IPv6, without the fear

An IPv4 address is 32 bits, so there are 2³² of them: 4,294,967,296. That sounded like plenty in 1981. It isn't enough for eight billion people with a phone, a laptop and a smart TV each. The central pool of unassigned IPv4 addresses ran dry in February 2011, and the regional registries that hand them out have run out since. Today IPv4 addresses are bought and sold second-hand.

The Internet has survived mostly through NAT, the trick from the Introduction where a whole house shares one public address. NAT works, but it's a patch. It breaks anything that needs to be reached from outside, and some providers now put hundreds of customers behind one address.

IPv6 fixes the shortage by making the address 128 bits long. That gives 2¹²⁸ addresses, about 340 followed by 36 zeros (3.4 × 10³⁸). It's enough to give every grain of sand on Earth billions of billions of addresses, and it means address shortages simply stop being a design constraint.

Do you have IPv6?

ping -6 2606:4700:4700::1111

That's the IPv6 address of the same Cloudflare server you pinged as 1.1.1.1 in the Introduction. Replies mean your provider, your router and your laptop all speak IPv6. If you get Destination net unreachable or No route to host, you're IPv4-only at the moment. That's still common, and everything on this page still applies; the practice problems work on paper either way.

Writing 128 bits as dotted decimals would take sixteen numbers, so IPv6 uses hexadecimal instead: counting in sixteens. Hex has sixteen digits: 0–9 as usual, then a=10, b=11, c=12, d=13, e=14, f=15. One hex digit is exactly 4 bits, which is why it's used: four digits make one 16-bit group, and eight groups separated by colons make the whole address.

The split is almost always exactly down the middle. The first 64 bits are the network, the street. On a home connection that's usually a block your provider gave you, plus a subnet number. The last 64 bits are the interface ID, the house, and the device chooses it itself (Step 05 shows how).

Nobody writes all 32 digits. Two rules shorten almost every address, and every tool uses them:

1. Drop leading zeros in each group. 0db8 becomes db8, 0042 becomes 42, and 0000 becomes 0. Only leading zeros: ff00 stays ff00.
2. Replace one run of all-zero groups with ::, and only once per address. If there are two runs, shorten the longer one; if they're the same length, the first.

To expand an address, work backwards: count the groups you can see, and the :: hides however many all-zero groups it takes to make eight. 2001:db8::1 shows three groups, so :: is five groups of zeros: 2001:0db8:0000:0000:0000:0000:0000:0001. That's also why :: can only appear once. In 2001::1::1 there'd be no way to know how many zeros each one hides.

Two you'll see constantly: ::1 is seven groups of zeros and a 1, which is IPv6's loopback address (“this computer”, like 127.0.0.1). :: on its own is all zeros, meaning “no address” or “any address”.

In IPv4, the subnetting guide spent an hour on masks, block sizes and the −2. IPv6 makes most of that go away, because of one rule: every LAN is a /64. Your home network, an office floor and a guest Wi-Fi are each a /64, whether they hold two devices or two thousand.

A /64 leaves 64 bits for devices: 2⁶⁴, about 18 billion billion addresses on one street. Nobody will ever fill it, and that's deliberate. It leaves room for devices to make up their own addresses at random without colliding. There's no broadcast address in IPv6 either, so there's nothing to subtract.

Subnetting moves to the subnet ID, the fourth group. Providers give a home a /56 or a /48, and you count through the subnet ID in hex:

With the /48 2001:db8:abcd::/48, your networks are 2001:db8:abcd:1::/64, 2001:db8:abcd:2::/64, and so on. Want a subnet per VLAN? Use the VLAN number: VLAN 10 is 2001:db8:abcd:10::/64. There's no block-size arithmetic at all; you just pick the fourth group. (It's hex, so after 9 comes a: …:9::, …:a::, … …:f::, …:10::.)

In IPv4, your laptop had one address per connection. In IPv6 it normally has several at once, each for a different job. Look at yours:

ipconfig

Mac: ifconfig en0 | grep inet6. Linux: ip -6 addr. You'll see the same kinds of address. Here's what each one is, with its closest IPv4 equivalent:

Two details in that output are worth a second look. The default gateway is a link-local address: devices reach their router by its fe80:: address, which never changes even if your provider changes your prefix. And the %12 after each link-local address is the zone index, meaning which network adapter. Every adapter has its own fe80:: street, so the computer needs to know which one you mean.

In IPv4, a DHCP server keeps a list and hands out addresses. IPv6 usually skips it. The router just announces the street name, and each device makes up its own house number. This is SLAAC (stateless address autoconfiguration, pronounced “slack”):

Routers also repeat their Router Advertisement every few minutes, so devices that were already on the street keep hearing it. The advertisement can also say “ask a DHCPv6 server for extra settings”. Some networks use DHCPv6 for DNS server addresses or for full address assignment, but at home SLAAC does the work.

The Introduction's ARP shouted “who is 192.168.1.1?” to every device on the street, a broadcast. IPv6 has no broadcast at all. The same jobs are done by Neighbor Discovery (NDP), which uses multicast: messages addressed to a group, so only the devices that care have to listen. The router solicitation and the duplicate-address check in Step 06 were both NDP. So is finding a neighbour's MAC address:

netsh interface ipv6 show neighbors

Mac: ndp -a. Linux: ip -6 neigh. The first line is the router, found by its link-local address, with the same MAC as in the Introduction's ARP table: one box, two protocols. The ff02:: lines are multicast groups, which map to special 33-33-… hardware addresses so the network card itself can ignore groups it hasn't joined.

With IPv4, NAT did two things: it let a whole house share one address, and, as a side effect, it blocked strangers from starting connections to your devices, because they had no address to aim at. IPv6 doesn't need the first job, so it drops NAT entirely. Every device gets its own global address.

The second job, protection, is done properly by a firewall. Almost every home router with IPv6 support ships with a rule that allows replies to conversations your devices started and blocks new connections from outside. The result feels the same as NAT from the outside, with none of NAT's breakage: video calls, games and home servers work directly, and you open exactly the doors you choose.

IPv4 isn't going away soon, so almost every network runs both side by side. This is dual stack, and it's what your ipconfig showed: an IPv4 address and IPv6 addresses on the same adapter. DNS keeps two kinds of record, A for IPv4 and AAAA (“quad-A”) for IPv6. Look at both:

nslookup -type=AAAA one.one.one.one

When a name has both records, your browser tries IPv6 first and IPv4 a split second later, and uses whichever connects first (the nickname is Happy Eyeballs). You never notice which one won.

Now try it on this site: nslookup -type=AAAA bozcode.com. You'll get the name back with no IPv6 address, because bozcode.com doesn't publish an AAAA record yet, so every visit here uses IPv4. That's how you tell whether any website supports IPv6: look for its AAAA record. Plenty of large sites have one, and plenty of sites don't.

Work each on paper before you open the answer.

1. Shorten 2001:0db8:abcd:0012:0000:0000:0000:0001.

   Show the answer

   Drop leading zeros: 2001:db8:abcd:12:0:0:0:1. Replace the run of three zero groups: 2001:db8:abcd:12::1.

2. Shorten 2001:0db8:0000:0000:0001:0000:0000:0001. Watch out: there are two zero runs.

   Show the answer

   After dropping leading zeros: 2001:db8:0:0:1:0:0:1. Both zero runs are two groups long, so the rule is to shorten the first: 2001:db8::1:0:0:1. (2001:db8:0:0:1::1 means the same address, but the standard form shortens the first of equal runs.) You can't use :: for both.

3. Expand 2001:db8::1 to all 32 digits. How many groups is the :: hiding?

   Show the answer

   Three groups are visible, so :: stands for five zero groups: 2001:0db8:0000:0000:0000:0000:0000:0001.

4. Why is 2001:db8::abcd::1 not a valid address?

   Show the answer

   It uses :: twice. Six groups are missing in total, but there's no way to tell whether that's one and five, two and four, or any other split, so the address is ambiguous. One :: per address, always.

5. Are 2001:db8:abcd:12:3c1f:9a2e:7b40:d51c and 2001:db8:abcd:13::5 on the same street (the same /64)?

   Show the answer

   No. A /64 is the first four groups. The first is 2001:db8:abcd:12, the second is 2001:db8:abcd:13. Different subnet IDs mean different streets, so their traffic goes through a router. In IPv6 you can answer this just by comparing the first four groups, with no block-size arithmetic.

6. Your provider gives you 2001:db8:abcd::/48. How many /64 networks can you make, and what are the first two?

   Show the answer

   From /48 to /64 is 16 bits of subnet ID, so 2¹⁶ = 65,536 networks. The first two are 2001:db8:abcd::/64 (subnet ID 0) and 2001:db8:abcd:1::/64. A /56 would have given you 2⁸ = 256.

7. What kind of address is each? fe80::1, ::1, fd12:3456:789a:1::20, 2606:4700:4700::1111, ff02::1.

   Show the answer

   fe80::1: link-local, only valid on its own street. ::1: loopback, this computer. fd12:3456:789a:1::20: unique local, private and never routed on the Internet. 2606:4700:4700::1111: global, a real public address (Cloudflare's DNS). ff02::1: multicast, every device on this street.

Check yourself

• You know whether your own connection has IPv6 (Step 01's ping)
• You can shorten and expand any IPv6 address, and know why :: appears once
• You can point to the /64 network and the interface ID in an address
• You found your global, temporary and link-local addresses, and know what each is for
• You can explain how SLAAC works without a DHCP server
• You can explain why IPv6 has no NAT and what protects your devices instead

Where to go next