6.3 IPv6 Fundamentals

IPv4's 32-bit space is exhausted for practical global allocation. IPv6 expands the address to 128 bits, providing an enormous pool and simplifying some addressing patterns. The Cyber Test expects you to read IPv6 notation, apply compression rules, and recognize major address types — not design an enterprise dual-stack rollout.

Address Length and Written Form

• Length: 128 bits
• Grouping: eight hextets (16-bit groups)
• Alphabet: hexadecimal digits 0–9 and a–f (case-insensitive)
• Separator: colon (:), not a dot

Fully written example:

2001:0db8:0000:0000:0000:0000:0000:0001

That is one address. Writing every leading zero every time is painful, so IPv6 defines shortening rules.

---

Compression Rules (Must Memorize)

Rule 1 — Drop leading zeros in a hextet

2001:0db8:0000:0042:0000:8a2e:0370:7334

becomes

2001:db8:0:42:0:8a2e:370:7334

You may remove leading zeros inside each hextet, but you must leave at least one digit (0 stays as 0, not empty).

Rule 2 — Replace one contiguous run of all-zero hextets with ::

The longest consecutive sequence of 0 hextets can be replaced by :: — and you may do this only once in an address. Using :: twice would make the length ambiguous.

Full: 2001:0db8:0000:0000:0000:0000:0000:0001

Compressed: 2001:db8::1

Another example:

fe80:0000:0000:0000:0202:b3ff:fe1e:8329 → fe80::202:b3ff:fe1e:8329

Ambiguity trap

Invalid (two compressions): 2001::db8::1

Valid choice when multiple zero runs exist: compress the longest run. If two runs are equal length, convention prefers the leftmost run (be consistent with RFC 5952 style thinking for exam purposes: one :: only).

Mixed IPv4 embedding (awareness)

You may see forms like ::ffff:192.0.2.1 for IPv4-mapped IPv6 addresses. Know that IPv6 can represent transition cases; focus first on pure hex colon notation.

---

Prefix Lengths and the /64 Habit

Like IPv4 CIDR, IPv6 uses prefix length after a slash:

2001:db8:abcd:0012::/64

Common meanings:

On most Ethernet LANs, the first 64 bits identify the subnet and the last 64 bits are the interface identifier (often derived from MAC via EUI-64, or randomly assigned for privacy).

---

Major IPv6 Address Types

IPv6 does not use broadcast. Traffic models are:

Global unicast

Globally routable addresses, commonly in 2000::/3 (addresses starting with 2 or 3 in the first hextet). Documentation space 2001:db8::/32 appears in textbooks and examples — treat it like IPv4's 192.0.2.0/24 documentation range.

Link-local

Every IPv6 interface autoconfigures a link-local address in fe80::/10 (you will usually see addresses starting with fe80:). Link-local traffic does not route off the local link. Neighbor Discovery uses link-local heavily (IPv6's replacement for much of IPv4 ARP behavior).

Unique local (ULA)

Private-like site-local addressing for IPv6 often uses fc00::/7, with locally assigned addresses commonly appearing as fd00::/8. These are not meant for global Internet routing — analogous in spirit to RFC 1918, though the rules and allocation differ.

Loopback and unspecified

Multicast quick ID

If the address begins with ff, think multicast. Example well-known idea: all-nodes link-local multicast ff02::1.

---

Side-by-Side: IPv4 vs IPv6

---

Worked Notation Drill

Expand and compress practice:

1. Compressed: 2001:db8::8a2e:370:7334
2. One valid expanded form: 2001:0db8:0000:0000:0000:8a2e:0370:7334
3. Count hextets: left of :: has 2 (2001, db8); right has 3 (8a2e, 370, 7334); zeros fill the middle to total 8 hextets

Identify type quickly:

• fe80::1 → link-local unicast
• ff02::1 → multicast
• ::1 → loopback
• 2001:db8:1:2::10 → documentation/global-unicast style example on a /64-ish subnet

---

Why Cyber Operators Care

Modern DoD and commercial networks dual-stack or migrate toward IPv6. Packet filters written only for IPv4 miss IPv6 paths. Link-local and multicast addresses appear constantly in Neighbor Discovery traffic. If you only memorize IPv4 private ranges and ignore fe80:: and ff00::/8, you will misread captures.

Neighbor Discovery vs ARP (awareness)

IPv4 uses ARP to map IP addresses to MAC addresses. IPv6 replaces that role with Neighbor Discovery Protocol (NDP) messages carried over ICMPv6, typically using link-local and multicast addresses. You do not need full NDP message formats for the Cyber Test, but you should expect that IPv6 local resolution looks different in a packet capture: look for fe80:: sources and ff02:: multicast destinations instead of Ethernet broadcasts of who-has ARP.

Dual-stack reality check

Many hosts run dual stack — both IPv4 and IPv6. A firewall that allows only IPv4 rules may still leave an IPv6 path open. When troubleshooting "the host is blocked," confirm which protocol family the application actually used. Aptitude questions may simply ask which protocol is longer, which address is link-local, or which compressed form is legal; operational awareness helps you eliminate distractors that mix IPv4 and IPv6 concepts.

Study focus for the Cyber Test

1. State 128-bit length and eight hextets.
2. Apply leading-zero and single :: compression correctly.
3. Recognize fe80::/10, ::1, ff00::/8, and documentation 2001:db8::/32.
4. Remember no broadcast and the default /64 LAN prefix habit.

Master those four themes and most IPv6 aptitude items become recognition problems rather than deep protocol engineering.