with no DHCP server, just to communicate with its neighbors. The low 64 bits are the interface ID described above; the figure shows the classic EUI-64 form.

Unique Local Addresses

Unique local addresses (ULAs) are IPv6’s private addresses, the rough counterpart of 10.0.0.0/8 or 192.168.0.0/16 in IPv4. RFC 4193 defines them, reserving fc00::/7 and dividing it in two:

  • fd00::/8 is the half you actually use. You form a /48 prefix by setting the next 40 bits to a randomly generated value, giving the shape fdxx:xxxx:xxxx::/48. The randomness makes collisions between unrelated sites very unlikely, so two private networks can be merged or VPN-linked without renumbering. Each /48 still yields 65,536 subnets of size /64.
  • fc00::/8 was reserved for a centrally assigned variant that the IETF never standardized, so it is unused in practice.

For example, drawing the random 40-bit string e48dba82e1 yields the prefix fde4:8dba:82e1::/48, with subnets fde4:8dba:82e1::/64 through fde4:8dba:82e1:ffff::/64.

ULAs are not routed on the global Internet, so they do make NAT possible in IPv6, but it is discouraged: with a routable /64 on every subnet there is rarely a reason to hide behind NAT the way IPv4 forces you to.

Older material describes site-local addresses in fec0::/10 as IPv6’s private range. RFC 3879 deprecated those back in 2004 (the notion of a “site” was too ambiguous and led to surprising application behavior), and ULAs replaced them. Treat fec0::/10 as historical.

Multicast Addresses

A multicast address identifies a group of interfaces, usually spread across different nodes; a packet sent to it is delivered to every member of the group. Any address whose first byte is all ones (ff00::/8) is multicast. IPv6 has no broadcast address at all: its job is done by well-known multicast groups such as all-nodes (ff02::1) and all-routers (ff02::2), and by the solicited-node groups that Neighbor Discovery uses to check reachability.

The base format (RFC 4291) is simple: the ff byte, a 4-bit flags field, a 4-bit scope (how far the packet may travel: link-local, site-local, global, and so on), and a 112-bit group ID. RFC 3306 defines the richer unicast-prefix-based layout shown below, which lets a site derive multicast groups from its own unicast prefix:

  • 11111111 (ff) marks the address as multicast.
  • Flags are four bits 0,R,P,T. The high bit is reserved; R is the Rendezvous-Point flag (RFC 3956); T is 0 for a permanently assigned (well-known) group and 1 for a transient one; P is 1 for a prefix-based address (RFC 3306), in which case T must also be 1.
  • Scope limits how far the packet may be forwarded.
  • Reserved / Plen are a reserved byte and the number of significant bits in the network prefix.
  • Network Prefix is the unicast prefix the group is derived from.
  • Group ID identifies the multicast group itself.

For the complete details, see RFC 3306.

Anycast Addresses

An anycast address is assigned to several interfaces, usually on different nodes; a packet sent to it is delivered to the nearest one, as judged by the routing system. Anycast addresses are drawn from the ordinary unicast space and are syntactically indistinguishable from unicast: you create one simply by assigning the same unicast address to more than one interface and configuring those nodes to treat it as anycast. A common example is the subnet-router anycast address, a subnet prefix followed by all-zero interface bits (for instance 2001:19f0:6000:8f2a::), which reaches any router on that subnet.

Loopback and Unspecified Addresses

Two special addresses are each a single fixed value:

  • Loopback ::1/128 (127 zero bits followed by a 1) is IPv6’s 127.0.0.1. Traffic sent to it never leaves the host; the stack loops it straight back, which makes it useful for reaching local services and for testing the TCP/IP stack.
  • Unspecified ::/128 (all zeros) means “no address.” A host uses it as the source address before it has configured one, for instance in the Duplicate Address Detection probes it sends while bringing up an interface. It is never valid as a destination.

How a Host Gets an Address

Unlike IPv4, where an interface usually has a single address from DHCP, an IPv6 interface normally carries several at once: always a link-local address, often a ULA, and one or more global addresses (typically a stable one plus rotating temporary ones). They coexist, and the host chooses a source address per destination according to the rules in RFC 6724.

Most of these are configured by the host itself through Stateless Address Autoconfiguration (SLAAC). When an interface comes up, the host sends a Router Solicitation; a router answers with a Router Advertisement carrying one or more /64 prefixes. The host then forms an address for each prefix by appending a locally generated interface ID (a stable, opaque one per RFC 7217, plus temporary ones per RFC 8981). No server records the assignment, which is what “stateless” means, and it is also why the interface ID is fixed at 64 bits.

DHCPv6 is the stateful alternative: a server hands out addresses and configuration much as IPv4 DHCP does. In practice it is often run alongside SLAAC rather than instead of it, for example to distribute DNS settings while the addresses themselves still come from Router Advertisements.

One practical wrinkle follows from link-local addresses. Because the same fe80::/10 prefix exists on every interface, a link-local address on its own is ambiguous, so you must name the interface with a zone index: ping6 fe80::1%eth0 on Linux, or the %11 suffix you would see on Windows.

References