🌐 01-06: IPv6 Basics & Security¶

📌 Why Does IPv6 Exist?¶

IPv4 uses 32-bit addresses, giving roughly 4.3 billion possible addresses (01-04: IPv4 Addressing Basics). That sounded huge in the 1980s. It is nowhere near enough for a planet with billions of phones, laptops, servers, IoT sensors, cars, and smart fridges all wanting their own address.

This is IPv4 exhaustion — the regional internet registries have already run out of fresh IPv4 blocks to hand out. Workarounds like NAT (Network Address Translation, letting many private devices share one public IP) have stretched IPv4's life dramatically, but they don't scale forever and add complexity.

IPv6 (Internet Protocol version 6) was designed to solve this permanently by using 128-bit addresses instead of 32-bit — an astronomically larger address space (roughly 340 undecillion addresses, i.e., 2^128).

💡 To put 2^128 in perspective: it's enough to assign roughly 100 unique IP addresses to every atom on the surface of the Earth. Address exhaustion is not a problem IPv6 will face again.

🔢 IPv6 Address Format¶

Hexadecimal Notation¶

An IPv6 address is written as 8 groups of 4 hexadecimal digits, separated by colons:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Each group represents 16 bits (4 hex digits × 4 bits), for a total of 8 × 16 = 128 bits.

Compare this to IPv4's dotted-decimal format (192.168.1.1, 4 groups of 8 bits) — IPv6 uses hex instead of decimal, and colons instead of dots, mostly because writing 128 bits in decimal dotted notation would be unreasonably long.

Zero Compression (`::`)¶

IPv6 addresses are full of zeros, so two shorthand rules keep them readable:

Leading zeros in each group can be dropped: 0db8 → db8, 0000 → 0.
One consecutive run of all-zero groups can be replaced with :: (double colon) — but only once per address, since using it twice would make the address ambiguous (you couldn't tell how many zero groups belong to each ::).

Example compression:

Full:        2001:0db8:85a3:0000:0000:8a2e:0370:7334
Step 1:      2001:db8:85a3:0:0:8a2e:370:7334      (drop leading zeros per group)
Step 2:      2001:db8:85a3::8a2e:370:7334          (collapse the 0:0 run with ::)

💡 The loopback address in IPv6 is 0000:0000:0000:0000:0000:0000:0000:0001, which compresses all the way down to ::1 — the IPv6 equivalent of IPv4's 127.0.0.1.

The "unspecified address" (used before a device has an address, similar in spirit to 0.0.0.0) is :: on its own — all 128 bits are zero.

🏷️ IPv6 Address Types¶

Unlike IPv4 (which has unicast, broadcast, and multicast), IPv6 has no broadcast at all — it was intentionally removed. Instead:

Type	Purpose	Example / Prefix
Unicast	One-to-one — identifies a single interface	Global unicast addresses start `2000::/3`
Multicast	One-to-many — a packet delivered to every member of a group	Starts with `ff00::/8`
Link-local	Automatically self-assigned, valid only on the local network segment, never routed	Starts with `fe80::/10`
Anycast	One-to-nearest — several interfaces share an address; the packet goes to the closest one	Same format as unicast, distinguished by configuration, not prefix

💡 Every IPv6-enabled interface automatically gets a link-local address the moment it's activated, even with no DHCP or manual configuration. This is what IPv6 uses for essential low-level operations — including neighbor discovery, described next — before any "real" routable address is even assigned.

There is no IPv6 broadcast because multicast groups replace every use case broadcast used to serve — for example, instead of broadcasting "who has this IP?" to every device on the segment (as IPv4's ARP does), IPv6 sends that question to a specific multicast group that only the relevant device needs to listen to.

🔍 Neighbor Discovery Protocol (NDP): IPv6's Replacement for ARP¶

In IPv4, when your device knows a target's IP address but needs its MAC address to actually deliver a frame on the local network, it uses ARP (Address Resolution Protocol) — broadcasting "who has this IP?" to everyone on the segment (see 03-03: ARP Protocol Recap for the full mechanics, including how it's exploited).

IPv6 has no ARP. Instead, it uses NDP (Neighbor Discovery Protocol), built on top of ICMPv6, which handles several jobs ARP never did:

NDP Message	Purpose
Neighbor Solicitation (NS)	"Who has this IP?" — the rough equivalent of an ARP request, sent to a multicast group instead of a broadcast
Neighbor Advertisement (NA)	"I have this IP, here's my MAC" — the equivalent of an ARP reply
Router Solicitation (RS)	"Are there any routers here?" — sent by a device that just joined the network
Router Advertisement (RA)	A router announcing itself and handing out network configuration (prefix, default gateway) — this is how many IPv6 networks handle address auto-configuration without needing DHCP

💡 Key conceptual link forward: just as ARP has no authentication and can be spoofed (Module 03 covers ARP spoofing / ARP cache poisoning attacks in depth), NDP has the exact same trust problem — a malicious device can send forged Neighbor Advertisements or Router Advertisements, redirecting traffic through itself (an NDP-based man-in-the-middle) or knocking devices off the network entirely. The vulnerability pattern is identical; only the protocol name changed.

⚠️ IPv6-Specific Security Considerations¶

1. A Much Larger Scan Space (a Double-Edged Sword)¶

An IPv4 /24 subnet has only 254 usable hosts — trivial to fully port-scan in seconds. A typical IPv6 subnet is a /64, containing 2^64 possible addresses — scanning every address exhaustively is computationally infeasible.

💡 This sounds like a security win ("attackers can't just scan the whole subnet"), but it's a partial one — attackers now use smarter techniques like harvesting addresses from DNS records, multicast traffic, or NDP tables, rather than relying on security-by-obscurity from a large address space.

2. Transition and Tunneling Risks¶

Because IPv4 and IPv6 aren't natively interoperable, many networks run transition mechanisms (like 6to4, Teredo, or dual-stack configurations) during the long migration period. These tunneling mechanisms can:

Create unmonitored tunnels that bypass IPv4-only firewalls and security monitoring, since a firewall configured only to inspect IPv4 rules may not properly inspect IPv6 traffic tunneled inside it.
Introduce shadow IPv6 connectivity on networks where administrators believe IPv6 is "disabled" — many operating systems have IPv6 enabled by default and will happily use available tunnels even if IPv6 was never intentionally configured.

3. NDP Spoofing¶

As described above, forged Router Advertisements or Neighbor Advertisements let an attacker on the local segment redirect traffic, perform denial of service, or position themselves for a man-in-the-middle attack — the IPv6 sibling of ARP spoofing.

4. Extension Header Abuse¶

IPv6 supports chainable extension headers (for fragmentation, routing options, etc.) that sit between the IPv6 header and the payload. Poorly configured firewalls and intrusion detection systems have historically struggled to properly parse deeply chained or malformed extension headers, which attackers have used to slip malicious packets past inspection.

📌 Key Takeaways¶

IPv6 uses 128-bit addresses (vs. IPv4's 32-bit) specifically to solve IPv4 address exhaustion.
Addresses are written as 8 groups of hex digits; leading zeros can be dropped and one run of all-zero groups can be compressed with ::.
::1 is the IPv6 loopback address; :: alone is the unspecified address.
IPv6 has no broadcast — unicast, multicast, link-local, and anycast cover every use case broadcast used to.
NDP (Neighbor Discovery Protocol), built on ICMPv6, replaces ARP for address resolution and adds router/prefix discovery via Router Solicitation/Advertisement.
NDP has the same lack of built-in authentication as ARP, making it vulnerable to spoofing-based man-in-the-middle attacks (the IPv6 analog of what Module 03 covers for ARP).
IPv6's larger address space makes brute-force scanning harder, but transition tunnels, default-enabled IPv6 stacks, and extension header parsing all introduce their own distinct risks.