IPv6 and Coexistence with IPv4

IPv4 has about four billion possible addresses, and the world ran out of new ones long ago. IPv6 is the long-term replacement, and it is already in use on your phone, your home box or your company network, often without you noticing. For a security professional, IPv6 matters for a simple reason: if you only watch IPv4, you may be blind to half of the traffic. This lesson gives you the essentials to read IPv6 addresses and to understand how both protocols coexist.

It also closes chapter 2. You have learned to capture traffic, to understand ARP and to segment a network. Now we complete the picture of the addressing layer before turning to your lab.

Why IPv6 exists

An IPv4 address is 32 bits long. Techniques such as NAT, which you met in lesson 1, stretched the lifetime of the system by letting many devices share one public address. IPv6 solves the problem at its root with 128-bit addresses, which is a number of addresses so large that it will not run out in practice. It also simplifies some aspects of the protocol and was designed with auto-configuration in mind.

Reading an IPv6 address

An IPv6 address is written as eight groups of four hexadecimal digits separated by colons:

2001:0db8:0000:0000:0000:0000:0000:0001

Two rules make it shorter. Leading zeros in a group can be dropped, and one (and only one) run of consecutive all-zero groups can be replaced by a double colon ::. The address above therefore becomes:

2001:db8::1

The prefix 2001:db8::/32 is reserved for documentation, like the special IPv4 ranges we saw before, so it is the one we use in examples. IPv6 uses CIDR-style prefixes too. A home or small-company network usually receives a /48 or /56 from its provider, and each LAN uses a /64: the first 64 bits identify the network and the last 64 bits identify the interface.

Kinds of IPv6 addresses

Type	Prefix	Role
Loopback	::1	This machine, like 127.0.0.1
Link-local	fe80::/10	Valid only on the local link; every interface has one automatically
Global unicast	typically 2000::/3	Routable on the Internet
Unique local	fc00::/7	Private addresses, similar in spirit to 10.x or 192.168.x
Multicast	ff00::/8	Sent to a group of listeners

IPv6 has no broadcast. Instead, it uses multicast: a message is sent to a group address and only interested devices listen.

Because every interface has a link-local address, you will notice that your machine already has an IPv6 address starting with fe80::, even if your network does not offer IPv6 to the Internet. Display it with the same commands as before: ip addr show, ifconfig or ipconfig. A link-local address often comes with a suffix like %en0 or %eth0 that names the interface, since the same fe80:: address can exist on several links.

How devices get an address

IPv6 offers two main methods:

• SLAAC (Stateless Address Autoconfiguration): routers announce the network prefix in Router Advertisement messages and each device builds its own address from that prefix. No server needed. To protect privacy, modern systems generate random, changing interface identifiers rather than using the hardware MAC address, so the address cannot be used to track a device for years.
• DHCPv6: a server hands out addresses and options, like DHCP for IPv4.

Replacing ARP is the Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages: "Neighbor Solicitation" asks who has an address, and "Neighbor Advertisement" answers. NDP also covers router discovery. Like ARP, it was originally designed with trust in mind: a rogue machine could send false Router Advertisements and set itself up as the default router. The defence has the same flavour as for ARP: features such as RA Guard on switches, which blocks router advertisements coming from ports that are not supposed to host a router, and, in some environments, secured variants of discovery.

Coexistence: dual stack, tunnels and translation

The Internet is not switching overnight. For many years, IPv4 and IPv6 live side by side, through several mechanisms:

• Dual stack: devices have both an IPv4 and an IPv6 address and use whichever works best. This is the most common situation. Browsers often try both and use the one that answers first.
• Tunnelling: IPv6 packets are wrapped inside IPv4 packets to cross networks that do not support IPv6 yet.
• Translation: gateways translate between the two protocols, so IPv6-only devices can still reach IPv4-only services.

In DNS, the AAAA record gives an IPv6 address for a name, just as the A record gives an IPv4 one. A domain can have both.

Security implications

IPv6 is not less secure or more secure by nature; it is different, and the risks come from forgetting it.

• Forgotten IPv6 means unfiltered IPv6. If a firewall carefully filters IPv4 but has no IPv6 rules, traffic may flow through the unguarded side. Any firewall policy must cover both protocols.
• IPv6 may be active without being planned. Many operating systems enable it by default, and a rogue router advertisement can switch a network to IPv6 for devices that no one administers. Monitor and decide deliberately, instead of hoping it is off.
• Monitoring must see both. Logs, intrusion detection rules and inventories that only record IPv4 addresses leave a blind spot.
• The address space is huge. Scanning a /64 network for live hosts one address at a time is impractical, which slightly changes how reconnaissance works, although attackers have other methods such as DNS and logs. Do not consider it a protection.
• NAT is not a firewall. With IPv6, devices can have global addresses without NAT, so the stateful firewall must do the protection role that NAT is often wrongly credited with.

Your turn: find your IPv6 identity

On your own computer, display your network configuration and look for IPv6 addresses. In your lab notebook, record: your link-local address (fe80::...), whether you also have a global address (starting with 2 or 3), and whether your network seems dual-stack. Then use ping -6 ::1 (or ping6 ::1 on some systems) to test the IPv6 loopback. Finally, write the short form of the address 2001:0db8:0000:0000:00a0:0000:0000:0010.

See a solution

Almost every machine shows at least a link-local fe80:: address. If you also see an address starting with 2 or 3, your provider or network offers global IPv6, and since you also have an IPv4 address, you are in dual stack. The loopback test should answer on ::1, proving the IPv6 stack is active even without external connectivity. For the shortening exercise, drop the leading zeros: 2001:db8:0:0:a0:0:0:10. Then replace one run of zero groups by ::. There are two possible runs (the two zeros in the middle, and the two zeros before the last group); the rule is to compress the longest one, and the first one if there is a tie, which gives 2001:db8::a0:0:0:10.