IPv6 in 55 minutes¶

Exercise ipv6-in-55-minutes-annex.pdf · PDF

Pick up your phone, switch off the Wi-Fi and look at its network details on mobile data. There is a good chance you will find an address that looks nothing like 192.168.1.35. Something like 2a0c:5a80:1f02:6b00::1d. Letters, colons, a double colon in the middle. What is that?

It is an IPv6 address, and your phone has probably used one every day for years. On Wednesday you saw that NAT exists because the world ran out of IPv4 addresses. NAT is a patch. Today you meet the real repair, and it has been ready since before you were born.

Why IPv4 ran out¶

An IPv4 address has 32 bits. That gives 2³² ≈ 4.3 billion addresses: fewer than there are people on Earth, and each person now carries a phone, a laptop, a console, a smartwatch...

The registries that hand out addresses ran dry, one after another:

IPv6 (Internet Protocol version 6) is the successor of IPv4. Its addresses have 128 bits: 2¹²⁸ ≈ 3.4 × 10³⁸ addresses.

How much bigger is that? Four times, because 128 = 4 × 32? No. Every extra bit doubles the number of addresses. 96 extra bits double it 96 times: IPv6 has 2⁹⁶ times more addresses than IPv4. That is enough to give a whole network to every grain of sand you can imagine.

And it is not the future. In 2026 about half of the people who use Google reach it over IPv6.

Writing an IPv6 address¶

128 bits in binary would be a wall of 128 zeros and ones. So IPv6 is written in hexadecimal (the hex you used for MAC addresses): 8 groups of 4 hex digits, separated by colons. Each group is 16 bits.

2001:0db8:0000:0000:0000:ff00:0042:8329

Still long. Two rules make it shorter:

2001:0db8:0000:0000:0000:ff00:0042:8329   8 groups of 4 hex digits
2001:db8:0:0:0:ff00:42:8329               rule 1: drop leading zeros
2001:db8::ff00:42:8329                    rule 2: ONE run of zero groups = ::

Rule 1 — drop the leading zeros. Zeros at the left of a group can go: 0042 → 42, 0db8 → db8, 0000 → 0. Zeros at the right stay: ff00 is not ff. ff00 and 00ff are different numbers.

Rule 2 — one ::. One run of consecutive all-zero groups can be replaced by ::. Only once per address: with two :: nobody could tell how many zeros each one hides. If there are two runs, shorten the longest; if they tie, the first one. Letters are written in lowercase (RFC 5952).

To expand an address, count the groups you can see. The :: stands for all the missing ones, up to 8.

Kinds of address: read the first digits¶

In IPv4 you learnt to spot 10.x.x.x or 127.0.0.1 at a glance. IPv6 has the same trick: the first digits tell you the kind.

Some examples:

• fe80::a8c1:abff:fe92:d27f — link-local.
• 2a04:4e42::644 — global (it is one of the addresses of debian.org).
• fd00:5::20 — unique local.
• ff02::1 — multicast, all nodes on the link.

SLAAC: the PC picks its own house number¶

With IPv4, a PC switches on and asks: "can somebody give me an address?" A DHCP server lends one and keeps a table of leases. IPv6 can work differently.

sequenceDiagram
    participant PC as PC
    participant R as Router
    Note over PC: 1. builds a link-local address<br>fe80::... by itself
    R->>PC: 2. Router Advertisement to ff02::1<br>"the street here is 2001:db8:10::/64,<br>and I am the way out"
    Note over PC: 3. prefix (64 bits) + its own 64 bits<br>= global address + default route

1. The PC switches on and gives itself a link-local address fe80::.... Nobody is asked. It only works on that cable.
2. The router shouts to everybody on the cable (multicast ff02::1) a Router Advertisement (RA): "the network here is 2001:db8:10::/64, and I am the way out".
3. The PC takes those 64 bits, adds 64 bits of its own, and now has a global address and a default route.

SLAAC (Stateless Address Autoconfiguration, RFC 4862) is the way an IPv6 host builds its own global address from the prefix that the router advertises.

"Stateless" means the router remembers nothing: no DHCP server, no table of leases. In the analogy: the router announces the street name, and every PC picks its own house number.

One more difference. IPv6 has no broadcast and no ARP. To find a neighbour's MAC address, hosts send multicast messages called Neighbour Discovery. ip -6 neigh is the new ip neigh.

Your addresses in the lab¶

The lab is the office topology: pc1 and pc2 behind the router r1, and the server srv on the other side. r1 sends Router Advertisements. Nobody typed an IPv6 address on pc1. Follow the Exercise sheet.

cd ~/lab/office && containerlab deploy -t office.clab.yml
docker exec -it clab-office-pc1 bash
ip -6 addr show dev eth1

Real output from the lab (first line shortened; the last 64 bits differ on every machine):

12: eth1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9500 ... state UP
    inet6 2001:db8:10:0:a8c1:abff:fe92:d27f/64 scope global dynamic
          mngtmpaddr proto kernel_ra
       valid_lft 86395sec preferred_lft 14395sec
    inet6 fe80::a8c1:abff:fe92:d27f/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever

How to read it:

• scope link ... kernel_ll — the link-local address, made by the kernel itself.
• scope global dynamic ... kernel_ra — the global address, built from a Router Advertisement. It has a lifetime (valid_lft) that the router keeps renewing.
• Both addresses end with the same 64 bits: the same house number on two different streets.

The way out.

ip -6 route

You will see a line like default via fe80::... dev eth1 proto ra. The gateway is the router's link-local address, learnt from the advertisement.

The neighbours.

ping -c 2 ff02::1%eth1
ip -6 neigh

The ping to "everybody on this cable" is answered by two addresses: pc1 itself and r1. ip -6 neigh then lists r1 with its MAC address and the word router.

Why %eth1? A link-local address exists on every interface, all of them starting with fe80::. So the kernel must be told which cable you mean. Without %eth1 the ping fails.

Crossing the router.

ping -c 2 2001:db8:ffff::10
traceroute -n 2001:db8:ffff::10
dig +short AAAA intranet.tramuntana.internal

The ping works; traceroute shows two hops (2001:db8:10::1, the router, then the server); dig returns 2001:db8:ffff::10. An AAAA record is the IPv6 version of the DNS A record: four A's because the address is four times as long in bits.

When you finish: exit, then containerlab destroy -t office.clab.yml --cleanup.

Stretch, on the group's MikroTik. Add a unique local prefix to the LAN bridge and let the router advertise it (G = your group number):

/ipv6 address add address=fd00:G::1/64 interface=bridge-lan advertise=yes

Within a few seconds, ip -6 addr on a PC cabled to it shows a new fd00:G:... address. In WinBox: IPv6 → Addresses → +.

Key takeaways¶

• IPv4 has 32 bits (about 4.3 billion addresses) and ran out; IPv6 has 128 bits, 2⁹⁶ times more. Most hosts run both: dual stack.
• An IPv6 address is 8 groups of 4 hex digits. Rule 1: drop leading zeros. Rule 2: one run of zero groups becomes ::, only once.
• A LAN is always a /64: the first 64 bits are the network (the street), the last 64 the interface (the house number).
• First digits tell the kind: ::1 loopback, fe80: link-local, 2/3 global, fc/fd unique local, ff multicast.
• With SLAAC the router sends a Router Advertisement with the prefix and the host builds the rest; no DHCP server, no leases.
• No broadcast, no ARP: Neighbour Discovery (ip -6 neigh). A link-local address needs the interface: ping fe80::1%eth1.

Quick check¶

Next: when something stops working, you need a method, not luck — Network troubleshooting.