IPv6 — The Next Generation Internet Protocol

IPv4 provides 2^32 = 4,294,967,296 addresses. The global internet has approximately 5 billion internet users, and each user may have dozens of devices. IoT projections suggest 75 billion connected devices by 2030. IPv4's address space was fundamentally insufficient for the internet we built.

IPv6 was designed to solve this with 128-bit addresses — 2^128 = 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses. That's approximately 340 undecillion. Or: 340 trillion trillion trillion. Every human on Earth could have 43 quintillion addresses. Every square meter of Earth's surface could have 670 quadrillion addresses. IPv6 addresses do not run out.

Beyond addressing, IPv6 redesigns several aspects of networking: eliminates broadcast (replaced by multicast), introduces SLAAC for stateless address configuration, simplifies the IP header for faster forwarding, mandates IPsec support, and improves mobility support. IPv6 is not merely a larger address space — it is a redesigned protocol.

The 128-Bit Address

IPv6 addresses are 128 bits written as eight 16-bit groups (called hextets or quibbles) in hexadecimal, separated by colons. Each hextet is 4 hex digits (0000 to ffff). A complete IPv6 address:

2001:0db8:0000:0000:0000:0000:0000:0001

Address Compression Rules

Two compression rules make IPv6 addresses more readable:

Rule 1: Remove leading zeros. Within each 16-bit group, leading zeros may be omitted. 0db8 becomes db8. 0000 becomes 0.

Rule 2: Collapse consecutive all-zero groups with :: A single run of one or more consecutive all-zero groups can be replaced by :: (double colon). 2001:db8:0:0:0:0:0:1 becomes 2001:db8::1. The :: can only appear once — its position indicates how many zero groups to insert (total must equal 8 hextets).

The /64 Boundary

IPv6 network prefixes end at the /64 boundary for all LAN segments. This is not arbitrary — SLAAC (Stateless Address Autoconfiguration) requires exactly 64 host bits to generate EUI-64 based interface IDs. The prefix (first 64 bits) identifies the network; the interface ID (last 64 bits) identifies the host.

This fixed /64 boundary means every LAN segment has 2^64 ≈ 18.4 quintillion possible host addresses. Networks never run out of host addresses within a /64.

IPv6 has a richer address type system than IPv4, with specific address types serving specific functions. Understanding them is essential for IPv6 troubleshooting and design.

Solicited-Node Multicast: ARP's Replacement

In IPv4, ARP uses broadcast to find MAC addresses. In IPv6, there is no broadcast. Instead, each node automatically joins a solicited-node multicast group derived from its address: ff02::1:ff00:0/104 plus the last 24 bits of the interface address. When a host needs to resolve a neighbor's MAC, it sends a Neighbor Solicitation to the solicited-node multicast address — only the target host (or hosts sharing the same last 24 bits) receives it, dramatically reducing the number of devices that must process the message compared to broadcast.

Anycast in IPv6

IPv6 has explicit anycast support: any global unicast address can be advertised by multiple nodes. The routing infrastructure delivers packets to the topologically closest advertiser. IPv6 also defines a specific subnet-router anycast address for every subnet (the network address with all host bits = 0) — all routers on that subnet respond to it.

Link-Local Address: Always First

The first thing any IPv6 interface does is generate a link-local address (prefix fe80::/10). This happens before any router communication. The link-local address uses EUI-64 (or a random stable address in modern operating systems) as the interface ID. Link-local addresses are always present on every IPv6-enabled interface — they're how the router and host initially communicate (NDP, Router Solicitations).

SLAAC: Stateless Address Autoconfiguration

With SLAAC (RFC 4862), a host derives its global IPv6 address from the network prefix announced by the router without any DHCP server:

1. Router periodically broadcasts Router Advertisement (RA) to ff02::1, announcing the network prefix (e.g., 2001:db8::/64) and the A flag (autonomous configuration enabled).

2. Host takes the /64 prefix from the RA and combines it with a 64-bit interface ID (generated from MAC via EUI-64, or using RFC 7217 stable privacy-preserving IDs, or TEMPORARY random addresses per RFC 8981).

3. Host performs DAD (Duplicate Address Detection) — sends a Neighbor Solicitation to the solicited-node multicast address, waits 1 second. If no response: address is unique, assign it.

EUI-64: Interface ID from MAC

The original SLAAC interface ID generation uses EUI-64: take the 48-bit MAC address (e.g., AA:BB:CC:DD:EE:FF), insert the bytes FF:FE in the middle (AA:BB:CC:FF:FE:DD:EE:FF), then flip the 7th bit (Universal/Local bit, bit 6 of the first byte): AA in binary is 10101010 → flipping bit 6 (value 2) gives 10101000 = A8. Result: A8:BB:CC:FF:FE:DD:EE:FF, written as IPv6: a8bb:ccff:fedd:eeff.

DHCPv6: Stateful Assignment

DHCPv6 provides stateful address assignment (like IPv4 DHCP). The M flag in the RA tells hosts to use DHCPv6 for address assignment; the O flag tells hosts to use DHCPv6 for other information (DNS servers, domain search) while using SLAAC for the address itself. DHCPv6 is required when the network administrator needs to track which device has which address.

A key difference: DHCPv6 does not provide a default gateway. The default gateway is always learned from the RA (Router Advertisement), not from DHCPv6. This is a common IPv6 deployment mistake: engineers configure DHCPv6 and forget that the router must still send RAs.

NDP (Neighbor Discovery Protocol, RFC 4861) replaces IPv4's ARP, ICMP Router Discovery, and ICMP Redirect with a unified ICMPv6-based protocol. NDP is essential to IPv6 operation.

NDP Message Types

Router Solicitation (RS, ICMPv6 type 133): sent by a host to ff02::2 (all routers) when it needs router information immediately (instead of waiting for the next periodic RA). Triggered when an interface comes up.

Router Advertisement (RA, ICMPv6 type 134): sent by routers to ff02::1 (all nodes) periodically (default 200s) and in response to RS. Contains: network prefixes, M/O flags, lifetime, MTU, default gateway (implicit — the router's link-local address as source).

Neighbor Solicitation (NS, ICMPv6 type 135): asks "who has this IPv6 address? Tell me your MAC." Sent to the solicited-node multicast address. Also used for DAD.

Neighbor Advertisement (NA, ICMPv6 type 136): responds to NS with the sender's MAC address and flags. Similar to ARP reply.

Redirect (ICMPv6 type 137): sent by a router when it knows of a better next-hop for a destination. Equivalent to ICMP Redirect in IPv4.

The Neighbor Cache

The Neighbor Cache is IPv6's equivalent of the ARP cache. It stores IPv6-to-MAC-address mappings with states: INCOMPLETE (NS sent, awaiting NA), REACHABLE (recently confirmed reachable), STALE (confirmation timeout, but not probed yet), DELAY (probing to confirm reachability), PROBE (actively sending NS to confirm). The reachability state machine is more sophisticated than IPv4 ARP, reducing unnecessary NS traffic in large subnets.

SEND: Secure Neighbor Discovery

NDP is vulnerable to the same spoofing attacks as ARP — a rogue host can send fake NA messages claiming another host's IP and redirect traffic to itself. SEND (Secure Neighbor Discovery, RFC 3971) adds cryptographic protection: Cryptographically Generated Addresses (CGAs) bind the address to a public key, and NDP messages are signed. SEND is complex to deploy and not widely implemented in practice — RA Guard and DHCPv6 Guard provide partial mitigation.

IPv6's header is simplified compared to IPv4 — fixed at 40 bytes with fewer fields. All optional functionality is moved to extension headers.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| Traffic Class |           Flow Label                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Payload Length        |  Next Header  |   Hop Limit   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
|                         Source Address                        |
|                          (128 bits)                           |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
|                      Destination Address                      |
|                          (128 bits)                           |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Key Header Differences from IPv4

No header checksum: IPv4 required every router to verify and recompute the header checksum (TTL changes at each hop). IPv6 eliminates the header checksum — Layer 2 (Ethernet FCS) and Layer 4 (TCP/UDP) checksums provide integrity. This saves CPU cycles at every router.

No fragmentation fields: IPv6 routers never fragment packets. Only the source can fragment (using the Fragment extension header). Routers drop oversized packets and send ICMPv6 "Packet Too Big" back to the source. This eliminates per-packet fragmentation processing at routers and forces correct PMTU Discovery.

Fixed 40-byte header: IPv4 had a variable-length header (IHL field). IPv6's fixed-size header simplifies hardware processing — routers know exactly where the payload starts without parsing the header length.

Flow Label: 20-bit field to identify packets belonging to the same flow for QoS. Allows routers to group packets for consistent treatment without examining Layer 4 headers.

Extension Headers: IPv6 replaces IPv4's options with extension headers — separate headers inserted between the main header and the payload. Types include: Hop-by-Hop Options (routers must process), Routing (loose/strict source routing), Fragment, Authentication (IPsec AH), Encapsulating Security Payload (IPsec ESP), Destination Options. Extension headers form a linked list via the Next Header field.

Dual Stack

Dual stack runs IPv4 and IPv6 simultaneously on every device and every network link. A dual-stack host has both an IPv4 address and an IPv6 address; a dual-stack router has both protocol stacks active on every interface. When a dual-stack host connects to a server, it prefers IPv6 if the server has an AAAA record (IPv6 DNS record), falling back to IPv4 if IPv6 fails.

Dual stack is the most straightforward transition strategy but requires IPv6 support throughout the network path. It does not reduce IPv4 consumption — it runs both protocols in parallel. The goal is to eventually phase out IPv4, not to run both forever.

Tunneling: 6in4, 6to4, Teredo, DS-Lite

When an IPv6 island needs to cross IPv4-only infrastructure, tunneling encapsulates IPv6 packets inside IPv4 packets. 6in4 (RFC 4213): manually configured tunnel between two IPv6 routers across IPv4; reliable but requires setup at both ends. 6to4 (RFC 3056): automatic tunneling using the 2002::/16 prefix — embeds the IPv4 address in the IPv6 prefix, enabling automatic tunneling to any 6to4 relay. Deprecated due to reliability and security issues.

DS-Lite (Dual Stack Lite, RFC 6333): allows ISPs to give customers private IPv4 addresses while providing native IPv6. Customer's IPv4 traffic is encapsulated in IPv6 to the ISP's AFTR (Address Family Transition Router), which performs NAT44 to public IPv4. Used by ISPs that have deployed IPv6 to customers but still need to support legacy IPv4 traffic.

Translation: NAT64 and DNS64

NAT64 (RFC 6146) allows IPv6-only clients to reach IPv4-only servers. The NAT64 gateway translates IPv6 packets to IPv4 — the IPv4 destination address is embedded in a well-known /96 prefix (64:ff9b::/96). DNS64 (RFC 6147) works alongside NAT64: when an IPv6-only client queries DNS for a server that only has an A record (IPv4), DNS64 synthesizes an AAAA record by combining the NAT64 prefix with the IPv4 address. The client connects to the synthesized IPv6 address, which the NAT64 gateway translates to IPv4.

Happy Eyeballs (RFC 8305)

When a dual-stack host connects to a server with both IPv4 and IPv6, which protocol is tried first? Happy Eyeballs (RFC 8305) specifies: try IPv6 first. If IPv6 doesn't succeed within 250ms, try IPv4 simultaneously, use whichever succeeds first. This ensures users get the best of both worlds — IPv6 when available, IPv4 as fallback — without noticeable delay from IPv6 failures.

Linux IPv6 Configuration

# Show IPv6 addresses
ip -6 addr show
ip -6 addr show eth0

# Show neighbor cache (IPv6 ARP equivalent)
ip -6 neigh show

# Show IPv6 routing table
ip -6 route show

# Ping IPv6 (use %interface for link-local)
ping6 ::1                              # loopback
ping6 fe80::1%eth0                     # link-local (specify interface)
ping6 2001:db8::1

# Traceroute IPv6
traceroute6 2606:4700:4700::1111       # Cloudflare IPv6 DNS

# Static IPv6 address
ip -6 addr add 2001:db8::10/64 dev eth0

# Check SLAAC-generated address
ip -6 addr show eth0 | grep "scope global"

# Send Router Solicitation manually
rdisc6 eth0

Cisco IOS IPv6 Configuration

! Enable IPv6 routing
ipv6 unicast-routing

! Configure interface with global address
interface GigabitEthernet0/0
 ipv6 address 2001:db8:1::1/64
 ipv6 address fe80::1 link-local      ! explicitly set link-local
 no shutdown

! Enable SLAAC advertisements (Router Advertisement)
interface GigabitEthernet0/0
 ipv6 nd prefix 2001:db8:1::/64       ! advertise this prefix in RA
 no ipv6 nd ra suppress               ! send RAs (default on interfaces with IPv6)

! Configure OSPFv3 for IPv6 routing
ipv6 router ospf 1
 router-id 1.1.1.1
interface GigabitEthernet0/0
 ipv6 ospf 1 area 0

! Verify
show ipv6 interface brief
show ipv6 neighbors
show ipv6 route

IPv6 DNS: AAAA Records

IPv6 addresses are stored in DNS as AAAA records (pronounced "quad-A"). The IPv4 equivalent is an A record. A server providing both protocols has both A and AAAA records. DNS AAAA records contain the full 128-bit IPv6 address.

# Check if a domain has IPv6 (AAAA records)
dig google.com AAAA
dig +short google.com AAAA

# Check DNS resolver's IPv6 support
dig @2606:4700:4700::1111 google.com AAAA   # Cloudflare IPv6 DNS

# Example AAAA record in zone file
; IPv4 record
www     IN  A     93.184.216.34
; IPv6 record
www     IN  AAAA  2606:2800:220:1:248:1893:25c8:1946

No NAT — Direct Connectivity

IPv6 restores the internet's end-to-end model — every device has a globally routable address. This is fundamentally more correct than NAT but requires rethinking security. In IPv4 with NAT, unsolicited inbound connections fail automatically (no NAT state). In IPv6, every device is directly reachable — firewall rules must explicitly block unwanted inbound traffic.

The common misunderstanding: "IPv6 is less secure because there's no NAT." NAT was never a security mechanism — it was address translation. A stateful firewall on an IPv6 network provides equivalent security to NAT + firewall on IPv4, while restoring end-to-end connectivity. Most operating systems include a default "deny all inbound" stateful firewall policy for IPv6.

RA Guard and DHCPv6 Guard

Rogue Router Advertisements can be used to redirect host traffic through an attacker's host (rogue RA attack). RA Guard (RFC 6105) — implemented on managed switches — inspects ICMPv6 RA messages and drops any received on ports not configured as router-facing. Only designated "router" ports can send valid RAs. DHCPv6 Guard similarly filters DHCPv6 server messages to only those originating from trusted ports.

IPv6 Extension Header Abuse

IPv6 extension headers can be chained arbitrarily and processed in different ways at different nodes. Attackers have exploited extension headers to: bypass firewalls that don't process extension headers, craft Hop-by-Hop headers that force all routers to process the packet (DoS via header injection), and fragment extension headers across fragment boundaries to hide malicious content. Modern firewalls and routers are hardened against these techniques, but extension header processing remains an ongoing security research area.

IPv6 adoption has accelerated dramatically since 2015, driven by mobile carriers and major internet companies. As of 2024:

Google IPv6 adoption: approximately 48% of users access Google over IPv6. This is a reliable metric because Google measures actual client connections.

Mobile-first adoption: T-Mobile USA was ~100% IPv6 for mobile users by 2020. All major US mobile carriers are predominantly IPv6. Mobile devices default to IPv6 because carrier networks exhausted IPv4 — CGNAT was the alternative.

Content providers: Cloudflare, Google, Facebook, Netflix, Amazon all support IPv6 natively. Over 30% of the Alexa top 1 million websites have IPv6 addresses.

Enterprise: Enterprise IPv6 adoption lags consumer — internal networks often still IPv4-only with dual-stack at the edge. The operational complexity of migrating existing IPv4 infrastructure is significant.

OSPFv3

OSPFv3 (RFC 5340) is OSPF modified for IPv6. Key differences from OSPFv2: OSPFv3 runs on link-local addresses (not global addresses), meaning a router's OSPFv3 neighbor is identified by its link-local address. Router IDs are still 32-bit values (same as IPv4 — just identifiers, not actual addresses). OSPFv3 supports address-family separation — the same OSPFv3 instance can route both IPv4 and IPv6 using address-family indicators.

BGP for IPv6

IPv6 BGP uses MP-BGP (Multi-Protocol BGP, RFC 4760) — an extension to BGP-4 that adds IPv6 address family support. A BGP session can carry both IPv4 (AFI=1, SAFI=1) and IPv6 (AFI=2, SAFI=1) prefixes over a single TCP connection. BGP sessions for IPv6 prefixes can be established over either IPv4 or IPv6 transport.

! Cisco IOS — BGP IPv6 configuration
router bgp 65001
 bgp router-id 10.0.0.1
 neighbor 2001:db8::2 remote-as 65002

 address-family ipv6 unicast
  neighbor 2001:db8::2 activate
  network 2001:db8:1::/48

! Verify
show bgp ipv6 unicast summary
show bgp ipv6 unicast

# Check all IPv6 addresses on all interfaces
ip -6 addr show

# Check neighbor table (ARP equivalent)
ip -6 neigh show
# States: REACHABLE, STALE, INCOMPLETE, DELAY, PROBE

# Ping (include %interface for link-local)
ping6 -c 4 2001:4860:4860::8888     # Google IPv6 DNS

# Traceroute
traceroute6 google.com

# DNS check — does host have AAAA record?
dig AAAA google.com +short

# tcpdump — capture ICMPv6 (NDP traffic)
tcpdump -i eth0 icmp6 -n

# Watch for Router Advertisements
tcpdump -i eth0 'icmp6 and ip6[40] == 134'  # type 134 = RA

# Linux — force Router Solicitation
rdisc6 eth0

# Check if IPv6 is forwarding (routing enabled)
sysctl net.ipv6.conf.all.forwarding

Common IPv6 Issues

No global IPv6 address despite RA being sent: Check M flag in RA (if M=1, host should use DHCPv6 for address, not SLAAC). Check that the prefix in the RA has the A (autonomous) flag set. Check DAD — if multiple hosts had the same EUI-64, one lost the DAD contest.

Cannot reach IPv6 default gateway: The default gateway in IPv6 is the router's link-local address learned from the RA. If no RA is received, no default route is installed. Check ip -6 route show for a default route (:: /0).

DHCPv6 address assigned but no default gateway: DHCPv6 does not provide a default gateway (unlike IPv4 DHCP). The router must still send RAs. A common misconfiguration: DHCPv6 works, but the router has ipv6 nd ra suppress configured, preventing RA transmission. Remove that command.

Privacy extensions creating multiple addresses: Modern OS generates both a stable address (from MAC or RFC 7217) for incoming connections and multiple temporary addresses (rotating every few hours) for outbound connections. ip -6 addr show may show 3-5 addresses per interface. This is normal — the privacy extensions addresses are used for outbound connections to prevent tracking.