Internet Protocol Version 6 (IPv6)

With the in­tro­duc­tion of IPv6, fun­da­men­tal processes of network com­mu­ni­ca­tion are changing. The expansion of address room from 32 to 128 bit not only coun­ter­acts the in­creas­ing shortage of IP addresses; the new standard also makes it possible to uniquely address all devices in a network. Unlike IPv4, version 6 con­sis­tent­ly im­ple­ments the basic idea of IP, the end-to-end principle. We will explain here how it all works.

IPv6 stands for “Internet Protocol Version 6” and rep­re­sents a stan­dard­ized process created by the Internet En­gi­neer­ing Task Force (IETF) for the trans­mis­sion of data packets in computer networks. IPv6, the directed successor of IPv4, together with around 500 other network protocols of the TCP/IP family, forms the basis for internet com­mu­ni­ca­tions. Central functions of IPv6 are the ad­dress­ing of network elements over so-called IPv6 addresses as well as routing, or the packet for­ward­ing between sub­net­works. For this purpose, IPv6 is based on the network layer (layer 3) of the OSI layer model.

The al­lo­ca­tion of IP addresses goes through so-called RIRs (Regional Internet Reg­istries), which are each assigned their own IP address ranges by the IANA (Internet Assigned Numbers Authority). The RIR re­spon­si­ble for Europe, the Middle East, and Central Asia is the RIPE NCC (Réseaux IP Européens Network Co­or­di­na­tion Centre).

Even at first glance, it is obvious that the new address format of the sixth IP version differs sig­nif­i­cant­ly from that of its pre­de­ces­sor IPv4.

• IPv4 address: 203.0.120.195

• IPv6 address: 2001:0620:0000:0000:0211:24FF:FE80:C12C

While the IPv4 uses 32-bit addresses, which are usually in decimal pre­sen­ta­tion, its successor IPv6 uses 128-bit addresses, which are displayed in hexa­dec­i­mal format for read­abil­i­ty reasons.  Direct com­par­i­son il­lus­trates the central concern, which is addressed by the new IP standard: With 128 bits, sig­nif­i­cant­ly more unique IP addresses can be generated than with 32 bits.

• Address range of IPv4: 32 bit = 2³² addresses ≈ 4.3 billion addresses

• Address range of IPv6: 128 bit = 2¹²⁸ addresses ≈ 340 sex­til­lion addresses

The dif­fer­ence in size is made clear by a com­par­i­son: While the address range of IPv4 with around 4.3 billion IPS is not even close to enough to provide every person in the world with a unique address, a 128-bit system can the­o­ret­i­cal­ly assign each grain of sand on earth several IP addresses of its own. The in­tro­duc­tion of IPv6 can therefore be viewed as an in­vest­ment in the future. Trends such as the Internet of Things (IoT) suggest that the number of devices that connect to the internet and need to be clearly iden­ti­fi­able will grow dras­ti­cal­ly in the coming years.

The 128 bits of an IPv6 address are divided into eight blocks of 16 bits each. In hexa­dec­i­mal notation, a 16-bit block can be recorded with four digits or letters. The colon acts as a sep­a­ra­tion element:

• 2001:0620:0000:0000:0211:24FF:C12C

In order to make the IPv6 address more man­age­able, a shorthand has been es­tab­lished where leading zeros within hexa­dec­i­mal blocks can be omitted. If a hexa­dec­i­mal block consists ex­clu­sive­ly of zeros, the last zero must be retained:

• 2001:0620:0000:0000:0211:24FF:FE80:C12C

• 2001:620:0:0:211:24FF:FE80:C12C

Once per IPv6 address, it is also possible to delete any con­sec­u­tive blocks of zeros.

• 2001:620:0:0:211:24FF:FE80:C12C

• 2001:620::211:24FF:FE80:C12C

The con­sec­u­tive colons (after the second block in the example above) indicate the omission.

In reality, internet users have far fewer addresses available than the 128-bit format suggests. The reason for this is the design principle of IPv6: unlike the previous version, the new standard is intended to allow for real end-to-end con­nec­tions and make the trans­la­tion of private to public IP addresses based on NAT (Network Address Trans­la­tion) un­nec­es­sary. In principle, end-to-end con­nec­tions should be possible with IPv4 as well; however, since the IPv4 address space is too small to provide each device with a unique address, a system with separate address areas and the mediating component NAT were developed. With the new standard, any device that is connected to a LAN can be addressed logically via its own IP. IPv6 addresses therefore contain, in addition to the section on network ad­dress­ing (also called network address or routing prefix), a unique interface iden­ti­fi­er which either results from the MAC address of the network card of the device or is generated manually. The routing prefix and the interface iden­ti­fi­er each comprise 64 bits of an IPv6 address.

The interface iden­ti­fi­er acts as a distinct marking of a par­tic­u­lar device which is connected to the network and is either assigned manually or generated based on the MAC address of the device’s network card. Typically it happens the second way, and is based on the con­ver­sion of the stan­dard­ized MAC address into the modified EUI-64 format. This happens in three steps:

• In the first step, the 48-bit MAC address is broken down into two 24-bit pieces. These pieces become the beginning and the end of the 64-bit interface iden­ti­fi­er.
  • MAC address: 00-11-24-80-C1-2C
  • Dis­as­sem­bled MAC address: 0011:24__:__80:C12C

• The second step assigns the remaining 16 bits in the middle by default to the bit sequence 1111 1111 1111 1110, which cor­re­sponds to the hexa­dec­i­mal code FFFE:
  • Completed MAC address: 0011:24FF:FE80:C12C
  • The MAC address is now in the modified EUI-64 format.

• In the third step, the seventh bit, also called the universal or local bit, is inverted. This specifies whether an address is globally unique or is only used locally.
  • Bit order before inversion: 0000 0000
  • Bit order after inversion: 0000 0010
   
  • Interface iden­ti­fi­er before inversion: 0011:24FF:FE80:C12C
  • Interface iden­ti­fi­er after inversion: 0211:24FF:FE80:C12C

An IPv6 address based on the modified EUI-64 format allows for con­clu­sions to be drawn from the un­der­ly­ing MAC address. Because this could cause privacy concerns for users, Privacy Ex­ten­sions developed a process that allows IPv6 to make an interface iden­ti­fi­er anonymous by removing the link between the MAC address and the interface iden­ti­fi­er. Instead, Privacy Ex­ten­sions generates a temporary interface iden­ti­fi­er for outbound con­nec­tions that is more or less random. This makes con­clu­sions about the host and the creation of movement profiles on the basis of the IP more difficult.

As with IPv4, IPv6 contains different address areas with special tasks and prop­er­ties. These are specified in RFC 4291 and RFC 5156 and can be already be iden­ti­fied by the first bits of an IPv6 address, the so-called format prefix. The central address types include unicast addresses, multicast addresses, and anycast addresses.

Unicast addresses are used to com­mu­ni­cate one network element with exactly one other element, and can be divided into two cat­e­gories: link local addresses and global unicast addresses.

• Link local addresses: Addresses in this category are only valid within local networks and begin with the format prefix FE80::/10. Local link addresses are used to address elements within a local network and are used, for example, for auto-con­fig­u­ra­tion. In general, the scope of a link local address extends to the next router, so that any device connected to the network is able to com­mu­ni­cate with it to generate a global IPv6 address. This process is called neighbor discovery.

• Global unicast addresses: Global unicast addresses are worldwide unique addresses that a network device needs in order to connect to the internet. The format prefix is usually 2000::/3 and includes all addresses that begin with 2000 to 3FFF. The global unicast address is routable and can be used to directly address a host in the local network over the internet. Global unicast addresses, which are re­dis­trib­uted from internet providers to end users, begin with the hexa­dec­i­mal block 2001.

While unicast addresses are used for one-to-one com­mu­ni­ca­tion, multicast addresses implement a one-to-many com­mu­ni­ca­tion. Along with this come dis­trib­u­tor addresses. Packages that are sent from a multicast address are received by all of the network devices that are part of the multicast group. One device can belong to multiple multicast groups. If an IPv6 address is created for a network device, then it is au­to­mat­i­cal­ly a member of certain multicast groups that are required for recog­ni­tion, ac­ces­si­bil­i­ty, and prefix detection. Common multicast groups, for example, are “all routers” or “all hosts”.  The format prefix for multicast addresses is generally FF00::/8.

Packages can also be sent to groups of receivers from anycast addresses. Unlike multicast addresses, though, data packages are not sent to all members of an anycast group, but only to the device closest to the sender. Anycast addresses are used primarily for load dis­tri­b­u­tion and failure safety purposes.

Every field in the IPv6 header contains certain in­for­ma­tion that is required for package transfer over IP networks:

The in­tro­duc­tion of extension headers makes it possible to implement optional in­for­ma­tion in IPv6 packages much more ef­fec­tive­ly than with IPv4. Because routers on the delivery path of a package neither check nor process IPv6 extension headers, these are usually only read at the des­ti­na­tion. This results in a sig­nif­i­cant im­prove­ment of router per­for­mance in com­par­i­son with IPv4, which required that optional in­for­ma­tion be examined by all routers along the delivery path. The in­for­ma­tion that could be included in IPv6 header ex­ten­sions includes node-to-node options, des­ti­na­tion options, routing options, and frag­men­ta­tion, au­then­ti­ca­tion, and en­cryp­tion options (IPsec).

Most internet users are connected with IPv6, mostly due to the expansion of the address space. However, the new standard also provides a number of features that can overcome the key lim­i­ta­tions of IPv4. Above all, this includes the con­sis­tent im­ple­men­ta­tion of the end-to-end principle, which makes the detour via NAT su­per­flu­ous, sim­pli­fy­ing the im­ple­men­ta­tion of security protocols such as IPsec.

Ad­di­tion­al­ly, IPv6 enables automatic address con­fig­u­ra­tion via neighbor discovery as well as allowing multiple unique IPv6 addresses per host with different scopes to map different network topolo­gies. In addition to the optimized address as­sign­ment, the sim­pli­fi­ca­tion of the package header and out­sourc­ing of optional in­for­ma­tion to header ex­ten­sions for package transfers ensures faster routing.

With QoS (Quality of Service), IPv6 has an in­te­grat­ed mechanism for the security of quality service which pri­or­i­tizes urgent packages and makes package handling more efficient. The fields “traffic class” and “flow label” have been directly tailor to the QoS method­ol­o­gy.

Critical to consider, though, is the as­sign­ment of static IP addresses to local network devices, as well as the practice of creating unique interface iden­ti­fiers based on MAC addresses. Privacy ex­ten­sions certainly created an al­ter­na­tive to the modified EUI-64 address format; however, because the prefix of an IPv6 address is also suf­fi­cient to create a user’s movement profile, a new prefix that is dy­nam­i­cal­ly assigned by the ISP for main­tain­ing anonymity on the internet would be desirable in addition to the privacy ex­ten­sions.