IPv6 essentials
Use this when: you read, shorten or configure an IPv6 address, or need to know which type it is and how it was assigned.
Text version
Everything on the sheet, as plain HTML: handy for screen readers, copy-paste and search.
Anatomy of an address
An IPv6 address is 128 bits written as 8 groups of hex. Example: 2001:db8:acad:1::10/64, which expands to 2001:0db8:acad:0001:0000:0000:0000:0010.
| Part | Size | In the example | Set by |
|---|---|---|---|
| Global routing prefix | 48 bits | 2001:0db8:acad | Your ISP or RIR |
| Subnet ID | 16 bits | 0001 | You (65,536 LANs) |
| Interface ID | 64 bits | 0000:0000:0000:0010 | Host: SLAAC, EUI-64 or manual |
Shorten it (RFC 5952): drop leading zeros in each group, then replace the longest run of all-zero groups with ::. Use :: once only, never for a single zero group, and write hex in lowercase. The example becomes 2001:db8:acad:1::10.
Address types
IPv6 has no broadcast. Multicast does that job.
| Prefix | Type | Notes |
|---|---|---|
2000::/3 | Global unicast | Routable on the internet |
fe80::/10 | Link-local | One link only; every interface has one |
fc00::/7 | Unique local | Private; in practice fd00::/8 |
ff00::/8 | Multicast | One to many; replaces broadcast |
::1/128 | Loopback | This host (::/128 means no address yet) |
2001:db8::/32 | Documentation | Use in examples, never on a live network |
Useful multicast groups: ff02::1 all nodes, ff02::2 all routers, and ff02::1:ffXX:XXXX solicited-node.
Neighbor Discovery (replaces ARP)
| ICMPv6 type | Message | Purpose |
|---|---|---|
| 133 | Router Solicitation (RS) | Host asks for routers |
| 134 | Router Advertisement (RA) | Router announces prefix and gateway |
| 135 | Neighbor Solicitation (NS) | "Who has this address?" |
| 136 | Neighbor Advertisement (NA) | "I do, here is my MAC" |
| 137 | Redirect | Router names a better first hop |
NS and NA do the job of ARP and also find duplicate addresses. Every ND message uses hop limit 255, so messages from off-link senders are ignored.
How a host gets its address
| Method | How it works |
|---|---|
| SLAAC | The host builds its interface ID from the RA prefix. Needs a /64. |
| DHCPv6 | Stateless adds DNS and options; stateful assigns the address. |
| EUI-64 | Flip bit 7 of the MAC and insert fffe in the middle. |
Example: MAC 00:00:5e:00:53:01 becomes interface ID 0200:5eff:fe00:5301, so the link-local address is fe80::200:5eff:fe00:5301.
IPv4 vs IPv6
| IPv4 | IPv6 | |
|---|---|---|
| Address | 32 bits, dotted decimal | 128 bits, hex |
| Header | 20 bytes or more, with checksum | 40 bytes fixed, no checksum |
| Fragmenting | Routers can | Source only (minimum link MTU 1280) |
| NAT | Common | Not needed; use a firewall |
Configure and check
| Command | What it does |
|---|---|
ipv6 unicast-routing | Turn on IPv6 routing on the router |
ipv6 address 2001:db8:acad:1::1/64 | Static address |
ipv6 address 2001:db8:acad:1::/64 eui-64 | Prefix plus EUI-64 interface ID |
ipv6 route ::/0 2001:db8:acad:1::2 | Default route |
show ipv6 interface brief | Addresses and up/up status |
show ipv6 route, show ipv6 neighbors | Routing table, ND cache |
ping -6, ipconfig, ip -6 addr | Windows, Windows, Linux |
Secure it
Danger. A rogue Router Advertisement can hijack every host on the LAN. Enable RA Guard on access ports.
Caution. Never block all ICMPv6. Types 133 to 136 and Packet Too Big must pass, or addressing and paths break.
Caution. IPv6 is on by default. Firewall rules must cover it too.
Remember
- /64 per LAN, /48 or /56 per site
fe80::is on every interface::only once per address
Sources
- RFC 4291, IPv6 addressing architecture
- RFC 5952, IPv6 address text representation
- RFC 4861, Neighbor Discovery for IPv6
- RFC 4193, unique local IPv6 unicast addresses
- RFC 3849, IPv6 documentation prefix
- RFC 8200, IPv6 specification
- RFC 4890, filtering ICMPv6 messages
- RFC 6105, IPv6 Router Advertisement Guard
- Cisco IOS XE, IPv6 basic connectivity