Describe IPv6 address types

IPv6 defines several address types by their leading bits. Learn the prefixes cold; the exam shows an address and asks what type it is.

There is no broadcast in IPv6. Anything IPv4 did with broadcast (ARP, DHCP discovery, “all hosts” messages) IPv6 does with multicast.

1.9.a Unicast (global, unique local, and link local)

A unicast address identifies a single interface; a packet sent to it is delivered to that one interface. IPv6 has three unicast scopes.

Global unicast addresses (GUA) are the IPv6 equivalent of public IPv4 addresses: globally unique and routable on the Internet. They come from the 2000::/3 block, which means the first three bits are 001 and therefore the first hex digit is 2 or 3. 2001:db8::/32 within this range is set aside for documentation. The IANA allocates blocks to regional registries, which allocate to ISPs, which assign /48 or /56 prefixes to customers. Because addresses are so plentiful, every host on a modern IPv6 network normally has a global address and no NAT is involved.

Unique local addresses (ULA) are the IPv6 counterpart to RFC 1918 private addresses: usable within an organization but never routed on the Internet. The block is fc00::/7, covering fc00:: through fdff::. The eighth bit is the “L” (local) flag; RFC 4193 says it must be set to 1, so in practice all ULAs start with fd and the usable block is effectively fd00::/8. The next 40 bits are a randomly generated global ID, which makes accidental overlap between two organizations extremely unlikely (unlike 10.0.0.0/8 in IPv4, where every merger brings address conflicts). A ULA looks like fd12:3456:789a:1::1.

Link-local addresses (LLA) exist on every IPv6-enabled interface, automatically, whether or not any other address is configured. They come from fe80::/10, which technically spans fe80:: to febf::, but the standard requires the next 54 bits to be zero, so real link-local addresses are always fe80::/64 followed by an interface ID (EUI-64 or random). A link-local address is valid only on the local link; routers never forward packets with link-local sources or destinations, and the same link-local address can legitimately be reused on every link. Link-local addresses are used for neighbor discovery, for routing protocol messages between adjacent routers (OSPFv3 neighbors and next hops are link-local), and as the default gateway that hosts learn from Router Advertisements.

1.9.b Anycast

An anycast address is a unicast address assigned to more than one interface, typically on different devices in different locations. The routing system delivers a packet sent to an anycast address to the nearest one of those interfaces (nearest by routing metric). Anycast addresses have no special prefix; they are ordinary global unicast addresses that happen to be configured in several places, and a device must be told that an address is anycast so it does not perform duplicate address detection on it. Anycast is used for services that should be served from the closest instance: DNS root servers, content delivery networks, and redundant default gateways.

R1(config)# interface gigabitethernet 0/0
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
! The same anycast address is also configured on R2 and R3
R1(config-if)# ipv6 address 2001:db8:acad::99/64 anycast

IPv4 also uses anycast (root DNS servers, 8.8.8.8), but IPv6 formalized it in the addressing architecture.

1.9.c Multicast

A multicast address identifies a group of interfaces; a packet sent to it is delivered to every member of the group. All IPv6 multicast addresses start with ff (prefix ff00::/8). The second hextet-half encodes flags and scope: the fourth hex digit is the scope, and the values you will see are:

The well-known link-local multicast groups are heavily tested:

Compare these with IPv4: 224.0.0.1 all hosts, 224.0.0.2 all routers, 224.0.0.5 and 224.0.0.6 for OSPFv2, 224.0.0.9 RIPv2, 224.0.0.10 EIGRP. The last digits match.

Solicited-node multicast is a special group that replaces ARP’s broadcast. For every unicast address an interface has, it automatically joins the solicited-node group formed by taking the fixed prefix ff02::1:ff00:0/104 and appending the last 24 bits (the last six hex digits) of the unicast address.

Worked example: for the address 2001:db8:acad:1:20c:29ff:fe12:3456, the last 24 bits are 12:3456 (the last six hex digits 123456). The solicited-node address is therefore ff02::1:ff12:3456. For 2001:db8:acad:1::1, the last six hex digits are 000001, giving ff02::1:ff00:1. That is exactly what appeared in the show ipv6 interface output in section 1.8.

Why it exists: when a host needs the MAC address of 2001:db8:acad:1::1, it sends a Neighbor Solicitation to ff02::1:ff00:1 rather than to all nodes. Only interfaces whose addresses end in those 24 bits (almost always just the one target) process it; every other host’s NIC filters it out in hardware. In IPv4, every host on the LAN has to process every ARP broadcast.

At Layer 2, an IPv6 multicast address maps to an Ethernet MAC address that begins with 33:33 followed by the last 32 bits of the IPv6 address. ff02::1:ff12:3456 becomes MAC 3333.ff12.3456.

1.9.d Modified EUI-64

The 64-bit interface ID of an IPv6 address can be typed manually, generated randomly (the default on Windows and most modern operating systems for privacy), or derived from the interface’s 48-bit MAC address using the modified EUI-64 procedure. Cisco routers use EUI-64 for link-local addresses by default and for global addresses when the eui-64 keyword is given. The exam expects you to perform the calculation.

The procedure:

1. Take the 48-bit MAC address and split it into two 24-bit halves.
2. Insert the 16-bit value fffe between the halves. This yields 64 bits.
3. Flip the 7th bit of the first byte (counting from the left, bit 7 of 8). This is the U/L (universal/local) bit from section 1.1. In a burned-in MAC it is 0; EUI-64 inverts it, so a burned-in MAC produces a 1 here. The effect on the first byte is to add or subtract 2 in hex.

Worked example: MAC 00:1a:2b:3c:4d:5e.

• Step 1: split into 00 1a 2b and 3c 4d 5e.
• Step 2: insert ff fe: 00 1a 2b ff fe 3c 4d 5e.
• Step 3: first byte 00 in binary is 0000 0000. Bits numbered from the left are 1 through 8; the 7th bit is the second from the right. Flipping it gives 0000 0010, which is 02.
• Result interface ID: 021a:2bff:fe3c:4d5e.
• With the prefix 2001:db8:acad:1::/64, the address is 2001:db8:acad:1:21a:2bff:fe3c:4d5e (leading zero dropped from 021a).
• The link-local address is fe80::21a:2bff:fe3c:4d5e.

Second example: MAC 0c:2f:b0:12:34:56. First byte 0c is 0000 1100. Flipping the 7th bit gives 0000 1110, which is 0e. Interface ID: 0e2f:b0ff:fe12:3456, written e2f:b0ff:fe12:3456 in an address.

Third example (reverse): interface ID 1a:2bff:fe3c:4d5e came from which MAC? Expand to 021a:2bff:fe3c:4d5e, remove fffe from the middle: 02 1a 2b 3c 4d 5e. Flip bit 7 of 02 (0000 0010 becomes 0000 0000): 00. MAC: 00:1a:2b:3c:4d:5e.

The quick trick for the first byte: converting the second hex digit of the first byte, add 2 if it is 0, 1, 4, 5, 8, 9, c, or d; subtract 2 if it is 2, 3, 6, 7, a, b, e, or f. Then look for ff:fe in the middle of any IPv6 interface ID; it is the giveaway that EUI-64 was used.

SLAAC and Neighbor Discovery (NDP)

IPv6 hosts can configure themselves without a DHCP server using SLAAC (Stateless Address Autoconfiguration), which relies on the Neighbor Discovery Protocol (NDP), a set of five ICMPv6 message types:

The SLAAC process on a host:

1. The host generates its link-local address (fe80:: plus EUI-64 or a random interface ID) and performs Duplicate Address Detection (DAD) by sending an NS for its own address from source ::. If no NA comes back, the address is unique.
2. The host sends an RS to ff02::2.
3. The router replies with an RA containing the /64 prefix (for example 2001:db8:acad:1::/64). The RA’s source address is the router’s link-local address, which the host installs as its default gateway.
4. The host appends its interface ID to the prefix to form its global address, runs DAD again, and is ready.

Flags in the RA tell the host what else to do: the M (managed) flag says “get your address from a stateful DHCPv6 server”; the O (other) flag says “use SLAAC for the address but ask DHCPv6 for DNS and other options.” Cisco routers send RAs only when ipv6 unicast-routing is enabled.

NDP also maintains the neighbor cache (show ipv6 neighbors), which lists IPv6-to-MAC mappings with states such as REACH, STALE, and INCMP, replacing the IPv4 ARP table.