IPv6

Address format and compression

128 bits written as eight groups of four hex digits separated by colons. Two compression rules, and they are the whole trick.

1. Drop leading zeros in any group: 0db8 → db8, 0000 → 0. 2. Replace one run of all-zero groups with ::. Only one per address, or the length would be ambiguous.

full        2001:0db8:0000:0000:0008:0800:200c:417a
leading 0s  2001:db8:0:0:8:800:200c:417a
compressed  2001:db8::8:800:200c:417a

loopback    0000:...:0001  →  ::1
unspecified 0000:...:0000  →  ::

Prefix notation is the same idea as CIDR: 2001:db8:acad:1::/64. The /64 is the standard subnet size for any link, because SLAAC and many features assume 64 interface bits. Sites usually get /48 or /56 from an ISP, which is 65,536 or 256 subnets.

2001:0db8:acad:0001 : 0000:0000:0000:0010
\__________________/ \___________________/
   /64 network         interface identifier
   48 global + 16 subnet

Address types and scopes

There is no broadcast in IPv6. Link-local addresses need a zone index when used, for example ping fe80::1%eth0, and in URLs an IPv6 literal is bracketed: http://[2001:db8::1]:8080/.

Header and what changed from IPv4

+---------+---------------+-----------------------+
| Version | Traffic Class |      Flow Label       |
+---------+---------------+-------+---------------+
|  Payload Length | Next Header   |   Hop Limit   |
+-----------------------------------------------+
|              Source Address (128 bits)        |
+-----------------------------------------------+
|            Destination Address (128 bits)     |
+-----------------------------------------------+

SLAAC, DHCPv6, and NDP

Neighbor Discovery (ICMPv6) does what ARP, ICMP redirect, and router discovery did in IPv4.

SLAAC flow: the host makes a link-local address, runs duplicate address detection, sends an RS, receives an RA carrying a /64 prefix, then builds its own global address by appending an interface identifier. No server holds state.

The interface identifier can be EUI-64 (derived from the MAC, flipping the universal bit and inserting fffe, which leaks the hardware address) or a privacy / stable random address per RFC 8981 and RFC 7217, which is what modern systems default to.

RA flags decide who assigns what:

DHCPv6 (UDP 546 client, 547 server) uses SOLICIT, ADVERTISE, REQUEST, REPLY and, notably, never supplies a default gateway. The router always comes from an RA, so blocking RAs breaks IPv6 even with DHCPv6 running. RDNSS in the RA (RFC 8106) can carry DNS servers without DHCPv6 at all.

Commands

ip -6 addr show                      # note the scope: global, link
ip -6 route
ip -6 neigh                          # the NDP cache, ARP's replacement
ping -6 2606:4700:4700::1111
ping fe80::1%eth0                    # link-local needs the zone
ping6 -c3 ff02::1%eth0               # who is on this link
traceroute6 example.com
ss -6 -lntp
dig AAAA example.com +short
curl -6 -sS https://example.com -o /dev/null -w '%{remote_ip}\n'
curl -g 'http://[2001:db8::1]:8080/'  # -g stops glob parsing of brackets
sysctl net.ipv6.conf.all.disable_ipv6
sysctl net.ipv6.conf.eth0.accept_ra
radvdump                              # watch RAs on the wire
tcpdump -ni eth0 icmp6

Dual stack and the gotchas

Transition mechanisms in current use are dual stack (run both, the default answer), NAT64 plus DNS64 (v6-only clients reaching v4 servers), and 464XLAT on mobile networks. 6to4 and Teredo are deprecated relics.