IPv6 in practice: the plan, automatic addresses and dual stack
Lesson 3 of 4
36️⃣ IPv6 in practice: the plan, automatic addresses and dual stack
The big pictureIPv4 addresses ran out years ago, and the internet lives on NAT. Today about half the users reaching Google come over IPv6, and large mobile networks run it first. A mid-level network engineer cannot stop at knowing what the address looks like; you must plan it, run it and protect it.
What the picture shows: The router announces the prefix, the device adds 64 bits of its own, checks nobody else uses the address, then talks. No server and no broadcast.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
An IPv4 address is like a flat number in a crowded building with no flats left, so neighbours share one postbox (NAT). IPv6 is a new city where every house gets a whole street. What is new is that the device writes its own address: the router says "this is the street name", the device adds its house number and asks the neighbours "does anyone live here?". During the years of transition every device holds both addresses and picks the faster.
The types that matter: global unicast from 2000::/3, link-local fe80::/10 on every interface and used by routers as the next hop, ULA fd00::/8 for the inside, and multicast ff00::/8, with no broadcast at all. NDP (RFC 4861) rides on ICMPv6: RS 133, RA 134, NS 135, NA 136. SLAAC (RFC 4862) builds the address from the RA prefix, followed by random temporary privacy addresses (RFC 8981), with DAD to catch duplicates. The M flag says "get your address from DHCPv6", the O flag says "get DNS and the rest from DHCPv6". Dual stack with Happy Eyeballs (RFC 8305) tries IPv6 first and falls back to IPv4 within about 250 ms if it lags. On IPv6-only networks you reach old sites through NAT64/DNS64.
Before You Start
📍Addresses
You know what an IPv6 address looks like and how to shorten it.
✂️Subnets
You know what a /n prefix means.
The Core Idea
1The address plan: by boundaries, not by counting
In IPv4 you counted "how many hosts?" to pick a mask. In IPv6 you do not count: every network is a /64 however many devices it holds, because SLAAC needs 64 bits for the device. A site usually gets a /48 (65,536 networks) or a /56 from the provider (256 networks). Make the digits mean something: one digit for the site and one for the kind of network, and split on hex digit boundaries (every 4 bits) so the eye can read them.
Notice how the fourth group tells you the site and kind of network at a glance.
import ipaddress
company = ipaddress.ip_network("2001:db8:4a00::/48") # documentation prefix
sites = list(company.subnets(new_prefix=52)) # 16 sites, one hex digit each
kinds = {1: "staff", 2: "voice", 3: "guests", 0xA: "servers"}
for site_no, site in enumerate(sites[1:3], start=1): # keep 0 for the head office core
print(f"site {site_no}: {site}")
nets = list(site.subnets(new_prefix=64))
for kind, name in kinds.items():
print(f" {name:<8} {nets[kind]}")
print("networks per site:", 2 ** (64 - 52))
print("addresses in one /64:", f"{2 ** 64:,}")2001:db8::/32 range is reserved for documentation and examples (RFC 3849). Use it in labs and write-ups, never on a real network.2NDP: neighbours meet without ARP
There is no broadcast in IPv6, so there is no ARP. Instead NDP rides on ICMPv6: a device sends an NS to a multicast address tied to the wanted address, and its owner answers with an NA carrying the MAC. Routers send an RA now and then (or on an RS) to announce the prefix and the gateway. That is why blocking all ICMPv6 breaks IPv6: no neighbours, no gateway, and no path MTU discovery (Packet Too Big).
| Message | Type | Sent by | Replaces in IPv4 |
|---|---|---|---|
| Router Solicitation (RS) | 133 | A device starting up | — |
| Router Advertisement (RA) | 134 | The router | Part of DHCP (the gateway) |
| Neighbour Solicitation (NS) | 135 | Any device | ARP request |
| Neighbour Advertisement (NA) | 136 | The address owner | ARP reply |
| Packet Too Big | 2 | A router on the path | ICMP fragmentation needed |
3Where does the address come from? SLAAC and DHCPv6
Two flags in the RA pick the method. M=0, O=0: SLAAC only, the device builds its own address (with DNS from the RDNSS option in the RA). M=0, O=1: SLAAC for the address and "stateless" DHCPv6 for DNS. M=1: stateful DHCPv6 hands out and records addresses, which some companies like for tracking. Careful: Android devices do not support stateful DHCPv6, so never rely on it alone.
This is how addresses used to be built from the MAC. Modern systems use random numbers instead so nobody can track you by your address.
import ipaddress
def eui64(prefix, mac):
parts = [int(b, 16) for b in mac.split(":")]
parts[0] ^= 0b00000010 # flip the universal/local bit
eui = parts[:3] + [0xFF, 0xFE] + parts[3:] # 48-bit MAC -> 64-bit interface ID
host = int.from_bytes(bytes(eui), "big")
return ipaddress.IPv6Address(int(ipaddress.IPv6Address(prefix)) | host)
print(eui64("2001:db8:4a00:1001::", "00:1a:2b:3c:4d:5e"))
print(eui64("fe80::", "00:1a:2b:3c:4d:5e"), "(link-local)")4Living with IPv4, and security
The most common transition plan is dual stack: every device holds both addresses and the browser picks with Happy Eyeballs. Modern mobile networks run IPv6 only and reach IPv4 sites through NAT64 with DNS64, which makes an IPv6 address from an IPv4 one. Security-wise: every device takes IPv6 automatically even if you never planned it, so if your firewall only inspects IPv4 you have opened a door you cannot see. Turn on RA Guard on device ports to stop fake router adverts.
Worked example
The task: a company got 2001:db8:4a00::/48 and has three branches, each with staff, voice and guests. Write the plan and how addresses are handed out on each network.
The answer: a /52 per branch, with the first digit of the fourth group naming the branch: branch 1 2001:db8:4a00:1000::/52, branch 2 2001:db8:4a00:2000::/52, branch 3 2001:db8:4a00:3000::/52. Inside branch 1: staff 2001:db8:4a00:1001::/64, voice 2001:db8:4a00:1002::/64, guests 2001:db8:4a00:1003::/64. Staff and guests: SLAAC with RDNSS (works on Android). Voice: stateless DHCPv6 for the phones' options. RA Guard on every port, and the same firewall rules written for both IPv4 and IPv6.
Myth vs Reality
| Myth | Reality |
|---|---|
| IPv6 is more secure by default because it is newer. | It has its own attacks such as fake RAs, and the biggest danger is it running on your network unwatched. |
| A network of 10 devices should get a /124 to save addresses. | Always a /64. Anything smaller breaks SLAAC, and addresses are not scarce. |
| NAT is needed in IPv6 for protection. | Protection comes from the firewall and a "block unsolicited inbound" rule, not from NAT. |
Where you meet it at work
📱Mobile operators
IPv6-only networks with NAT64 for millions of phones.
☁️The cloud
Cloud virtual networks support dual stack and save on costly public IPv4 addresses.
🏢Company network
A tidy /48 plan makes logs and firewall rules easier to read.
Test your understanding
What network size do you give any VLAN in IPv6?
SLAAC needs 64 bits for the device, so every network is a /64.
What replaces ARP in IPv6?
NDP on ICMPv6 asks with NS and answers with NA.
An RA has M=0 and O=1. How does the device get its address?
M=0 means the address comes from SLAAC; O=1 means the other options come from DHCPv6.
You blocked all ICMPv6 and some sites now hang. Why?
IPv6 routers do not fragment, so they rely on Packet Too Big to tell the sender.
Which technique lets a phone on an IPv6-only network open an IPv4-only site?
DNS64 makes an IPv6 address for the site and NAT64 translates it to IPv4.
Quick review cards
Check Your Understanding
Why do you not count hosts to size an IPv6 network?
Because every network is a fixed /64; you plan the number of networks and sites, not hosts.
Your firewall inspects only IPv4 and devices run both. What is the risk?
IPv6 traffic may pass uninspected, giving you a back door you cannot see.
What is the difference between fd00::/8 and 2000::/3?
The first is private internal addressing (ULA) that never reaches the internet; the second is globally routable public addressing.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
reference3
Done with this lesson?
Sign in to save your progress.