AnInternet Protocol version 6 address (IPv6 address) is a numeric label that is used to identify and locate a network interface of a computer or anetwork node participating in acomputer network usingIPv6.IP addresses are included in thepacket header to indicate the source and the destination of each packet. The IP address of the destination is used to make decisions about routingIP packets to other networks.
IPv6 is the successor to the first addressing infrastructure of theInternet,Internet Protocol version 4 (IPv4). In contrast to IPv4, which defined an IP address as a 32-bit value, IPv6 addresses have a size of 128 bits. Therefore, in comparison, IPv6 has a vastly enlargedaddress space.
IPv6 addresses are classified by the primary addressing and routing methodologies common in networking: unicast addressing, anycast addressing, and multicast addressing.[1]
Aunicast address identifies a single network interface. The Internet Protocol delivers packets sent to a unicast address to that specific interface.
Ananycast address is assigned to a group of interfaces, usually belonging to different nodes. A packet sent to an anycast address is delivered to just one of the member interfaces, typically the nearest host, according to the routing protocol's definition of distance. Anycast addresses cannot be identified easily, they have the same format as unicast addresses, and differ only by their presence in the network at multiple points. Almost any unicast address can be employed as an anycast address.
Amulticast address is also used by multiple hosts that acquire the multicast address destination by participating in the multicast distribution protocol among the network routers. A packet that is sent to amulticast address is delivered to all interfaces that have joined the corresponding multicast group. IPv6 does not implementbroadcast addressing. Broadcast's traditional role is subsumed by multicast addressing to theall-nodes link-local multicast groupff02::1. However, the use of the all-nodes group is not recommended, and most IPv6 protocols use protocol-specific link-local multicast groups to avoid disturbing every interface on a given network.
An IPv6 address consists of 128 bits.[1] For each of the major addressing and routing methodologies, various address formats are recognized by dividing the 128 address bits into bit groups and using established rules for associating the values of these bit groups with special addressing features.
Unicast andanycast addresses are typically composed of two logical parts: a 64-bit network prefix used forrouting, and a 64-bit interface identifier used to identify a host's network interface.
bits | 48 (or more) | 16 (or fewer) | 64 |
---|---|---|---|
field | routing prefix | subnet ID | interface identifier |
Thenetwork prefix (therouting prefix combined with thesubnet ID) is contained in the most significant 64 bits of the address. The size of the routing prefix may vary; a larger prefix size means a smaller subnet ID size. The bits of thesubnet ID field are available to the network administrator to define subnets within the given network. The 64-bitinterface identifier is automatically established randomly, obtained from aDHCPv6 server, or assigned manually. (Historically, it was automatically generated from the interface'sMAC address using themodified EUI-64 format, but this method is now not recommended for privacy reasons.[2])
Unique local addresses are addresses analogous to IPv4private network addresses.
bits | 7 | 1 | 40 | 16 | 64 |
---|---|---|---|---|---|
field | prefix | L | random | subnet ID | interface identifier |
Theprefix field contains the binary value 1111110. TheL bit is one for locally assigned addresses; the address range withL set to zero is currently not defined. Therandom field is chosen randomly once, at the inception of the/48 routing prefix.
A link-local address is also based on the interface identifier, but uses a different format for the network prefix.
bits | 10 | 54 | 64 |
---|---|---|---|
field | prefix | zeroes | interface identifier |
Theprefix field contains the binary value 1111111010. The 54 zeroes that follow make the total network prefix the same for all link-local addresses (fe80::/64link-local address prefix), rendering them non-routable.
Multicast addresses are formed according to several specific formatting rules, depending on the application.
bits | 8 | 4 | 4 | 112 |
---|---|---|---|---|
field | prefix | flg | sc | group ID |
For all multicast addresses, theprefix field holds the binary value 11111111.
Currently, three of the four flag bits in theflg field are defined;[1] the most-significant flag bit is reserved for future use.
bit | flag | Meaning when 0 | Meaning when 1 |
---|---|---|---|
8 | reserved | reserved | reserved |
9 | R (Rendezvous)[4] | Rendezvous point not embedded | Rendezvous point embedded |
10 | P (Prefix)[5] | Without prefix information | Address based on network prefix |
11 | T (Transient)[1] | Well-known multicast address | Dynamically assigned multicast address |
Thefour-bit scope field (sc) is used to indicate where the address is valid and unique.
In addition, the scope field is used to identify special multicast addresses, likesolicited node.
bits | 8 | 4 | 4 | 79 | 9 | 24 |
---|---|---|---|---|---|---|
field | prefix | flg | sc | zeroes | ones | unicast address |
Thesc(ope) field holds the binary value 0010 (link-local). Solicited-node multicast addresses are computed as a function of a node's unicast or anycast addresses. A solicited-node multicast address is created by copying the last 24 bits of a unicast or anycast address to the last 24 bits of the multicast address.
bits | 8 | 4 | 4 | 4 | 4 | 8 | 64 | 32 |
---|---|---|---|---|---|---|---|---|
field | prefix | flg | sc | res | riid | plen | network prefix | group ID |
Link-scoped multicast addresses use a comparable format.[6]
An IPv6 address is represented as eight groups of fourhexadecimal digits, each group representing 16bits[a] The groups are separated bycolons (:). An example of an IPv6 address is:
The standards provide flexibility in the representation of IPv6 addresses. The full representation of eight four-digit groups may be simplified by several techniques, eliminating parts of the representation. In general, representations are shortened as much as possible. However, this practice complicates several common operations, namely searching for a specific address or an address pattern in text documents or streams, and comparing addresses to determine equivalence. For mitigation of these complications, theInternet Engineering Task Force (IETF) has defined a canonical format for rendering IPv6 addresses in text:[9]
These methods can lead to very short representations for IPv6 addresses. For example, thelocalhost (loopback) address,0:0:0:0:0:0:0:1, and the IPv6 unspecified address,0:0:0:0:0:0:0:0, are reduced to::1 and::, respectively.
During the transition of the Internet from IPv4 to IPv6, it is typical to operate in a mixed addressing environment. For such use cases, a special notation has been introduced, which expresses IPv4-mapped and IPv4-compatible IPv6 addresses by writing the least-significant 32 bits of an address in the familiar IPv4dot-decimal notation, whereas the 96 most-significant bits are written in IPv6 format. For example, the IPv4-mapped IPv6 address::ffff:c000:0280 is written as::ffff:192.0.2.128, thus expressing clearly the original IPv4 address that was mapped to IPv6.
An IPv6 network uses an address block that is a contiguous group of IPv6 addresses of a size that is apower of two. The leading set of bits of the addresses are identical for all hosts in a given network, and are called the network's address or routingprefix.
Network address ranges are written inCIDR notation. A network is denoted by the first address in the block (ending in all zeroes), aslash (/), and adecimal value equal to the size in bits of the prefix. For example, the network written as2001:db8:1234::/48 starts at address2001:db8:1234:0000:0000:0000:0000:0000 and ends at2001:db8:1234:ffff:ffff:ffff:ffff:ffff.
The routing prefix of an interface address may be directly indicated with the address using CIDR notation. For example, the configuration of an interface with address2001:db8:a::123 connected to subnet2001:db8:a::/64 is written as2001:db8:a::123/64.
The size of a block of addresses is specified by writing a slash (/) followed by a number in decimal whose value is the length of the network prefix in bits. For example, an address block with 48 bits in the prefix is indicated by/48. Such a block contains 2128 − 48 = 280 addresses. The smaller the length of the network prefix, the larger the block: a/21 block is 8 times larger than a/24 block.
Colon (:) characters in IPv6 addresses may conflict with the established syntax of resource identifiers, such asURIs andURLs. The colon is conventionally used to terminate the host path before aport number.[10] To alleviate this conflict, literal IPv6 addresses are enclosed insquare brackets in such resource identifiers, for example:
When the URL also contains a port number the notation is:
where the trailing 443 is the example's port number.
For addresses with other than global scope (as described in§ Address scopes), and in particular for link-local addresses, the choice of the network interface for sending a packet may depend on which zone the address belongs to. The same address may be valid in different zones, and in use by a different host in each of those zones. Even if a single address is not in use in different zones, the address prefixes for addresses in those zones may still be identical, which makes the operating system unable to select an outgoing interface based on the information in therouting table (which is prefix-based).
In order to resolve the ambiguity in textual addresses, azone index must be appended to the address. The zone index is separated from the address by apercent sign (%).[11] Although numeric zone indices must be universally supported, the zone index may also be an implementation-dependent string. The link-local address
could be expressed by
or
The former (using aninterface name) is customary on mostUnix-like operating systems (e.g.,BSD,Linux,macOS).[12]The latter (using an interface number) is the only syntax onMicrosoft Windows, but as support for this syntax is mandatory per standard, it is also available on other operating systems.[c]
BSD-based operating systems (including macOS) also support an alternative, non-standard syntax, where a numeric zone index is encoded in the second 16-bit word of the address. E.g.:
In all operating systems mentioned above, the zone index for link-local addresses actually refers to an interface, not to a zone. As multiple interfaces may belong to the same zone (e.g. when connected to the same network), in practice two addresses with different zone identifiers may actually be equivalent, and refer to the same host on the same link.[d]
When used inuniform resource identifiers (URI), the use of the percent sign causes a syntax conflict, therefore it must be escaped viapercent-encoding,[13] e.g.:
InMicrosoft Windows operating systems, IPv4 addresses are valid location identifiers inUniform Naming Convention (UNC) path names. However, the colon is an illegal character in a UNC path name. Thus, the use of IPv6 addresses is also illegal in UNC names. For this reason,Microsoft implemented a transcription algorithm to represent an IPv6 address in the form of a domain name that can be used in UNC paths. For this purpose, Microsoft registered and reserved thesecond-level domainipv6-literal.net on theInternet (although they gave up the domain in January 2014[14]). IPv6 addresses are transcribed as a hostname or subdomain name within thisnamespace, in the following fashion:
is written as
This notation is automatically resolved locally by Microsoft software, without any queries to DNS name servers.
If the IPv6 address contains a zone index, it is appended to the address portion after an 's' character:
is written as
Every IPv6 address, except the unspecified address (::), has ascope,[11] which specifies in which part of the network it is valid.
Forunicast addresses, two scopes are defined: link-local and global.
Link-local addresses and theloopback address havelink-local scope, which means they can only be used on a single directly attached network. All other addresses (includingunique local addresses) haveglobal (oruniversal) scope, which means they are potentially globally routable and can be used to connect to addresses withglobal scope anywhere, or to addresses withlink-local scope on the directly attached network.
Unique local addresses have global scope, but they are not globally administered. As a result, only other hosts in the same administrative domain (e.g., an organization), or within a cooperating administrative domain are able to reach such addresses, if properly routed. As their scope is global, these addresses are valid as a source address when communicating with any other global-scope address, even though it may be impossible to route packets from the destination back to the source.
Anycast addresses are syntactically identical to and indistinguishable from unicast addresses. Their only difference is administrative. Scopes for anycast addresses are therefore the same as for unicast addresses.
Formulticast addresses, the four least-significant bits of the second address octet (ff0s::) identify the addressscope, i.e. the domain in which the multicast packet should be propagated. Predefined and reserved scopes are:
Value | Scope name | Notes |
---|---|---|
0x0 | reserved | |
0x1 | interface-local | Interface-local scope spans only a single interface on a node, and is useful only for loopback transmission of multicast. |
0x2 | link-local | Link-local scope spans the same topological region as the corresponding unicast scope. |
0x3 | realm-local | Realm-local scope is defined as larger than link-local, automatically determined by network topology and must not be larger than the following scopes.[15] |
0x4 | admin-local | Admin-local scope is the smallest scope that must be administratively configured, i.e., not automatically derived from physical connectivity or other, non-multicast-related configuration. |
0x5 | site-local | Site-local scope is intended to span a single site belonging to an organisation. |
0x8 | organization-local | Organization-local scope is intended to span all sites belonging to a single organization. |
0xe | global | Global scope spans all reachable nodes on the Internet – it is unbounded. |
0xf | reserved |
All other scopes are unassigned and available to administrators for defining additional regions.
The management of IPv6 address allocation process is delegated to theInternet Assigned Numbers Authority (IANA)[16] by theInternet Architecture Board and theInternet Engineering Steering Group. Its main function is the assignment of large address blocks to theregional Internet registries (RIRs), which have the delegated task of allocation tonetwork service providers and other local registries. The IANA has maintained the official list of allocations of the IPv6 address space since December 1995.[17]
In order to allow efficientroute aggregation, thereby reducing the size of the Internet routing tables, only one-eighth of the total address space (2000::/3) is currently allocated for use on theInternet. The rest of the IPv6 address space is reserved for future use or for special purposes. The address space is assigned to the RIRs in blocks of/23 up to/12.[18]
The RIRs assign smaller blocks tolocal Internet registries that distribute them to users. These are typically in sizes from/19 to/32.[19][20][21] Global unicast assignment records can be found at the various RIRs or other websites.[22]
The addresses are then typically distributed in/48 to/56 sized blocks to the end users.[23] IPv6 addresses are assigned to organizations in much larger blocks as compared to IPv4 address assignments—the recommended allocation is a/48 block which contains 280 addresses, being 248 or about2.8×1014 times larger than the entire IPv4 address space of 232 addresses and about7.2×1016 times larger than the/8 blocks of IPv4 addresses, which are the largest allocations of IPv4 addresses. The total pool, however, is sufficient for the foreseeable future, because there are 2128 (exactly 340,282,366,920,938,463,463,374,607,431,768,211,456; or about3.4×1038, or 340undecillion) unique IPv6 addresses.
Each RIR can divide each of its multiple/23 blocks into 512/32 blocks, typically one for each ISP; an ISP can divide its/32 block into65536/48 blocks, typically one for each customer;[24] customers can create65536/64 networks from their assigned/48 block, each having 264 (exactly 18,446,744,073,709,551,616; or about1.8×1019) addresses. In contrast, the entire IPv4 address space has only 232 (exactly 4,294,967,296; or about4.3×109) addresses.
By design, only a small fraction of the address space will be used actively. The large address space ensures that addresses are almost always available, which makes the use ofnetwork address translation (NAT) for the purposes of address conservation unnecessary. NAT has been increasingly used for IPv4 networks to help alleviateIPv4 address exhaustion.
Provider-independent address space is assigned directly to the end user by the RIRs from the special range2001:678::/29 and allows customers to make provider changes without renumbering their networks.
Internet exchange points (IXPs) are assigned special addresses from the ranges2001:7f8::/32,2001:504::/30, and2001:7fa::/32[25] for communication with their connectedISPs.
Root name servers have been assigned addresses from the range2001:7f8::/29.[26]
The lowest address within each subnet prefix (the interface identifier set to all zeroes) is reserved as thesubnet-router anycast address.[1] Applications may use this address when talking to any one of the available routers, as packets sent to this address are delivered to just one router.
The 128 highest addresses within each/64 subnet prefix are reserved to be used as anycast addresses.[27] These addresses usually have the first 57 bits of the interface identifier set to 1, followed by the 7-bit anycast ID. Prefixes for the network can be of any length for routing purposes, but subnets are required to have a length of 64 bits. The address with value 0x7e in the 7 least-significant bits is defined as amobile IPv6 home agents anycast address. The address with value 0x7f (all bits 1) is reserved and may not be used. No more assignments from this range have been made, so all the remaining values, 0x00 through 0x7d, are reserved as well.
There are a number of addresses with special meaning in IPv6.[28] The IANA maintains a registry of these special-purpose addresses.[29] They represent less than 2% of the entire address space:
Address block (CIDR) | First address | Last address | Number of addresses | Usage | Purpose |
---|---|---|---|---|---|
::/128 | :: | :: | 1 | Software | Unspecified address |
::1/128 | ::1 | ::1 | 1 | Host | Loopback address—a virtual interface that loops all traffic back to itself, thelocal host |
::ffff:0:0/96 | ::ffff:0.0.0.0::ffff:0:0 | ::ffff:255.255.255.255::ffff:ffff:ffff | 232 | Software | IPv4-mapped addresses |
::ffff:0:0:0/96 | ::ffff:0:0.0.0.0::ffff:0:0:0 | ::ffff:0:255.255.255.255::ffff:0:ffff:ffff | 232 | Software | IPv4-translated addresses |
64:ff9b::/96 | 64:ff9b::0.0.0.064:ff9b::0:0 | 64:ff9b::255.255.255.25564:ff9b::ffff:ffff | 232 | The global Internet | IPv4/IPv6 translation[30] |
64:ff9b:1::/48 | 64:ff9b:1:: | 64:ff9b:1:ffff:ffff:ffff:ffff:ffff | 280, with 248 for each IPv4 | Private internets | IPv4/IPv6 translation[31] |
100::/64 | 100:: | 100::ffff:ffff:ffff:ffff | 264 | Routing | Discard prefix[32] |
2001::/32 | 2001:: | 2001:0:ffff:ffff:ffff:ffff:ffff:ffff | 296 | The global Internet | Teredo tunneling[33] |
2001:20::/28 | 2001:20:: | 2001:2f:ffff:ffff:ffff:ffff:ffff:ffff | 2100 | Software | ORCHIDv2[34] |
2001:db8::/32 | 2001:db8:: | 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff | 296 | Documentation | Addresses used in documentation and example source code[35] |
2002::/16 | 2002:: | 2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff | 2112 | The global Internet | The6to4 addressing scheme |
3fff::/20 | 3fff:: | 3fff:fff:ffff:ffff:ffff:ffff:ffff:ffff | 2108 | Documentation | Addresses used in documentation and example source code[36] |
5f00::/16 | 5f00:: | 5f00:ffff:ffff:ffff:ffff:ffff:ffff:ffff | 2112 | Routing | IPv6Segment Routing (SRv6)[37] |
fc00::/7 | fc00:: | fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff | 2121 | Private internets | Unique local address[38] |
fe80::/64 from fe80::/10 | fe80:: | fe80::ffff:ffff:ffff:ffff | 264 | Link | Link-local address |
ff00::/8 | ff00:: | ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff | 2120 | The global Internet | Multicast address |
Applications may listen on one or more specific interfaces for incoming connections, which are shown in listings of active internet connections by a specific IP address (and a port number, separated by a colon). When the unspecified address is shown it means that an application is listening for incoming connections on all available interfaces.
In routing table configuration, the unspecified address may be used to represent thedefault route address (corresponding to0.0.0.0/0 in IPv4) for destination addresses (unicast, multicast and others) not specified elsewhere in a routing table.
IANA has reserved a so-calledSub-TLA ID address block for special assignments[28][41] of2001::/23 (split into the range of 64 network prefixes2001:0000::/29 through2001:01f8::/29). Three assignments from this block are currently allocated:
See§ Deprecated and obsolete addresses
The multicast addressesff0x::, wherex is any hexadecimal value, are reserved[1] and managed by theInternet Assigned Numbers Authority (IANA).[44]
Address | Description | Available scopes |
---|---|---|
ff0x::1 | All nodes address, identify the group of all IPv6 nodes | Available in scope 1 (interface-local) and 2 (link-local):
|
ff0x::2 | All routers | Available in scope 1 (interface-local), 2 (link-local) and 5 (site-local):
|
ff02::5 | OSPFIGP | 2 (link-local) |
ff02::6 | OSPFIGP designated routers | 2 (link-local) |
ff02::9 | RIP routers | 2 (link-local) |
ff02::a | EIGRP routers | 2 (link-local) |
ff02::c | Web Services Dynamic Discovery | 2 (link-local) |
ff02::d | AllPIM routers | 2 (link-local) |
ff02::1a | AllRPL routers | 2 (link-local) |
ff0x::fb | mDNSv6 | Available in all scopes |
ff0x::101 | AllNTP servers | Available in all scopes |
ff02::1:1 | Link name | 2 (link-local) |
ff02::1:2 | AllDHCPv6 servers and relay agents[45] | 2 (link-local) |
ff02::1:3 | Link-local multicast name resolution | 2 (link-local) |
ff05::1:3 | A relay agent may use this address to reach allDHCPv6 servers in the site.[45] | 5 (site-local) |
ff02::1:ff00:0/104 | Solicited-node multicast address (see below) | 2 (link-local) |
ff02::2:ff00:0/104 | Node information queries | 2 (link-local) |
The least significant 24 bits of thesolicited-node multicast address group ID are filled with the least significant 24 bits of the interface's unicast or anycast address. These addresses allow link-layer address resolution viaNeighbor Discovery Protocol (NDP) on the link without disturbing all nodes on the local network. A host is required to join a solicited-node multicast group for each of its configured unicast or anycast addresses.
On system startup, a node automatically creates alink-local address on each IPv6-enabled interface, even if globally routable addresses are manually configured or obtained throughconfiguration protocols (see below). It does so independently and without any prior configuration bystateless address autoconfiguration (SLAAC),[46] using a component of theNeighbor Discovery Protocol. This address is selected with the prefixfe80::/64.
In IPv4, typicalconfiguration protocols include DHCP or PPP. AlthoughDHCPv6 exists, IPv6 hosts normally use theNeighbor Discovery Protocol to create a globally routable unicast address: the host sends router solicitation requests and an IPv6router responds with a prefix assignment.[47]
The lower 64 bits of these addresses are populated with a 64-bit interface identifier. This should be a pseudo-random number for privacy reasons. Also for privacy reasons, the interface identifier is different for each automatically configured address of that interface. This has the disadvantage that multiplemulticast groups need to be joined for neighbor discovery. For this, the solicited-node multicast address is used, formed from the network prefixff02::1:ff00:0/104 and the 24 least significant bits of the address.
A 64-bit interface identifier can be derived from the interface's 48-bitMAC address, althoughstable privacy addresses are now recommended as a default instead.[2] A MAC address00-0C-29-0C-47-D5 is turned into a 64-bitEUI-64 by insertingFF-FE in the middle:00-0C-29-FF-FE-0C-47-D5.[f]
The assignment of aunicast IPv6 address to an interface involves an internal test for the uniqueness of that address usingNeighbor Solicitation andNeighbor Advertisement (ICMPv6 type 135 and 136) messages. While in the process of establishing uniqueness an address has atentative state.
The node joins thesolicited-node multicast address for the tentative address and sends neighbor solicitations, with the tentative address as the target address and the unspecified address (::/128) as its source address. The node also joins the all-hosts multicast addressff02::1, so it can receiveNeighbor Advertisements.
If a node receives a neighbor solicitation with its own tentative address as the target address, then it knows its address is not unique. The same is true if the node receives a neighbor advertisement with the tentative address as the source of the advertisement. Only after having successfully established that an address is unique may it be assigned and used by an interface.
When ananycast address is assigned to an interface (e.g. a subnet-router anycast address), due to the inherent non-uniqueness of this type of address, duplicate address detection is not performed.
Each IPv6 address that is bound to an interface has a defined lifetime. Lifetimes are infinite, unless configured to a shorter period. There are two lifetimes that govern the state of an address: thepreferred lifetime and thevalid lifetime.[48] Lifetimes can be configured inrouters that provide the values used for autoconfiguration, or specified when manually configuring addresses on interfaces.
When an address is assigned to an interface it gets the statuspreferred, which it holds during its preferred-lifetime. After that lifetime expires the status becomesdeprecated and no new connections should be made using this address.[g] The address becomesinvalid after its valid-lifetime also expires; the address is removed from the interface and may be assigned somewhere else on theInternet.
The globally unique and static MAC addresses used by stateless address autoconfiguration to create interface identifiers offer an opportunity to trackuser equipment across time and IPv6 network prefix changes.[49] To reduce the prospect of a user identity being permanently tied to an IPv6 address portion, a node may create temporary addresses with interface identifiers based on time-varying random bit strings[50] and relatively short lifetimes (hours to days), after which they are replaced with new addresses.
Temporary addresses may be used as source addresses for originating connections, while external hosts use a public address by querying theDomain Name System (DNS).
Network interfaces configured for IPv6 use temporary addresses by default inOS X Lion and later Apple systems[citation needed] as well as inWindows Vista,Windows 2008 Server and later Microsoft systems.[51]
As a means to enhance security forNeighbor Discovery Protocolcryptographically generated addresses (CGAs) were introduced in 2005[52] as part of theSecure Neighbor Discovery (SEND) protocol.
Such an address is generated using twohash functions that take several inputs. The first uses a public key and a random modifier; the latter being incremented repeatedly until a specific amount of zero bits of the resulting hash is acquired.[h] The second hash function takes the network prefix and the previous hash value. The least significant 64 bits of the second hash result is appended to the 64-bit network prefix to form a 128-bit address.
The hash functions can also be used to verify if a specific IPv6 address satisfies the requirement of being a valid CGA. This way, communication can be set up between trusted addresses exclusively.
The use of themodified EUI-64 format has serious implications for security and privacy concerns,[53] because the underlying hardware address (most typically theMAC address) is exposed beyond the local network, permitting the tracking of user activities and correlation of user accounts to other information. It also permits vendor-specific attack strategies and reduces the size of the address space for searching for attack targets.
Stable privacy addresses were introduced to remedy these shortcomings. They are stable within a specific network but change when moving to another, to improve privacy. They are chosen deterministically, but randomly, in the entire address space of the network.
Generation of a stable privacy address is based on a hash function that uses several stable parameters. It is implementation specific, but it is recommended to include at least the network prefix, the name of the network interface, a duplicate address counter, and a secret key. The resulting hash value is used to construct the final address: Typically the 64 least significant bits are concatenated to the 64-bit network prefix, to yield a 128-bit address. If the network prefix is smaller than 64 bits, more bits of the hash are used. If the resulting address does not conflict with existing or reserved addresses, it is assigned to the interface. Conflicts are resolved by adjusting the duplicate address counter.[53]
IPv6-enabled network interfaces usually have more than one IPv6 address, for example, a link-local and a global address. They may also have temporary addresses that change after a certain lifetime has expired. IPv6 introduces the concepts of address scope and selection preference, yielding multiple choices for source and destination addresses in communication with another host.
The preference selection algorithm selects the most appropriate address to use in communications with a particular destination, including the use of IPv4-mapped addresses indual-stack implementations.[54] It uses a configurable preference table that associates each routing prefix with a precedence level. The default table has the following content:
Prefix | Precedence | Label | Usage |
---|---|---|---|
::1/128 | 50 | 0 | Localhost |
::/0 | 40 | 1 | Default unicast |
::ffff:0:0/96 | 35 | 4 | IPv4-mapped IPv6 address |
2002::/16 | 30 | 2 | 6to4 |
2001::/32 | 5 | 5 | Teredo tunneling |
fc00::/7 | 3 | 13 | Unique local address |
::/96 | 1 | 3 | IPv4-compatible addresses (deprecated) |
fec0::/10 | 1 | 11 | Site-local address (deprecated) |
3ffe::/16 | 1 | 12 | 6bone (returned) |
The default configuration places preference on IPv6 usage, and selects destination addresses within the smallest possible scope, so that link-local communication is preferred over globally routed paths when otherwise equally suitable. The prefix policy table is similar to a routing table, with the precedence value serving as the role of a link cost, where higher preference is expressed as a larger value. Source addresses are preferred to have the same label value as the destination address. Addresses are matched to prefixes based on the longest-matching most-significant bit sequence. Candidate source addresses are obtained from theoperating system and candidate destination addresses may be queried via DNS.
To minimize the time to establish a connection when multiple addresses are available for communication, theHappy Eyeballs algorithm was devised. It queries DNS for IPv6 and IPv4 addresses of the target host, sorts candidate addresses using the default address selection table, and tries to establish connections in parallel. The first established connection aborts current and future attempts to connect to other addresses.
In theDomain Name System,hostnames are mapped to IPv6 addresses byAAAA resource records, so-calledquad-A records.[55] Forreverse lookup the IETF reserved the domainip6.arpa, where the name space is hierarchically divided by the 1-digithexadecimal representation ofnibble units (4 bits) of the IPv6 address.
As in IPv4, each host is represented in the DNS by two DNS records: an address record and a reverse mapping pointer record. For example, a host computer namedderrick in zoneexample.com has theunique local addressfdda:5cc1:23:4::1f. Its quad-A address record is
derrick.example.com. IN AAAA fdda:5cc1:23:4::1f
and its IPv6 pointer record is
f.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.4.0.0.0.3.2.0.0.1.c.c.5.a.d.d.f.ip6.arpa. IN PTR derrick.example.com.
This pointer record may be defined in a number of zones, depending on the chain of delegation of authority in the zone d.f.ip6.arpa.
The DNS protocol is independent of itstransport layer protocol. Queries and replies may be transmitted over IPv6 or IPv4 transports regardless of the address family of the data requested.
NAME | Domain name |
TYPE | AAAA (28) |
CLASS | Internet (1) |
TTL | Time to live, in seconds |
RDLENGTH | Length of RDATA field |
RDATA | 128-bit IPv6 address innetwork byte order |
if_nametoindex()
API for converting a name to an interface number, it does not support the customary "name after %" extension.inet6(4)
– FreeBSD Kernel InterfacesManual "The KAME implementation supports an extended numeric IPv6 address notation for link-local addresses, like "fe80::1%de0" [...] draft-ietf-ipngwg-scopedaddr-format-02.txt"All customers get one/48 unless they can show that they need more than 65k subnets. [...] If you have lots of consumer customers you may want to assign/56s to private residence sites.