Module 11 · Internet layer · Lesson 5 of 5
IPv6
The 128-bit successor to IPv4: how its addresses are written and allocated, what changes (no NAT required, no ARP, no broadcast, a simpler header), how IPv4 and IPv6 coexist through dual stack and translation.
Why it matters
IPv4 ran out of new addresses years ago, and the workarounds (NAT layered on NAT, buying addresses at auction) are visible in every cloud bill and every NAT incident. A large and growing share of user traffic, especially from mobile networks, already arrives over IPv6, and some networks are IPv6-only internally. A service that only speaks IPv4 still works for most users through translation, but knowing how IPv6 differs explains logging surprises, allow-list gaps and why some clients connect a little slower.
The idea
IPv6 keeps IP's job (hop-by-hop delivery of packets between hosts) and changes its address size from 32 bits to 128 bits: about 3.4 × 10^38 addresses, enough that every device, and every network, can have globally unique addresses with room to spare. Along the way it simplifies the header and removes several IPv4 mechanisms that existed mostly to cope with scarcity.
Writing addresses
An IPv6 address is eight groups of four hex digits: 2001:0db8:0000:0000:0000:ff00:0042:8329. Leading zeros in a group can be dropped and one run of all-zero groups can be replaced with ::, giving 2001:db8::ff00:42:8329. In URLs, addresses go in brackets: https://[2001:db8::1]:8443/. The first 64 bits are normally the network prefix and the last 64 the interface identifier, so a single /64 subnet holds 18 quintillion addresses, and providers delegate a /56 or /48 to each customer.
What changes from IPv4
| Area | IPv4 | IPv6 |
|---|---|---|
| Address size | 32 bits, scarce | 128 bits, abundant |
| NAT | Everywhere, by necessity | Not needed; every host can be globally addressable (a stateful firewall still guards inbound) |
| Header | Variable length, checksum, fragmentation fields | Fixed 40 bytes, no checksum, optional extension headers |
| Fragmentation | Routers may fragment | Only the sender fragments; path MTU discovery is mandatory |
| Finding neighbours | ARP broadcasts | Neighbour discovery over ICMPv6 multicast |
| Address configuration | DHCP or manual | SLAAC (hosts build their own address from the router's prefix) or DHCPv6 |
| Broadcast | Yes | No; multicast instead |
Coexistence
The world will run both protocols for a long time.
- 1
Dual stack
Hosts and services have both an IPv4 and an IPv6 address. DNS returns an A record and an AAAA record, and the client chooses. - 2
Happy eyeballs
Clients race IPv6 and IPv4 connection attempts, preferring IPv6 but falling back within a few hundred milliseconds, so a broken IPv6 path costs a small delay instead of a failure. - 3
NAT64 and DNS64
IPv6-only networks (common on mobile carriers) reach IPv4-only servers through a translator; DNS64 synthesises AAAA records that point at it. - 4
Cloud load balancers
Most can accept IPv6 from clients and talk IPv4 to backends, so services gain IPv6 reachability without changing servers.
What it means for your services
Logging, rate limiting and allow-lists must handle IPv6 addresses: columns sized for 15-character IPv4 strings truncate them, and per-IP rate limits are meaningless when one user controls a whole /64, so limit by /64 prefix instead. Firewalls must have IPv6 rules too, or an IPv6 path can bypass IPv4-only filtering. ICMPv6 must be allowed, since neighbour discovery and path MTU discovery depend on it. And test the AAAA path: a published but broken IPv6 address makes some clients slow even if happy eyeballs eventually rescues them.
Trade-offs
IPv6 removes address scarcity, NAT's state and its breakage of end-to-end connectivity, and simplifies forwarding, at the cost of running two protocols during a very long transition, new operational knowledge, tooling and log formats, and security policies that must be duplicated. For most services the pragmatic step is dual stack at the edge (load balancers and CDNs) and IPv4 internally until there is a reason to change.
In an interview
It appears as an edge-case check: "The load balancer is dual stack, so IPv6-only mobile clients connect natively; logs store addresses as text up to 45 characters; the per-client rate limiter keys IPv6 clients by /64, because a single user can rotate through billions of addresses in their prefix." That shows you have thought about what changes, not just that IPv6 exists.
Check yourself
An API rate-limits clients by source IP address. After enabling IPv6 on the load balancer, an abusive client evades the limit entirely. How?