IPv6 fundamentals: addressing, SLAAC and Neighbor Discovery

IPv6 uses 128-bit addresses, scoped address types and ICMPv6 Neighbor Discovery. Plan addressing, router advertisements, DNS, filtering and monitoring explicitly; working IPv4 does not prove that IPv6 is healthy.

Read the address and its scope

IPv4 has 32-bit decimal addresses; IPv6 has 128 bits written as eight hexadecimal groups. IPv6 uses multicast rather than broadcast, and routers do not fragment IPv6 packets. Interfaces commonly hold several IPv6 addresses at once.

Leading zeroes inside a group may be removed. One consecutive sequence of all-zero groups may be replaced by ::, only once per address. For consistent documentation, use lowercase and compress the longest zero sequence. For example, 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8:0:0:0:0:0:1 and then 2001:db8::1.

Global unicast, illustrated by 2000::/3: globally routed communication.
Link-local fe80::/10: interface-local addressing that stays on the link.
Unique local fc00::/7: privately routed addressing.
Multicast ff00::/8: one-to-many communication.
Loopback ::1/128: the local host. The unspecified address is ::.

SLAAC and an EUI-64 example

Router Advertisements announce a prefix and flags. Stateless Address Autoconfiguration lets a host form an address from the advertised prefix and its interface identifier. Modified EUI-64 is illustrated here as one way to construct that identifier; this example should not be read as requiring every address to expose a MAC-derived identifier.

Starting from MAC 00:11:22:33:44:55, insert FF:FE between its halves and flip the universal/local bit in the first octet: 02:11:22:FF:FE:33:44:55. The resulting interface identifier is 0211:22ff:fe33:4455. Combined with prefix 2001:db8:1:1, the example address is 2001:db8:1:1:0211:22ff:fe33:4455.

Neighbor Discovery performs several jobs

ICMPv6 Neighbor Discovery finds neighbours and routers, checks reachability and supports Duplicate Address Detection. SLAAC uses Router Advertisements; DHCPv6 can provide extra information or stateful addresses. The default gateway is learned through Router Advertisements rather than a conventional DHCPv6 gateway option.

Blocking all ICMPv6 breaks essential functions. Permit required message types deliberately and control unwanted traffic. Address scope matters as much as the prefix when diagnosing routing and local communication.

Operate IPv6 deliberately

Many systems enable IPv6 by default. Monitoring IPv4 alone can miss uncontrolled paths and configuration errors. Address plans, AAAA records, routing, firewalls, VPNs, monitoring and logs must cover both. NAT is not a necessary security building block; stateful firewall rules control incoming connections.

Dual stack supports gradual adoption but temporarily increases the diagnostic surface. Test IPv4 and IPv6 explicitly and separately so a working path does not hide a broken one.

Practical checklist

01
Identify address type, prefix length and interface correctly.
02
Observe Router Advertisements, the link-local gateway and DAD.
03
Test AAAA resolution and IPv6 routing independently of IPv4.
04
Configure IPv6 firewalling and monitoring explicitly.
05
Separate dual-stack faults using protocol-specific tests and logs.

Frequently asked questions

Does IPv6 make NAT unnecessary?

It removes the address-scarcity reason for NAT because devices can have globally unique addresses. Filtering, segmentation and address planning remain necessary.

Why does one interface have several IPv6 addresses?

Link-local, global or ULA addresses, temporary privacy addresses and several prefixes may be valid simultaneously. This is normal, with address-selection rules determining their use.

IPv6 fundamentals: addressing, SLAAC and Neighbor Discovery

Knowledge you can put to work.