VMware ESXi and vSphere Cluster Management

IPv6 Overview: Addressing, Headers, and Core Features

Learn what IPv6 is, why IPv4 address exhaustion led to its development, how IPv6 addressing and headers work, and how SLAAC, NDP, NAT, security, and dual stack fit together.

What Is IPv6?

IPv6 means Internet Protocol version 6. It is the successor to IPv4 at the network layer. Both protocols provide logical addressing and packet delivery between networks: hosts use addresses, and routers use those addresses to forward packets toward their destinations.

IPv6 was developed mainly because the supply of publicly usable IPv4 addresses is limited. IPv4 uses a 32-bit address space, and the rapid growth of the Internet, mobile devices, cloud services, and connected equipment made address exhaustion a major design problem. IPv6 also updates several aspects of addressing, host configuration, and packet processing.

IPv6 is not simply IPv4 with longer addresses. It changes address representation, neighbor and router discovery, packet-header processing, fragmentation behavior, and the role of address translation. In practice, IPv4 and IPv6 commonly coexist for many years rather than IPv6 replacing IPv4 everywhere at once. This simultaneous operation is called dual stack.

IPv4 Exhaustion and IPv6 Address Capacity

An IPv4 address contains 32 bits, so the theoretical address space contains 2^32, or about 4.3 billion, possible values. Not all of those values can be assigned as public host addresses: some are reserved, some identify private networks, and some serve special purposes.

An IPv6 address contains 128 bits. Its theoretical address space contains 2^128, or approximately 3.4 × 10^38, possible values. This enormous space supports globally unique addressing at a scale suitable for networks, services, sensors, and other devices.

IPv4: 32 bits → 2^32 ≈ 4.3 × 10^9 possible values

IPv6: 128 bits → 2^128 ≈ 3.4 × 10^38 possible values

Address-space size does not determine address scope. An IPv6 address may be globally routable, private to an organization, limited to one local link, or used for multicast. Therefore, it is incorrect to assume that every IPv6 address can be routed across the public Internet.

IPv6 Addressing and Notation

IPv6 addresses are written in hexadecimal, a base-16 numbering system using the digits 0–9 and letters a–f. Colons separate the address into eight groups. Each group contains 16 bits, normally written as four hexadecimal digits, for a total of 128 bits.

A full address can look like this:

2001:0db8:0000:0000:0000:0000:0000:0001

IPv6 notation has two common shortening rules:

  • Leading-zero suppression: Remove zeros at the beginning of an individual group. For example, 0db8 becomes db8, and 0001 becomes 1.
  • Zero compression: Replace one consecutive sequence of all-zero groups with ::. The double colon may be used only once in an address because it represents an unknown number of zero groups.

Using both rules, the full address above becomes:

2001:db8::1

The 2001:db8::/32 range is reserved for documentation examples, so it is useful in training material without representing a real production assignment.

Prefixes and Subnets

A prefix length states how many leading bits identify the network portion of an address. For example, /64 means that the first 64 bits are the subnet prefix and the remaining 64 bits identify an interface within that subnet.

A /64 subnet is common in IPv6 and is important for Stateless Address Autoconfiguration (SLAAC). A router can advertise the 64-bit prefix, while a host creates the interface portion. Prefix lengths are not automatically interchangeable with IPv4 subnet masks, although both describe the network portion of an address.

Common IPv6 Address Types

Address Type — Typical Prefix or Identifier — Scope — Primary Use

Global unicast — Commonly allocated from Internet-routable ranges — Global — Communication across routed networks and the Internet.

Unique local address (ULA) — fc00::/7, commonly using fd00::/8 in locally assigned ranges — Organization or site — Private internal communication; not ordinarily routed on the public Internet.

Link-local — fe80::/10 — One local link — Neighbor discovery, router discovery, and communication that remains on the local network segment.

Multicast — ff00::/8 — Defined by multicast scope — One-to-many delivery to interested receivers.

Anycast — An address assigned to multiple interfaces — Determined by routing — Delivery to one member of a group, usually the nearest according to the routing system.

IPv6 does not use broadcast addresses. Instead, multicast groups provide many functions that broadcast served in IPv4. For example, Neighbor Discovery uses ICMPv6 multicast messages to reach relevant nodes rather than sending a frame to every host on the link.

Link-Local and Global Use

A host may have both a link-local address and a global unicast address. The link-local address can be used to communicate with neighbors and routers on the same link. It cannot be used to reach a remote network. A global unicast address can be used when the destination is beyond the local link and the network has appropriate routing.

IPv6 Base Header

The IPv6 base header has a fixed size of 40 bytes. Its predictable size simplifies processing compared with the variable-length IPv4 header. Optional information is placed in separate extension headers rather than being added directly to the base header.

Version: Identifies the packet as IPv6. IPv6 uses the value 6.

Traffic Class: Supports traffic classification and quality-of-service handling.

Flow Label: Identifies packets belonging to a flow when devices need consistent handling for that flow.

Payload Length: States the length of the data after the IPv6 base header, including extension headers.

Next Header: Identifies the following extension header or the upper-layer protocol, such as TCP, UDP, or ICMPv6.

Hop Limit: Limits how many router hops the packet may traverse. Each router decreases it by one.

Source Address: Identifies the IPv6 sender.

Destination Address: Identifies the IPv6 destination.

The IPv6 Hop Limit performs the same packet-lifetime function as the IPv4 TTL. When a router forwards a packet, it decrements the Hop Limit. If the value reaches zero, the router discards the packet and normally reports the condition with ICMPv6.

The IPv6 base header has no header checksum. IPv4 routers decrement TTL and recalculate the IPv4 header checksum at every hop. IPv6 routers decrement Hop Limit without recalculating a base-header checksum, reducing per-packet processing work. Upper-layer protocols and other mechanisms still provide integrity checks where appropriate.

Extension Headers and Fragmentation

Extension headers carry optional information such as routing-related data, fragmentation information, or security information. They can be chained after the base header and before the upper-layer payload.

IPv6 routers do not fragment packets while forwarding them. The sending host uses Path MTU Discovery (PMTUD) to learn the largest packet size that can cross the path. If a host must fragment a packet, it can use the IPv6 Fragment extension header. A router that encounters a packet that is too large sends an ICMPv6 Packet Too Big message instead of fragmenting it.

SLAAC, Router Advertisements, and Neighbor Discovery

Stateless Address Autoconfiguration (SLAAC) lets an IPv6 host configure an address using information advertised by a router. The host does not necessarily need a DHCP server to obtain its address.

A router sends an Router Advertisement (RA), an ICMPv6 message that can provide:

  • An IPv6 subnet prefix, often a /64 prefix.
  • Default-router information.
  • Configuration flags indicating whether hosts should use SLAAC, DHCPv6, or both.
  • Additional parameters used by hosts on the link.

A typical SLAAC sequence is:

  1. The router advertises a prefix such as 2001:db8:10:20::/64.
  2. The host combines the prefix with an interface identifier or randomly generated interface value.
  3. The host performs Duplicate Address Detection (DAD) to check whether another node is already using the proposed address.
  4. If the address is not already in use, the host assigns it to the interface.
  5. The host installs the router as a default IPv6 gateway based on the Router Advertisement.

DHCPv6 is the Dynamic Host Configuration Protocol for IPv6. A network may use SLAAC alone, DHCPv6 alone for selected information, or both. SLAAC primarily describes how a host forms an address from an advertised prefix; DHCPv6 can supply addresses and additional configuration information according to the network design.

The Neighbor Discovery Protocol (NDP) is IPv6 control functionality carried in ICMPv6. It replaces or combines several IPv4 functions, including address resolution traditionally provided by ARP, router discovery, prefix discovery, and neighbor reachability checks. Neighbor Solicitation and Neighbor Advertisement messages use multicast-based discovery rather than IPv4 broadcast.

IPv6 and Security

IPsec is a suite of protocols that can authenticate and/or encrypt IP traffic. Support for IPsec was standardized as part of the IPv6 protocol suite. However, IPsec is not automatically enabled, negotiated, or used by every IPv6 connection.

IPv6 is not inherently secure simply because it has IPsec support. A secure deployment still requires correctly designed firewall policies, endpoint protection, authentication, monitoring, logging, vulnerability management, and appropriate filtering of IPv6 traffic. IPv6 security rules must be included explicitly; securing only IPv4 traffic can leave an unintended path open.

NAT and End-to-End Connectivity

Network Address Translation (NAT) changes address information as traffic crosses a device. IPv4 networks commonly use NAT partly because public IPv4 addresses are scarce. The large IPv6 address space reduces that address-conservation pressure.

NAT is not required for a normal IPv6 design. A site can receive a routed global prefix and assign globally routable addresses to internal interfaces. A firewall can then control inbound and outbound traffic. This approach can restore more direct end-to-end reachability, but a globally routable address does not mean that a service must be exposed.

NAT is also not a security control. Any protection attributed to common IPv4 NAT deployments generally comes from the stateful firewall behavior often combined with NAT, not from address translation itself.

Translation mechanisms can still be used when IPv6-only systems must communicate with IPv4-only systems, or during other transition scenarios. These mechanisms solve interoperability problems; they do not eliminate the need for routing, filtering, or application support.

IPv6 Routing and Deployment

IPv6 communication requires support throughout the path. Hosts, operating systems, routers, firewalls, and applications must understand and be configured for IPv6. Routers need IPv6 forwarding enabled and must know IPv6 prefixes through static routes or IPv6-capable routing protocols.

Dual stack is a common deployment approach. A dual-stack host and router operate IPv4 and IPv6 simultaneously, with separate addresses, forwarding information, and security policies for each protocol. Applications may select one protocol based on availability, configuration, and connection behavior.

If one side supports only IPv4 and the other only IPv6, direct communication is not automatic. A transition or translation mechanism may be required. During migration, organizations must test DNS, monitoring, firewall rules, routing, endpoint behavior, and application support for both protocols.

IPv4 and IPv6 at a Glance

Characteristic — IPv4 — IPv6 — Why It Matters

Address length — 32 bits — 128 bits — IPv6 provides a vastly larger address space.

Address-space size — 2^32, about 4.3 billion — 2^128, about 3.4 × 10^38 — IPv6 reduces the public-address scarcity that drove widespread IPv4 NAT use.

Address notation — Dotted decimal, such as 192.0.2.10 — Colon-separated hexadecimal, such as 2001:db8::10 — IPv6 addresses require different notation and shortening rules.

Broadcast support — Broadcast is supported — No broadcast; multicast is used instead — Discovery and group delivery use IPv6 multicast and ICMPv6.

Base-header size — Variable IPv4 header, commonly 20 bytes without options — Fixed 40-byte base header — A fixed base header simplifies router processing.

Header checksum — Routers recalculate the IPv4 header checksum after TTL changes — No checksum in the IPv6 base header — IPv6 avoids per-hop base-header checksum recalculation.

Router fragmentation — Routers may fragment packets — Routers do not fragment; the source uses PMTUD and the Fragment extension header when needed — Correct MTU handling and ICMPv6 are essential.

Automatic host configuration — Commonly uses manual configuration or DHCP — Can use SLAAC, DHCPv6, or both — Router Advertisements provide prefixes and default-router information.

NAT role — Widely used partly because public addresses are scarce — Not required for address conservation — Firewalls remain necessary even when NAT is absent.

Security and IPsec support — IPsec is available — IPsec support is standardized, but not automatically active — Security still depends on policy, configuration, and monitoring.

Troubleshooting IPv6 Connectivity

Link-Local Address but No Remote Connectivity

If a host has only a link-local address, it can communicate on its local link but cannot normally reach remote IPv6 networks. Check whether the host received a valid Router Advertisement, whether it has a default IPv6 route, and whether the router has IPv6 forwarding and upstream IPv6 routing configured.

Two Hosts on the Same LAN Cannot Communicate

Check the prefix length and address assignments first. Then verify that the firewall permits ICMPv6 and Neighbor Discovery traffic. Blocking essential ICMPv6 messages can prevent address resolution and neighbor reachability even when the addresses appear correct. Also check whether Duplicate Address Detection reported a conflict.

Large Packets Fail on Part of the Path

Because IPv6 routers do not fragment packets, a smaller-MTU link can cause failures if PMTUD does not work. Check whether ICMPv6 Packet Too Big messages are being filtered and whether the sender is learning the correct path MTU.

Assuming IPv6 Is Secure by Default

Enabling IPv6 does not automatically activate IPsec or create a complete security policy. Confirm that IPv6 firewall rules, logging, monitoring, endpoint controls, and incident-response procedures are in place. Treat IPv4 and IPv6 as separate protocol paths that both require security attention.

Key Exam Notes

  • IPv6 is a network-layer successor to IPv4 and provides logical addressing and packet delivery.
  • IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses.
  • IPv6 addresses contain eight 16-bit hexadecimal groups before compression.
  • Use :: to compress one consecutive run of zero groups, and use it only once per address.
  • IPv6 has global unicast, unique local, link-local, multicast, and anycast address categories.
  • IPv6 has no broadcast addresses; multicast performs many group-discovery functions.
  • The common IPv6 subnet prefix is /64, especially for SLAAC.
  • The IPv6 base header is fixed at 40 bytes and has no header checksum.
  • Hop Limit is the IPv6 equivalent of IPv4 TTL.
  • IPv6 routers do not fragment packets; the source uses PMTUD and may use the Fragment extension header.
  • NDP replaces several IPv4 functions, including ARP and router discovery.
  • SLAAC and DHCPv6 are different mechanisms and may be used separately or together.
  • IPsec support does not mean that every IPv6 connection is automatically encrypted.
  • NAT is not required for IPv6 address conservation and is not a substitute for a firewall.
  • Dual stack runs IPv4 and IPv6 simultaneously during coexistence and migration.

For the next step, study IPv6 address format and core addressing concepts before moving into detailed subnetting, SLAAC, DHCPv6, and IPv6 routing.