IPv6

Introduction

This page is about IPv6. For IPv4 read this article

An IPv4 address is 32 bits = 4 bytes long.

192.168.10.10

11000000 10101000 00001010 00001010

An IPv6 address is four times longer: 128 bits = 32 nibbles = 16 bytes = 8 hextets

2001:0DB8:0002:008D:0000:0000:00A5:52F5 0010000000000001:0000110110111000:0000000000000010:0000000010001101:0000000000000000:0000000000000000:0000000010100101:0101001011110101

Since half of the address is the network address, a regular network can hold 2 ** 64 addresses, that is 18446744073709551616

Structure

The network address (Network Portion) is 64 bits long

2001:0DB8:0002:008D

The host address (Host Portion or Interface Identifier) is 64 bits long too

0000:0000:00A5:52F5

The full address looks like this

2001:0DB8:0002:008D:0000:0000:00A5:52F5

Removing leading zeros

If the full address looks like this

2001:0DB8:0002:008D:0000:0000:00A5:52F5

it can be shortened by removing the leading zeros, which carry no meaning

2001:DB8:2:8D:0:0:A5:52F5

A run of hextets that are all zeros can be replaced with ::

Here these are the first two hextets of the host address

2001:DB8:2:8D::A5:52F5

In this example :: sits between the network part on the left and the host address on the right.

An address can contain only one ::

Unicast Address

A unicast address identifies exactly one network interface. The IPv6 protocol delivers packets sent to such an address to that one interface.

There are these types of unicast addresses:

• Global Unicast
• Link-Local
• Unique Local Address (ULA)
• Loopback

Global Unicast

A public address that is reachable over the global internet

Link-Local

fe80::/10

An address for local networks only. It is not reachable over the global internet.

The counterpart of APIPA addresses in IPv4

Let us look closer at what this means

fe80::/10

FE80 is

1111 1110 1000 0000

/10 means that the first 10 bits must stay the same

The first 10 bits are

1111 1110 10

The remaining 118 bits are the interface address.

The first Link-Local IPv6 address is

1111 1110 1000 0000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000

FE80::

The last Link-Local IPv6 address is

1111 1110 1011 1111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111

FEBF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

So the Link-Local range starts at FE80:: and ends at FEBF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

Not every Link-Local address starts with FE80. FE8*, FE9*, FEA* and FEB* are possible too, where * is any hex digit from 0 to F

Unique Local Address (ULA)

An address for local networks only. It is not reachable over the global internet.

The counterpart of private addresses in IPv4 , but without NAT.

FC00::/7

FC00 is

1111 1100 0000 0000

/7 means that the first 7 bits must stay the same

The first 7 bits are

1111 110

The remaining 121 bits are the interface address.

The first ULA IPv6 address is

1111 1100 0000 0000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000

FC00::

The last ULA IPv6 address is

1111 1101 1111 1111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111 1111111111111111

FDFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

Loopback

The address for traffic to the host itself. It is not reachable over the global internet.

The counterpart of the loopback address 127.0.0.1 in IPv4

::1/128

Multicast Address

A multicast address identifies a group of interfaces.

Packets sent to a multicast address are delivered to every member of the group.

Anycast Address

An anycast address is assigned to several interfaces, usually on different devices.

Traffic sent to an anycast address is delivered to the nearest interface (in terms of routing).

SLAAC

Stateless Address Auto-configuration.

When the system starts, the node automatically creates a link-local address on every IPv6-enabled interface, even if globally routable addresses are configured manually or obtained through configuration protocols.

It does this on its own and without any prior configuration, with stateless address autoconfiguration (SLAAC), which uses a component of the Neighbor Discovery protocol. This address is chosen with the prefix fe80::/64.

In IPv4 the typical configuration protocols are DHCP or PPP. DHCPv6 exists, but IPv6 hosts usually use the Neighbor Discovery protocol to create a globally routable unicast address: the host sends router solicitations, and the IPv6 router answers by assigning a prefix.

In Windows the Interface Identifier is created as a random 64-bit number

In Linux and Unix the Interface Identifier used to be created from the MAC address

SLAAC in Linux

SLAAC in Linux works by listening to IPv6 Router Advertisements (RA), learning the /64 prefix of the network and generating its own IPv6 address automatically, usually with a randomized interface identifier.

For this Linux uses the IPv6 Neighbor Discovery Protocol (NDP), and the feature is enabled by default in all modern distributions.

How SLAAC works in Linux, step by step

1. Linux brings the interface up

When a network interface becomes active, the kernel turns on IPv6 autoconfiguration automatically, unless it was explicitly disabled.

Typical names of network interfaces in Linux:

eth0, eth1, enp0s3, enp0s8, wlan0

Bringing the interface up starts the creation of the IPv6 link-local address

FE80::/10

Duplicate Address Detection (DAD) checks that the link-local address is unique.

2. Linux waits for Router Advertisements (RA)

RA stands for Router Advertisements

Routers periodically send ICMPv6 router advertisements that contain:

The network prefix (usually /64)

Flags that say whether SLAAC is available (the A flag)

DNS information (RDNSS), if provided

The router lifetime and the MTU

Linux also asks for this information itself by sending a Router Solicitation when the interface becomes active.

3. Linux builds its IPv6 address

After it receives a router advertisement (RA), Linux generates an interface identifier (IID) and appends it to the prefix.

Linux can generate the IID in several ways:

• Stable privacy addresses (the default in modern distributions)
  
  A pseudo-random 64-bit number based on the network prefix, the interface name, a secret key (kept in the kernel) and a per-interface counter, RFC 7217
  
  
• Temporary privacy addresses for outgoing connections
• EUI-64 addresses (an older method that uses the MAC address)

4. Linux runs Duplicate Address Detection (DAD)

Before it uses the new global IPv6 address, Linux sends a Neighbor Solicitation to make sure no other device uses it.

If no conflict is found, the address becomes preferred and ready to use.

5. Linux sets up the default route and DNS

If the router advertisement (RA) includes

• A router lifetime → Linux sets the default IPv6 route.
• RDNSS options → Linux configures the DNS servers without DHCPv6.

That completes SLAAC.

EUI-64

To turn a MAC address of the form

aa:bb:cc:dd:ee:ff

into a new IPv6 host address, two more bytes, FF:FE, are inserted after the 3rd byte

aa:bb:cc:FF:FE:dd:ee:ff

The 7th bit of the first byte is inverted

aa (1010 1010) becomes

a8 (1010 1000)

a8:bb:cc:FF:FE:dd:ee:ff

Subnets

In IPv4 we could pick a CIDR mask of any size. In IPv6 only /64 is recommended for a LAN

Other prefix lengths are used in special cases:

Addresses of the form

2001:DB8::/32

are used for documentation and in labs

Article author: Andrei Olegovich