IPv6 Addressing Basics

An IPv6 address is a 128-bit number, four times the length of an IPv4 address. That size changes how networks are designed: instead of counting hosts and rationing addresses, you hand every network segment the same fixed-size /64 and plan in terms of how many segments you need. This article covers how addresses are written, how they are structured, which kinds exist, and how reverse DNS handles them.

How an IPv6 Address Is Written

The 128 bits are written as eight groups of four hexadecimal digits — 16 bits each — separated by colons:

Nobody writes it that way. RFC 5952 defines one canonical short form, produced by three rules:

1. Drop leading zeros in each group. 0db8 becomes db8, 0042 becomes 42, 0000 becomes 0.
2. Replace one run of zero groups with ::. Use it for the longest run of two or more zero groups — the first, if two runs tie — and only once per address.
3. Use lowercase hex. 2001:DB8::1 works, but 2001:db8::1 is the canonical form.

Two more notation rules come up in practice:

• Brackets in URLs. Colons clash with the port separator, so a literal address in a URL goes in square brackets: https://[2001:db8::1]:8443/.
• Zone index on link-local addresses. Because fe80:: exists on every interface, you name the interface after a percent sign: ping fe80::1%eth0.

The Structure: Prefix, Subnet, Interface

Prefix lengths work exactly as in IPv4 — /48 means the first 48 bits are fixed. What differs is that the layout is effectively standard. A typical global address splits into three parts:

• Site prefix — assigned to you by your ISP or regional registry.
• Subnet ID — the bits between your prefix and the /64 boundary. These are yours to number your network segments.
• Interface ID — the last 64 bits, identifying the host on its segment.

Why the host part is always 64 bits

SLAAC (stateless address autoconfiguration, RFC 4862) lets a host build its own address: the router advertises a /64 prefix and the host fills in the 64-bit interface ID. Make the subnet longer than /64 and SLAAC stops working — and Android, which does not do DHCPv6 address assignment, ends up with no IPv6 address at all. Treat /64 as the fixed size of every LAN, VLAN and Wi-Fi network. The exceptions are router-to-router links, which can use /127 (RFC 6164), and loopbacks, which use /128.

A /64 holds 2⁶⁴ addresses — about 18 quintillion. There is no point counting hosts, and no network or broadcast address to subtract. IPv6 has no broadcast at all: it uses multicast, such as ff02::1 for "all nodes on this link", and Neighbor Discovery replaces ARP.

Allocation Sizes and What They Give You

Because the subnet size is fixed, the question becomes how many /64s you have. Each extra bit of prefix you are given doubles the count:

Subnet on hex-digit boundaries

Each hex digit is 4 bits, so prefixes that are multiples of 4 — /48, /52, /56, /60, /64 — line up with whole digits and are easy to read. Within a /48, the fourth group is your subnet ID:

Matching the subnet ID to the VLAN number (:10:: for VLAN 10) is a common convention — it is hex, so it is really subnet 16, but people read it at a glance. Staying on 4-bit boundaries also matters for reverse DNS, as below.

Address Types at a Glance

The first few bits tell you what kind of address you are looking at. These are the ones you will meet:

Every interface holds several addresses at once: a link-local address, one or more global addresses, and on most desktops and phones a rotating temporary address (RFC 8981) used for outgoing connections so the stable one is not tracked across sites. Run ip -6 addr on Linux to see them.

ULA vs global addresses

A unique local address (RFC 4193) is fd followed by a 40-bit random Global ID, which gives you a /48 of your own, such as fd12:3456:789a::/48. The randomness is the point: if two companies merge, or two sites connect over a VPN, their ULA ranges almost certainly do not collide, unlike two networks that both chose 10.0.0.0/8. Do not pick fd00::/48 by hand.

Reverse DNS in ip6.arpa

IPv4 reverse DNS reverses the octets under in-addr.arpa. IPv6 does the same with every single hex digit — all 32 of them, zeros included — under ip6.arpa:

Reverse zones are delegated one hex digit at a time, so a /48 is one zone and a /56 is one zone, but a /50 is not — it would need four /52 zones. That is the practical reason to subnet on 4-bit boundaries. See What Is Reverse DNS? for how PTR records work, and the PTR setup guide for mail servers, where an IPv6 address without a PTR record is often rejected outright.

Common Mistakes

• Subnets longer than /64 for hosts. SLAAC stops working and Android devices lose IPv6 connectivity.
• Using two :: in one address. 2001::1::5 is invalid because the zero runs cannot be told apart.
• Forgetting the firewall. Hosts with global addresses are reachable directly. If IPv4 was protected by NAT, IPv6 needs an explicit inbound-deny rule.
• Publishing AAAA records for services that do not listen on IPv6. Clients prefer IPv6 and fall back slowly or not at all. Check with the IPv6 Readiness Test.
• Copying documentation addresses. 2001:db8::/32 appears in every example, including this one, and is never routed.

Frequently Asked Questions

1. Why does every IPv6 LAN use a /64?

Stateless address autoconfiguration (SLAAC, RFC 4862) builds each host's address from the network's 64-bit prefix plus a 64-bit interface identifier the host picks itself. On a longer prefix SLAAC simply does not work, and Android does not support DHCPv6 address assignment, so phones on such a network get no IPv6 address at all. RFC 7421 lists the other things that break. Use /64 for every segment with hosts; /127 is fine for router-to-router links (RFC 6164).

2. How big a block should I expect from my ISP?

A business or data-centre site is normally given a /48, which holds 65,536 /64 subnets. Home connections usually get a /56 (256 subnets) and sometimes a /60 (16). A provider that hands out a single /64 leaves you unable to create a second network segment without workarounds, which is why RIPE-690 recommends a /56 at minimum for residential customers.

3. When can I use :: in an address?

:: stands for one run of two or more all-zero groups, and it may appear only once — two of them would make the address ambiguous. By RFC 5952 it should replace the longest run, the first one if two runs are equally long, and it is not used for a single zero group: 2001:db8:0:1:1:1:1:1 keeps its :0:.

4. What is the difference between ULA and link-local addresses?

Both are private, but on different scales. Link-local addresses (fe80::/10) exist on every IPv6 interface automatically and only work on that one link — routers never forward them. Unique local addresses (fd00::/8 in practice) are routable across your whole organisation but not on the internet, similar to RFC 1918 space in IPv4. You choose a ULA prefix; link-local addresses configure themselves.

5. Does IPv6 need NAT?

No. There are enough global addresses for every device to have its own, so the usual design is globally routable addresses with a stateful firewall that blocks unsolicited inbound connections — the protection people associate with NAT actually comes from that firewall. NAT66 and NPTv6 (prefix translation) exist for special cases such as multihoming, but they are not the default.

6. How do I check whether my site or connection works over IPv6?

Look up the domain's AAAA records with DNS Lookup, then run the IPv6 Readiness Test, which checks the AAAA records, nameservers, mail servers and whether the web server actually answers over IPv6. For a single address, the Subnet Calculator shows its type, its /64 and its ip6.arpa reverse zone.

Related Articles

• CIDR Notation and Subnetting Explained
• What Is an AAAA Record?
• What Is Reverse DNS?
• How to Plan Subnets with VLSM
• Subnet Calculator