IPv6

IPv6 has unicast (delivered to one interface), multicast (delivered to every member of a group, ff00::/8) and anycast (delivered to the nearest of a set, using unicast-format addresses). Broadcast was dropped; scoped multicast groups such as all-nodes ff02::1 replace it.

IPv6 Neighbor Discovery (RFC 4861) replaces ARP: a host sends an ICMPv6 Neighbor Solicitation to the target's solicited-node multicast address, and the target answers with a unicast Neighbor Advertisement carrying its MAC. IPv6 has no broadcast.

IPv4 and IPv6 are separate protocols with different headers and address sizes, so neither stack can read the other's packets. Coexistence comes from dual stack (run both), tunnelling (carry IPv6 inside IPv4) or translation (NAT64 rewriting headers).

IPv6 widens addresses to 128 bits and moves work off routers: a fixed 40-byte header with extension headers, no header checksum, source-only fragmentation, multicast instead of broadcast, Neighbor Discovery instead of ARP, built-in autoconfiguration, and no NAT in its base design.

The high-order bits identify the type: ::1 is loopback, fe80::/10 (fe80 to febf) is link-local, fc00::/7 (fc or fd, in practice fd00::/8) is unique local, and 2000::/3 (first digit 2 or 3) is where global unicast is allocated today.

The IPv6 base header is always 40 bytes: Version, Traffic Class, Flow Label, Payload Length, Next Header and Hop Limit fill the first 8 bytes, and the 128-bit Source and Destination addresses fill the other 32.

Error detection moved to link-layer frame checks and to TCP, UDP and ICMPv6 checksums over a pseudo-header with both addresses. Fragmentation moved into a Fragment extension header that only the source adds; routers send Packet Too Big instead of splitting.

Under SLAAC (RFC 4862) the laptop forms a link-local address, proves it unique with duplicate address detection, solicits a Router Advertisement, then combines the advertised prefix with its own interface identifier; the advertising router becomes its default router.

DNS64 answers the phone's AAAA query with a synthetic address that embeds the server's IPv4 address in a NAT64 prefix such as 64:ff9b::/96; the stateful NAT64 translates packets to that address into IPv4 from a shared address pool.

RFC 4291 fixes a 64-bit interface ID for most unicast addresses, so a LAN subnet is /64. A site prefix holds 2 to the power (64 minus its length) of them: 65,536 in a /48, 256 in a /56.

Append the low-order 24 bits of the unicast or anycast address to ff02::1:ff00:0/104. Those bits come from the interface identifier, so normally only the node holding that address has joined the group.

RFC 6724's ordered rules run over the outgoing interface's addresses: match the destination's scope (link-local for link-scoped destinations, global for global ones), avoid deprecated addresses, then prefer the temporary over the stable address by default; longest matching prefix is the late tiebreaker.

A SLAAC host chooses the low 64 bits itself. Legacy modified EUI-64 copied the MAC address, making the host trackable across networks; RFC 8064 now recommends RFC 7217's stable hashed identifiers, often alongside RFC 8981's short-lived random temporary addresses.

In an IPv6 Router Advertisement, M says addresses are available from DHCPv6 and O says other settings such as DNS are; in each Prefix Information option, A permits SLAAC on that prefix and L says the prefix is on-link.

Happy Eyeballs v2 (RFC 8305) queries AAAA and A together, gives IPv6 a short head start, and then starts staggered connection attempts every ~250 ms across interleaved addresses, keeping the first that completes.

6in4 is a manually configured tunnel over IP protocol 41; 6to4 derives the tunnel endpoint from a 2002::/16 address and needs relays; Teredo puts IPv6 in UDP to cross NAT; ISATAP tunnels inside one site.

Address handling: 16-byte addresses and longer text forms, bracketed literals before a port, and binary rather than string comparison. Client identity: no NAT, but rotating temporary addresses, so limits key on prefixes. Outbound calls may switch to IPv6 by default.

IPv6 loopback ::1, the unspecified ::, link-local fe80::/10, unique local fc00::/7 and IPv4-mapped forms such as ::ffff:127.0.0.1 all bypass it. Parse the address to 128 bits, unwrap mapped IPv4, then test the IPv6 blocks.

An anycast address is a unicast-format address configured on several interfaces; routing delivers each packet to the nearest holder by its own metric. If routing changes mid-connection, later TCP segments can reach a holder with no state, which resets the connection.

Each IPv6 header ends its job by naming the next one in its Next Header byte, until a value names the upper layer. RFC 8200 recommends Hop-by-Hop, Destination Options, Routing, Fragment, AH, ESP, Destination Options, then the upper layer.

Hosts trust any on-link Router Advertisement, so a rogue one can become their default router, add prefixes and push DNS servers. RA Guard (RFC 6105) drops RAs at switch ports; SEND (RFC 3971) signs them but is rarely deployed.

Tunnels wrap IPv6 inside IPv4, so an IPv4 filter sees only protocol 41 or a UDP flow, never the inner IPv6 addresses and ports. Control means filtering those outer markers and giving IPv6 a policy of its own.

IPv6 gives each host globally routable addresses with no translation, so every socket listening on all addresses becomes reachable from the internet. The review must add an explicit default-deny stateful policy for IPv6 and matching host rules for both families.

IPv4 routers fragment oversized packets unless DF is set; IPv6 routers never do, so the sender alone must size packets from Packet Too Big feedback or probing. In return, every IPv6 link carries 1,280 bytes, a size that always fits.

Drop IPv6 extension headers only by deliberate per-type policy, as RFC 7045 requires: permit fragments and Destination Options, drop Routing type 0, limit transit Hop-by-Hop. A new design should use them only inside networks you control.

RFC 4193 gives each site a pseudo-random 40-bit Global ID after fd so two sites' prefixes almost never match. Everyone choosing fd00::/48 recreates the ambiguity of deprecated site-local: merged networks and VPNs collide and must renumber.

After ff come 4 flag bits (T=0 marks a permanent, IANA-assigned group) and 4 scope bits: 1 interface, 2 link, 5 site, 8 organization, e global. Routers must not forward multicast beyond its scope, so ff02 stays on-link.

The IPv6 Flow Label lets a source tag a flow so routers can recognise it from label and addresses, without parsing ports. RFC 6437: sources pick uniform-looking values or zero; forwarders leave non-zero labels alone and never hash on the label alone.

An IPv4 literal or IPv4-only socket never asks DNS, so DNS64 cannot help and the device has no IPv4 route. 464XLAT adds a stateless translator (CLAT) on the device that turns IPv4 into IPv6 for the network's stateful NAT64 (PLAT).