IPv6: Not Just Bigger Addresses

The headline is 128-bit addresses: 3.4 × 10^38 of them, enough to give every device on Earth a public address with a /64 subnet to spare — and that is the real point, not the count. With every host publicly addressable, NAT is no longer necessary: a phone can accept a connection from a laptop, two peers can talk without a relay, and "server" becomes something any device can be. Firewalls still decide what is *allowed*; they no longer have to fake reachability.

The rest of the redesign is easy to miss. The header is a fixed 40 bytes with no checksum and no options — options moved to chained extension headers — so routers parse it faster. Broadcast is gone; everything that used it is multicast, and multicast is mandatory. ARP is gone, replaced by Neighbor Discovery over ICMPv6 (see ARP and Neighbor Discovery: From an IP to a Local MAC). Routers never fragment. Hosts can configure their own addresses from a router advertisement without DHCP (SLAAC). Every interface has several addresses at once, by design. A flow label lets routers hash a flow without reading the transport header. "IPv4 with longer addresses" describes none of this.

An IPv6 address is eight groups of 16 bits in hexadecimal, separated by colons: 2001:0db8:0000:0000:0000:0000:0000:0001. Two rules shorten it. Leading zeros in a group may be dropped: 0db8 → db8, 0000 → 0. One run of consecutive all-zero groups may be replaced by `::` — only one, or the address would be ambiguous; if there are two runs, compress the longer (the leftmost if equal). The result is 2001:db8::1. Reverse it by counting groups: 2001:db8::1 has two on the left and one on the right, so :: stands for five zero groups.

Because colons are also used for ports, an address with a port is written in brackets: [2001:db8::1]:443, and that is what URLs use — https://[2001:db8::1]/. Prefixes use CIDR as in IPv4: 2001:db8::/32 is a documentation range (the IPv6 counterpart of 192.0.2.0/24), 2001:db8:1::/64 is one subnet. The lowercase hex form with :: compression is the canonical text representation (RFC 5952); comparing addresses as strings without canonicalising them is a classic bug.

IPv6 addresses carry their scope in their prefix, and a host holds several at once. Global unicast (currently 2000::/3, so anything starting with 2 or 3) is the public, routable kind — your 2001:… or 2a02:… address. Link-local (fe80::/10) is automatically configured on every interface, valid only on that segment, never routed; Neighbor Discovery and router advertisements use it, and a default route in IPv6 usually points at the router’s link-local address, not its global one. Unique local (fc00::/7, in practice fd00::/8 with a random 40-bit suffix) is the private range — routable inside an organisation, not on the internet — but unlike RFC 1918 it is meant to be globally unique by randomness, so merging two networks does not collide. Multicast (ff00::/8) carries a 4-bit scope: ff02::1 is all nodes on the link, ff02::2 all routers, ff02::1:ffxx:xxxx the solicited-node group. There is no broadcast.

Because the address is so large, the interface identifier — the low 64 bits — can be anything unique on the link. It was once derived from the MAC (EUI-64: split the MAC, insert ff:fe, flip a bit), which leaked hardware identity and let a laptop be tracked across networks; modern stacks generate a stable random identifier per network (RFC 7217) and additionally rotate temporary addresses (RFC 8981) for outgoing connections every day or so. A typical interface therefore shows a link-local, a stable global, and one or more temporary global addresses at the same time.

A host that comes up on an IPv6 link builds its link-local address from the prefix fe80:: and an interface identifier, verifies it is unused with duplicate address detection (a neighbor solicitation for itself), and then sends a router solicitation to ff02::2. A router answers with a router advertisement listing the on-link prefix (2001:db8:1::/64), the link MTU, its own lifetime as a default gateway, and flags saying whether to use SLAAC, DHCPv6 for addresses, or DHCPv6 only for extras such as DNS servers (RAs can also carry DNS servers directly, RFC 8106). With SLAAC the host appends its identifier to the prefix and has a global address within a second of link-up, with no server and no lease.

Address resolution — the ARP replacement — is a neighbor solicitation to the target’s solicited-node multicast group and a neighbor advertisement back, cached with reachability states in ip -6 neigh. The whole family is ICMPv6, which means a firewall that drops ICMPv6 does not merely break ping6: it prevents a host from finding its router, its neighbours, or its own address. Allow at least types 133–137 (RS, RA, NS, NA, Redirect) and 2 (Packet Too Big) on every IPv6 network.

IPv6 is not backward compatible on the wire — an IPv6 packet is EtherType 0x86DD and an IPv4-only router will not forward it — so the transition is dual-stack: hosts and networks run both protocols side by side, every service publishes both A and AAAA records, and each connection picks one. Around 45–50% of Google’s traffic arrives over IPv6 today; mobile carriers are often IPv6-only internally with NAT64/DNS64 translating to reach the IPv4 internet, and some clouds now charge for IPv4 while IPv6 is free.

Picking one is the browser’s job. A naive "try IPv6, and if it times out try IPv4" would stall for a full connect timeout (tens of seconds) whenever the IPv6 path is broken — and it often is, silently, on networks that advertise a prefix but do not route it. Happy Eyeballs (RFC 8305) races them: resolve both, start the IPv6 connection first, and if it has not completed within about 250 ms start the IPv4 one too; use whichever completes first and close the other. The result is that a broken IPv6 path costs a quarter of a second, not a failure — and that "this site is slow to start loading" on a misconfigured network is often exactly that quarter-second. curl -6 and curl -4 force a family when you need to test one path in isolation.

Servers see the consequence too: on a dual-stack service, a single client can appear from an IPv6 address and, moments later, an IPv4 one; rate limits, sessions and allowlists keyed on the client address must treat both. And an IPv6 client behind no NAT presents its real, stable-per-network address — a privacy and a logging difference from the IPv4 world where one address was a whole household.