What is IPv6? Address structure, benefits and adoption

What is IPv6? It is version 6 of the Internet Protocol, standardized by the IETF to take over from IPv4, version 4, which still carries a large share of internet traffic. The core specification was first published as RFC 2460 in 1998 and replaced in 2017 by RFC 8200, which made it a full Internet Standard. The most visible change is address length: IPv4 addresses are 32 bits, about 4.3 billion in total; IPv6 addresses are 128 bits, for a total of 2^128, roughly 3.4 × 10^38. Written out in full, an IPv6 address is eight groups of hexadecimal digits separated by colons, usually compressed to something like 2001:db8:1a2b:10::25. The main problem it solves is that IPv4 addresses ran out; along the way it also simplified the packet header, dropped broadcast and ARP, and built in address autoconfiguration. The example addresses below use the documentation prefix 2001:db8::/32.

What problem IPv6 solves: IPv4 ran out

4.3 billion IPv4 addresses looked inexhaustible when the internet was designed, and nowhere near enough once every person carried a phone and every server needed several addresses. Some key dates:

Date	Event
February 2011	IANA hands the last five /8 blocks to the five regional internet registries (RIRs); the global free pool is gone
April 2011	APNIC, the registry for Asia-Pacific, starts allocating from its last /8, with each new member limited to a small amount
September 2015	ARIN, covering North America, issues the last addresses in its free pool
November 2019	RIPE NCC, covering Europe and the Middle East, makes its final /22 allocation
Since then	New IPv4 space comes mainly from transfers and leasing, and addresses have become an asset with a market price

The IPv4 answer to scarcity was NAT. A home router lets the whole household share one public address, and ISPs add carrier-grade NAT on top, so many broadband customers share one public IP. NAT eased the shortage but brought side effects. Outside hosts cannot open connections to devices behind NAT, so remote access and peer-to-peer traffic have to take detours. An address in a log no longer identifies one device, so tracing abuse needs the address, the port and the exact time together. And the NAT device has to keep state for every connection, which makes it a bottleneck and a point of failure.

IPv6 attacks the problem at the root: there are so many addresses that there is no need to conserve them. Every device gets a globally unique address, the network becomes end-to-end reachable again, and NAT is no longer required.

What an IPv6 address looks like: 128 bits in layers

A 128-bit address is written as eight groups of four hexadecimal digits. Leading zeros in each group can be dropped, and one run of consecutive all-zero groups can be replaced by “::”. More important than the notation is the hierarchy: IPv6 space is allocated by prefix length, level by level. A data center or company receives one large prefix and subdivides it. In a typical data center:

Level	Prefix length	Example	Meaning	How many of the next level fit
Address holder	/32	2001:db8::/32	Space an ISP or large organization receives from a registry	65,536 /48s
Site	/48	2001:db8:1a2b::/48	One data center or one company	65,536 /64s
Segment	/64	2001:db8:1a2b:10::/64	One VLAN, or one server’s allocation	2^64 interface addresses
Interface	/128	2001:db8:1a2b:10::25	One address on one NIC	—

A /48 holds 65,536 /64s, and a single /64 holds 2^64 addresses, about 4.3 billion times the entire IPv4 address space. So nobody counts “how many hosts fit in this subnet” in IPv6. LAN segments are always /64, and the last 64 bits form the interface identifier; Stateless Address Autoconfiguration (SLAAC) relies on those 64 bits to let hosts build their own addresses. Point-to-point links between routers may use a /127, an exception specifically allowed by RFC 6164.

Another habit to adjust: an IPv6 interface usually has several addresses at once. Every IPv6-enabled interface has a link-local address starting with fe80, valid only on that link and used for neighbor discovery and finding the router. Global unicast addresses, starting with 2 or 3, are the ones that reach the internet. There may also be a unique local address starting with fd, similar to an IPv4 private address, and temporary addresses that rotate periodically. IPv6 has no broadcast either; everything broadcast used to do is now done with multicast (addresses starting with ff).

IPv6 vs IPv4: the key differences

	IPv4	IPv6
Address length	32 bits	128 bits
Notation	Dotted decimal, e.g. 192.0.2.10	Colon-separated hexadecimal, e.g. 2001:db8::10
Subnets	Subnet mask or prefix length, with subnets of every size	Prefix length only; LAN segments are /64
Base header	20–60 bytes, variable length, with a header checksum	Fixed 40 bytes, no header checksum; optional features move to extension headers
Fragmentation	Sender and routers along the path can fragment	Only the sender fragments; routers never do, and path MTU discovery is relied on; minimum link MTU is 1280 bytes
Address resolution	ARP, using broadcast	Neighbor Discovery Protocol (NDP), using ICMPv6 multicast
Broadcast	Yes	No; replaced by multicast
Address configuration	Manual or DHCP	Manual, SLAAC or DHCPv6
NAT	Ubiquitous	Not needed by design
Addresses per interface	Usually one	Usually several
DNS record type	A	AAAA
Reverse DNS zone	in-addr.arpa	ip6.arpa

For operations, three rows matter most. There is no ARP, so binding and anti-spoofing measures have to be rebuilt around NDP. Routers do not fragment, so ICMPv6 cannot be blocked casually. And each interface has several addresses, so when troubleshooting, first make sure you know which one you are looking at.

IPv6 benefits, and what it does not fix

The benefits of IPv6 are worth stating concretely. These are the real ones:

1. Plenty of addresses. Servers, containers and IoT devices can all have global addresses. Network plans no longer need to chop space into tiny subnets to save addresses, and a data center can give each server a whole /64 instead of selling IPv4 one address at a time.
2. End-to-end reachability. No port forwarding is needed, and the address in a log is the real source, so tracing traffic no longer means digging through NAT translation logs.
3. Autoconfiguration. Hosts build their own addresses from the prefix the router advertises, so a machine works as soon as it is plugged in.
4. Clean, aggregatable prefixes. Space is allocated hierarchically, so an ISP or data center usually needs to announce only a few prefixes to the internet.
5. A simpler header. The base header has a fixed length and no checksum, so routers do less work per hop.

It is just as important to be clear about what IPv6 does not solve:

• It is not compatible with IPv4. The transition relies mainly on dual stack, which doubles what you operate: two sets of addresses, two routing tables, two sets of firewall rules.
• Security does not improve automatically. RFC 4294 once required IPv6 nodes to support IPsec; RFC 6434 in 2011 relaxed that to “should”, so encryption is not something IPv6 gives you for free. Neighbor Discovery, like ARP, has no authentication, which allows NDP spoofing and rogue router advertisements; switches need protections such as RA Guard.
• It is not necessarily faster. Speed depends on the path and the far end far more than on the protocol version.

Where IPv6 adoption stands

Adoption has been driven less by any single deadline than by IPv4 becoming scarce and expensive, and it varies widely between countries and networks:

• Mobile networks led the way. Many large mobile operators hand out IPv6 by default, and some run IPv6-only networks, reaching IPv4-only content through translation such as 464XLAT.
• Home broadband in many markets now delegates an IPv6 prefix to the customer’s router, though support still depends heavily on the ISP.
• Cloud platforms offer IPv6 on instances, load balancers and CDNs. Several major providers now charge for public IPv4 addresses, including ones attached to running instances, which gives customers a direct financial reason to use IPv6 where they can.
• Governments push their own networks. In the US, OMB memorandum M-21-07, issued in 2020, set federal agencies a target of moving most of their networked assets to IPv6-only operation by the end of fiscal 2025.

For current figures, check Google’s IPv6 statistics, which measure the share of its users reaching it over IPv6, and APNIC Labs’ per-country and per-network measurements; the numbers change too quickly to quote here. One point applies everywhere: users having IPv6 addresses does not mean traffic flows over IPv6. If a server has no AAAA record, every connection to it still uses IPv4.

For hosting providers, the pressure arrives through customers. Government and enterprise customers increasingly have IPv6 requirements for their sites, and customers renting servers ask more and more often whether IPv6 is included. What a data center needs to prepare is IPv6 space from its upstream provider or its regional registry, gateways and switches running dual stack, and a register that keeps track of IPv6 assignments.

Habits to change when you start working with IPv6

1. There are two firewalls, not one. iptables only filters IPv4; IPv6 rules live in ip6tables. Once a server has a public IPv6 address, if only iptables rules exist, its services are wide open over IPv6. firewalld zone rules apply to both protocols, and ufw manages both when IPV6=yes is set in /etc/default/ufw; servers with hand-written iptables scripts are the ones most likely to be missed. To check:

# List only IPv6 listening sockets; a local address of [::] or * means all addresses
ss -6 -tlnp
# Compare IPv4 and IPv6 inbound rules; an empty ip6tables chain with a default ACCEPT policy means no IPv6 filtering at all
iptables -S INPUT
ip6tables -S INPUT

2. Do not block ICMPv6 wholesale. Some IPv4 admins drop all ICMP out of habit; doing the same on IPv6 breaks the network. RFC 4890 gives detailed guidance on filtering ICMPv6, and at minimum these must be allowed:

Type	Name	Why it cannot be blocked
1	Destination Unreachable	Reports failed connections promptly instead of leaving them to time out
2	Packet Too Big	Routers do not fragment, so path MTU discovery depends on it; block it and large packets stall
3	Time Exceeded	traceroute depends on it
4	Parameter Problem	Feedback on malformed headers
133–136	Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement	Autoconfiguration, finding the router and resolving neighbors’ MAC addresses all rely on these; together they replace ARP and part of DHCP
128, 129	Echo Request, Echo Reply	ping; allow with rate limiting

3. Do not cut subnets smaller than /64 to “save addresses”. Prefixes such as /120 or /112 on a server break SLAAC and other features that rely on a 64-bit interface identifier. Addresses are not scarce: use /64 for every LAN segment, and give customers who need more a /56 or /48.

4. Block and rate-limit by /64. A host can switch to any address in its /64 at will, so banning a single address is bypassed by picking a new one. Think in /64s for firewall blocklists, API rate limits and allowlists.

5. Confirm IPv6 really works before adding an AAAA record. Under the default rules in RFC 6724, systems usually prefer IPv6. Browsers fall back quickly thanks to Happy Eyeballs (RFC 8305), but many programs and scripts do not: once a name has an AAAA record and the server’s IPv6 is broken, those clients hang until the connection times out. Test from an external machine with IPv6 before going live:

# Before adding the record: bypass DNS and connect to the server's IPv6 address; only an HTTP status line counts as working
curl -6 -sI --resolve www.example.com:443:[2001:db8:1a2b:10::25] https://www.example.com/ | head -1
# After adding the record: confirm the AAAA is live, then test again by name
dig AAAA www.example.com +short
curl -6 -sI https://www.example.com/ | head -1

Managing IPv6 space in the data center

Planning IPv6 is simpler than planning IPv4; the hard part is tracking it. You receive a /48 or larger from upstream, cut it into /64s for servers and /56s for larger customers, and after a few years nobody knows which sub-prefix went to whom unless there is a register.

IP address management in Toplink DCIM supports IPv6 natively. IPv6 blocks are entered by CIDR, just like IPv4, and can be split into smaller subnets by prefix length. When a server needs IPv6, the system carves out a suitable subnet automatically; you can also assign IPv6 subnets to servers in bulk, or generate a set number of addresses within a block. IPv4 and IPv6 blocks are registered side by side in one system, so finding which subnet belongs to which server is a single lookup.