Networking › Module 2 › Lesson 3
IPv6 Introduction
Why IPv6 exists, how addresses look, and what changes for security teams
Opening
IPv6 is not a trivia bonus track. Dual stack means two attack surfaces.
You just learned IPv4 fences: /24, /26, masks. That world is still everywhere — and it is exhausted. IPv4's 32 bits are about 4.3 billion addresses. Phones, VMs, and sensors outgrew that. IPv6 uses 128 bits so the internet could keep numbering hosts without pretending NAT is a complete design. The defender failure is not "cannot recite 2^128." It is leaving IPv6 on, unfiltered, because "nobody uses it" or "the space is too big to scan so we are safe." Both are false. You will learn how addresses look, what ::1 and fe80:: mean, and how to ask YOUR machine whether v6 is already alive.
1. 128 bits, compression, and the addresses you will actually see
IPv4 exhaustion is arithmetic plus politics: many addresses were allocated in large historic blocks; NAT delayed the crisis; it did not add bits. IPv6's 128 bits are 2^128 addresses — a number so large that "we will run out" is not the operational story. The operational story is format and policy. Written form is eight groups of four hex digits: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Hex is 0–9 and a–f; each group is 16 bits; 8 × 16 = 128.
Compression exists so humans can read logs. Leading zeros in a group drop: 0db8 → db8, 0370 → 370. One contiguous run of all-zero groups may become :: — and only once, or the address would be ambiguous. So 2001:db8:85a3::8a2e:370:7334 is the same value. If you see two :: in one address, it is malformed. Documentation examples often use 2001:db8::/32 (reserved for docs, like 192.0.2.0/24 in IPv4). Real global unicast in production often starts with 2000::/3, but you do not need to memorize allocation charts to read a host.
Loopback is ::1 — the IPv6 cousin of 127.0.0.1. ping6 ::1 (or ping -6 ::1) talks to yourself. Link-local addresses start with fe80::/10. They are valid only on that link; they are not global internet identities. You will often see fe80::…%eth0 — the %zone tells the OS which NIC, because every iface can have a similar-looking fe80 address. Unique local addresses (fd00::/8, conceptually like RFC1918) exist for internal numbering. Do not assume "starts with fe80" means "broken IPv6." It often means the link is up and Neighbor Discovery can run even without a global prefix.
2. Dual stack, Neighbor Discovery, and why "too big to scan" is not safety
Dual stack means a host has IPv4 and IPv6 at once. Browsers may prefer v6 (Happy Eyeballs) when a name has AAAA records. A firewall that only lists IPv4 objects can leave tcp/22 open on a global v6 address while v4 looks locked down. That is the classic miss: operators "disabled IPv4 exposure" and never ran ip -6 addr. IPv6 is not automatically encrypted. IPSec was designed to be available; it is not magically on for every packet.
ARP does not exist in IPv6. Neighbor Discovery Protocol (NDP) uses ICMPv6 for router advertisements, neighbor solicitation, and duplicate address detection. The attacks rhyme with IPv4: rogue Router Advertisements can hand out a malicious gateway; NDP spoofing is the Layer-2/3 lie for v6. No broadcasts: multicast and anycast replace that pattern. "No broadcast" does not mean "no local recon." It means your mental model must change, not shut off.
A 64-bit interface identifier in a typical /64 LAN is huge. Random scanning of the entire internet's v6 space like an IPv4 /8 is impractical. Attackers do not need that. They follow DNS AAAA records, logs, neighbor tables, and mis-advertised prefixes. Bigger scan space ≠ "IPv6 is safe to ignore." Cover v6 in firewalls, logging, and inventory. If ip -6 addr shows nothing but lo, note that. If it shows a global address, that address is in scope for the same controls as v4.
3. Wrong vs right: leaving v6 off the ticket because IPv4 still works
Worked failure mode — dual-stack laptop. Commands on YOUR box only:
Wrong
You harden iptables for IPv4, never look at ip6tables/nft v6 families, and declare the host safe. Or you assume fe80:: means IPv6 is unused. Or you scan a campus IPv6 prefix "because NDP is interesting." Or you claim IPv6 is encrypted by default so HTTPS is optional.
Right
Run ip -6 addr on a machine you own. Record ::1, any fe80:: link-local, and any global/ULA address. Treat dual stack as two policies. Do not probe other people's IPv6 networks. Ask whether the firewall you actually run has a v6 path.
4. Practical: ip -6 addr on YOUR machine
If the command prints only lo (::1) or is empty of global addresses, that is a finding: v6 may be off or link-local only. If you see 2000::/3-style or fd00:: addresses, write them down as inventory — still your host.
Command guide
IPv6 inventory on your VM / WSL only
YOUR Linux VM / WSL / spare machine
Command — copy this
ip -6 addr ip -6 route
Typical lines: inet6 ::1/128 → loopback (like 127.0.0.1) inet6 fe80::.../64 → link-local (this wire only; note %iface) inet6 2001:... or fd.. → global or unique-local if present
Optional: talk to yourself over v6
Optional command
ping -c 2 ::1 ping -6 -c 2 ::1
If there is no inet6 except lo: write "no global IPv6 on this host" NEVER: scan IPv6 prefixes you do not own NEVER: assume "no IPv4 listener" means no IPv6 listener
Mission: ::1, fe80, and whether you have global v6
On your own VM or WSL, run ip -6 addr. Write three notes: (1) ::1 loopback present or not, (2) any fe80:: link-local plus iface, (3) any other inet6 (global/ULA) or the sentence "none besides loopback/link-local." Do not scan other networks. Optional: ping -c 2 ::1.
Stuck? Ask Cyberlium AI Mentor
If fe80:: looks like a "fake IP," ask Cyberlium AI Mentor for a hint — not a scan of the LAN. Try: "Hint only: is fe80:: a global identity, and why does it need a %interface?" Keep the definition in your words.
IPv4 taught you 32-bit locators and masks. IPv6 adds 128-bit locators, ::1, link-local fe80::, compression, and a hard SOC rule: dual stack is two surfaces. Next up — Public vs Private IP — RFC1918, NAT as many-to-one, CGNAT, and why a "what is my IP" website disagrees with ip addr.
Knowledge Check
APPLY: ip -6 addr on your laptop shows inet6 ::1/128 and inet6 fe80::1234/64 scope link. A teammate says "IPv6 is off, ignore it in the firewall." What is true?
Multiple choice
Knowledge Check
APPLY: IPv4 SSH is filtered. A host also has a global IPv6 address and sshd listens on [::]:22. Best defender read?
Multiple choice
Knowledge Check
APPLY: True or False: You may compress zeros with :: only once in an IPv6 address, and ::1 is loopback.
True or False