IPv6 Protocol

128-bit addresses end the reign of NAT—SLAAC autoconfiguration, simplified fixed-length headers, and native IPsec support. Understanding IPv6 is more than just "longer addresses"; its neighbor discovery and address autoconfiguration models are fundamentally different from IPv4.

Overview

IPv6 is the successor to IPv4, defined in RFC 2460 in 1998 (updated to RFC 8200 in 2017). Core improvements include: 128-bit addresses (increasing from 4.3 billion to 3.4×10³⁸), a fixed 40-byte header (no options overhead, no checksum), native security (IPsec support), and stateless address autoconfiguration (SLAAC). Current global IPv6 deployment is approximately 40-50%, but mobile networks (4G/5G) and large cloud providers have widely adopted it. The transition period will see long-term coexistence technologies such as Dual-Stack and NAT64/DNS64.

IPv6 Header: 40 bytes, Fixed

 0                   1                   2                   3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|Traffic Class|           Flow Label                    |
|  (4)  |   (8 bits)  |          (20 bits)                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|        Payload Length         |  Next Header  |   Hop Limit   |
|        (16 bits, ≥0)          |   (8 bits)    |    (8 bits)   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Source Address                         |
|                         (128 bits)                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Destination Address                      |
|                         (128 bits)                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Key differences from the IPv4 header:

Removed:
  IHL:           None → header is fixed at 40 bytes
  Header Checksum: None → L2 CRC + L4 checksum are sufficient; recalculating the checksum at every hop is wasteful
  Identification/Flags/Fragment Offset: None → Fragmentation is handled by endpoints (PMTUD for IPv6)
  Options:       Moved into extension headers

Added:
  Flow Label: 20 bits → Marks flows (commonly used for ECMP hashing + QoS)
  Next Header: Replaces Protocol → But can also point to a chain of extension headers

Retained:
  Traffic Class ≈ DSCP + ECN
  Hop Limit ≈ TTL

Flow Label

A 20-bit pseudo-random marker chosen by the sender, identical for all packets in the same flow. Design goal: Allow routers/switches to distinguish flows using only the Flow Label + Source/Dst IP, without needing to parse L4 ports (which may be encrypted by IPsec ESP).

In practice: Linux generates a random Flow Label using skb->hash (net.ipv6.auto_flowlabels=1) — one per TCP connection.

Next Header and Extension Header Chain

Basic:
  Next Header = 6 (TCP) → Directly points to TCP header

Extension header chain:
  IPv6 Header (Next Header=0, Hop-by-Hop)
    → Hop-by-Hop Options Header (Next Header=43, Routing)
      → Routing Header (Next Header=44, Fragment)
        → Fragment Header (Next Header=6, TCP)
          → TCP Header + Data

Format of each Extension Header (EH):
  [Next Header (1 byte)] [Hdr Ext Len (1 byte)] [Options (variable)]
  → Must be 8-byte aligned

EH Order (RFC 8200):
  1. Hop-by-Hop Options (type 0)
  2. Destination Options (type 60) — for processing at intermediate destinations
  3. Routing (type 43)
  4. Fragment (type 44)
  5. Authentication Header (AH, type 51)
  6. Encapsulating Security Payload (ESP, type 50)
  7. Destination Options (type 60) — for processing at final destination
  8. Upper Layer (TCP=6, UDP=17, ICMPv6=58)

Security: RH0 (Type 0 Routing Header) is deprecated — source routing can be used for DDoS amplification attacks
     (Attacker: Packet → Host A → Host B → Host A → ... infinite loop)

IPv6 Fragmentation (Endpoints Only)

Unlike IPv4, IPv6 routers never fragment (the DF flag is always 1 in IPv6). Packets exceeding the link MTU → Router drops them and sends an ICMPv6 Packet Too Big (type 2, code 0).

Endpoints use the Fragment Extension Header:

[Fragment EH: Next Header=6, Reserved, Fragment Offset, M flag, Identification]
[original packet fragment: starting from offset]

SLAAC Deep Dive

Address Generation Process

1. Interface up → Generate link-local address: fe80::/64 + IID

2. DAD: Verify uniqueness of link-local address → If unique → tentative → preferred

3. RS (Router Solicitation):
   ICMPv6 type 133, src=:: (unspecified) or link-local, dst=ff02::2 (all-routers)
   Optional Option: Source Link-Layer Address

4. RA (Router Advertisement):
   ICMPv6 type 134, src=router's link-local, dst=unicast (response to RS)
   Contains Option: Prefix Information, MTU, Source Link-Layer Address

   Prefix Information Option:
     Type=3, Len=4 (32 bytes)
     Prefix Length: (1 byte, usually 64)
     L (on-link): This prefix is on the same link → Direct communication is possible
     A (autonomous): Use this prefix for SLAAC
     Valid Lifetime: Address validity (UINT32_MAX ≈ infinite or specific value)
     Preferred Lifetime: Address preference (≤ Valid Lifetime)
     Prefix:  (16 bytes)

5. Generate global unicast address:
   Prefix from RA + IID (from Privacy Extensions or EUI-64)

6. DAD again for global address

7. If M flag (Managed) is set in RA → Additional DHCPv6 to obtain DNS/NTP/etc.
   If O flag (Other Config) is set → DHCPv6 only obtains DNS (address still uses SLAAC)

Privacy Extensions (RFC 8981)

Permanent Address (EUI-64 based):
  Automatically generated, stable, suitable for servers

Temporary Address (Random IID):
  valid_lifetime ≤ 24h (short-term)
  preferred_lifetime ≤ 24h (shorter)
  Periodic: Generate new random IID + new IP → Old IP deprecated → Old IP removed
  → Outbound connections use temporary addresses (privacy), inbound connections use permanent addresses (reachability)

Linux:
  sysctl net.ipv6.conf.default.use_tempaddr=2  # prefer temporary for outbound

Transition Technologies

References

• RFC: 8200 (IPv6), 4862 (SLAAC), 8201 (PMTUD), 8981, 4291 (Address Architecture)
• Source Code: net/ipv6/ directory, include/net/ipv6.h

Keywords: IPv6, extension header, SLAAC, RA, RS, DAD, privacy extensions, Dual Stack, NAT64, DNS64