IPv4 has a fixed 32-bit address space. More efficient allocation and address sharing extended its life, but neither can create additional IPv4 addresses.

IPv6 removes that constraint with 128-bit addresses. The larger address space is its most visible change, though the protocol redesign goes further: IPv6 has a fixed-size base header, moves optional information into extension headers, avoids router-based fragmentation, replaces broadcast with multicast, and builds local discovery and automatic configuration into ICMPv6.

IPv6 is a separate network-layer protocol with its own packet format, address notation, configuration behavior, and operational requirements. IPv4 and IPv6 can run over the same application, host, and physical network, but they do not communicate directly without a coexistence mechanism.

The immediate problem was address exhaustion. IPv4 contains:

IPv6 contains:

IPv6 address planning still uses hierarchical allocations rather than handing out unrelated addresses from one flat pool. The scale makes it practical to give networks large, regular blocks while preserving room for aggregation and growth.

The redesign also removed several constraints from the IPv4 base header. IPv4 options can make header processing variable. IPv4 routers can fragment packets, which adds per-packet work and creates fragments that must later be reassembled. The IPv4 header checksum must be updated at every hop because the TTL changes.

IPv6 uses a fixed 40-byte base header. Optional features are carried in separate extension headers, routers do not fragment forwarded packets, and the base header has no checksum. The result is a cleaner forwarding format even though an IPv6 address is four times the size of an IPv4 address.

The larger address space solves the capacity problem. The packet and configuration changes make IPv6 a protocol redesign rather than an address-length extension.

An IPv6 address contains 128 bits, divided into eight 16-bit groups. Each group is written as four hexadecimal digits, and colons separate the groups.

A fully expanded address looks like this:

Each hexadecimal digit represents four bits. Four digits therefore represent one 16-bit group:

Hexadecimal keeps a 128-bit address readable. Writing the same value as decimal octets would require sixteen separate numbers.

Hexadecimal digits are case-insensitive, so DB8 and db8 represent the same bits. Canonical text output normally uses lowercase.

Fully expanded addresses are precise but cumbersome. IPv6 notation provides two compression rules.

First, leading zeroes can be removed from each 16-bit group:

At least one digit remains in every displayed group. The group 0000 becomes 0, and 0100 becomes 100.

Second, one consecutive run of all-zero groups can be replaced with :::

The double colon can appear only once in an address. If it appeared twice, a parser could not determine how many zero groups each occurrence represented.

To expand 2001:db8:42:100::17, count the visible groups. Four appear before :: and one appears after it, leaving three zero groups to restore:

Several text forms can represent the same address. These are equivalent:

Canonical formatting compresses the longest run of zero groups and removes leading zeroes. Applications should still parse valid alternative forms and compare the resulting 128-bit values. Raw string comparison can treat equivalent addresses as different keys, allow-list entries, or log identities.

Two highly compressed addresses appear frequently:

The first is the unspecified address. The second is loopback.

IPv6 uses the same slash notation as modern IPv4 addressing. The number after the slash states how many leading bits form the prefix:

Here, the first 64 bits identify the subnet prefix and the remaining 64 bits identify an address within that subnet.

A /64 contains:

That size is deliberate. Stateless address autoconfiguration on an ordinary LAN relies on a 64-bit interface identifier. The large per-subnet space also makes random address generation and duplicate avoidance practical.

Not every IPv6 prefix is /64. Providers and organizations can receive shorter prefixes containing many subnets. Point-to-point links and individual routes can use other lengths. /64 is the standard expectation for a conventional LAN, not a rule that every IPv6 prefix in every context has the same size.

IPv6 has no broadcast address at the end of a subnet. Address planning still reserves certain values for protocol roles, so the absence of broadcast should not be interpreted as permission to assign every mathematical value without checking its defined use.

IPv6 addresses carry a scope: the part of the network in which the address has meaning. An interface normally has more than one IPv6 address because local-link and wider communication use different scopes.

The table lists common ranges rather than every special-purpose allocation.

Unspecified and Loopback

:: is the all-zero unspecified address. A host can use it before it has selected a usable source address. A server binding to :: usually requests all local IPv6 interfaces.

As with IPv4 wildcard binding, operating-system socket settings matter. On some systems, one IPv6 wildcard socket also accepts IPv4 connections as IPv4-mapped addresses. On others, or when the IPV6_V6ONLY option is enabled, it accepts only IPv6. Portable servers configure this behavior explicitly.

::1 is the IPv6 loopback address. Traffic to it remains inside the local network stack:

A process listening only on ::1 is not reachable through a physical network interface. A container or virtual machine has its own loopback context, so its ::1 does not refer to the host's loopback interface.

Link-Local Unicast

Link-local addresses come from fe80::/10. An IPv6-enabled interface normally creates a link-local address even when it has no global or unique local address.

These addresses support communication with neighbors and local routers. Routers do not forward them beyond the link.

The same link-local address can exist on several interfaces, so software sometimes needs a zone identifier to name the intended link:

The %enp0s3 suffix is local API notation, not part of the 128-bit address transmitted in the packet. Windows often uses a numeric interface index such as %12.

Global Unicast

Global unicast addresses provide globally coordinated IPv6 delivery. Most allocated global unicast prefixes come from 2000::/3.

A global address is eligible for routing beyond the local network, but its presence does not guarantee Internet reachability. The network still needs an advertised route, firewall permission, and a listening service.

Examples should use the documentation block 2001:db8::/32:

Documentation addresses should not be assigned to public services.

Unique Local Unicast

Unique local addresses, or ULAs, come from fc00::/7. Locally generated ULA prefixes normally begin with fd.

A network can use ULAs for internal communication without obtaining a public prefix. A randomly generated prefix reduces the chance of collision when two private networks later connect, though it cannot mathematically guarantee uniqueness.

ULAs are not intended for global Internet routing. They differ from IPv4 private addresses in allocation structure and expected prefix generation, but both provide addresses for communication inside controlled network scopes.

ULA does not mean encrypted or trusted. Firewalls, authentication, and encryption remain separate controls.

IPv6 does not define broadcast. It uses multicast groups for one-to-many control traffic, limiting delivery to interfaces interested in a defined group.

All IPv6 multicast addresses begin with ff. The address also encodes a scope that constrains how far the packet can travel.

Two link-local groups are especially common:

Neighbor discovery uses more selective solicited-node multicast groups rather than sending every address-resolution request to every interface. A network interface can filter multicast groups in hardware or software, reducing unnecessary processing compared with a general broadcast.

Multicast is still one-to-many traffic and can be abused or misconfigured. Replacing broadcast narrows the intended receiver set; it does not make control traffic costless.

With anycast, the same unicast address is assigned to interfaces in more than one location. Routing directs a packet toward one of them, typically the instance selected by the routing policy as closest.

IPv6 does not reserve a visual prefix that marks an address as anycast. The same address syntax can represent ordinary unicast or anycast use. The network configuration determines the behavior.

Anycast is useful for replicated infrastructure such as DNS services and globally distributed entry points. “Closest” refers to the selected network path, not necessarily geographic distance or lowest application latency.

Because separate packets can be routed to different instances as paths change, applications using anycast must consider how they maintain connection and session state. The address alone does not guarantee that every new flow reaches the same physical server.

An IPv6 interface commonly holds several addresses at once:

The link-local address supports local control traffic. A stable address can provide a predictable endpoint for inbound connections. A temporary address can be selected for outbound client traffic to make long-term tracking by one fixed interface identifier harder.

Temporary addresses do not provide anonymity. The network prefix still identifies the originating network, and application credentials, cookies, traffic timing, and logs can correlate activity.

The operating system applies source-address selection rules when several addresses are available. It considers destination scope, prefix similarity, address state, policy, and other factors. A connection can fail when the destination is reachable but the selected source address has no valid return path or is blocked by policy.

An IPv6 address also has a lifetime. A preferred address is available for new connections. A deprecated address remains valid for existing communication but should not be selected for new connections. This allows a host to change prefixes or temporary addresses without immediately breaking every active flow.

The IPv6 base header is always 40 bytes:

Version contains 6.

Traffic Class carries traffic classification information comparable to the corresponding IPv4 field.

Flow Label can identify packets belonging to a flow that may benefit from consistent handling.

Payload Length gives the number of bytes after the 40-byte base header for an ordinary packet.

Next Header identifies either an extension header or the upper-layer protocol carried next. This creates a chain rather than placing every optional field in the base header.

Hop Limit is decreased by each forwarding router. A router discards the packet when the value reaches zero. It serves the same packet-lifetime purpose as IPv4 TTL.

Source Address and Destination Address each occupy 16 bytes.

The base header omits an IPv4-style header checksum. Link-layer integrity checks and upper-layer checks still protect their respective data, while routers avoid recalculating an IP header checksum after changing the Hop Limit.

IPv6 places optional network-layer information in extension headers between the base header and the upper-layer payload.

The Next Header value in each header identifies what follows. Common extensions support hop-by-hop options, destination options, routing information, fragmentation, and IP-layer security.

Routers do not fragment an IPv6 packet to fit a smaller outgoing link. The source is responsible for sending packets that fit the path. If fragmentation is required, the source adds a Fragment extension header.

IPv6 requires support for a minimum MTU of 1280 bytes. Path MTU information is therefore operationally important. Blocking the ICMPv6 error messages that report an oversized packet can produce connections that begin successfully but stall when larger packets are sent.

Extension headers keep the common base header fixed, but they also require careful handling by firewalls, load balancers, and packet analyzers. A device must walk the header chain far enough to find the upper-layer protocol without accepting malformed or excessively complex chains.

IPv6 does not use ARP. Neighbor Discovery, carried through ICMPv6, handles local address resolution and several related tasks.

Neighbor Discovery messages let a host:

A host normally begins by creating a link-local address and checking it with Duplicate Address Detection, or DAD. It then listens for Router Advertisements.

A router advertisement can identify the local prefix, advertise itself as a default router, provide lifetime information, and indicate how hosts should obtain additional configuration.

With Stateless Address Autoconfiguration, or SLAAC, the host combines an advertised prefix with an interface identifier to form an address. Modern systems can generate stable or temporary identifiers without embedding the interface's MAC address.

Networks can also use DHCPv6 for managed address assignment or other configuration. Hosts still learn default routers from Router Advertisements, including on networks that use DHCPv6.

ICMPv6 is therefore part of normal IPv6 operation. A firewall rule that blocks all ICMPv6 can break address configuration, neighbor discovery, error reporting, and path MTU handling.

DNS uses an AAAA record to map a hostname to an IPv6 address. An A record maps the same or another hostname to IPv4.

A hostname can publish both:

Clients with both protocols available choose an address according to local policy and observed connectivity. Many clients stagger or race IPv6 and IPv4 attempts so that a broken path for one protocol does not impose a long delay.

An IPv6 literal in a URL must be enclosed in square brackets because colons already separate address groups:

Without brackets, a parser cannot reliably separate the address from the port. The brackets belong to URI syntax; they are not part of the IPv6 address.

Server and database schemas must allow 128-bit addresses. A field sized for the longest IPv4 string cannot hold IPv6. Prefer a native IP-address type or a 16-byte binary representation when the platform provides one. Text storage should normalize values for display while comparing parsed binary addresses.

Some socket APIs report an IPv4 peer using an IPv4-mapped IPv6 value:

This representation often appears when one IPv6 listening socket accepts an IPv4 connection. It does not prove that an IPv6 packet crossed the network or that protocol translation occurred.

Allow lists, rate limits, logs, and identity systems must handle both address families. Treating textual spellings as identities can let one IPv6 endpoint appear under several compressed or expanded forms.

IPv6 packets are not backward-compatible with IPv4-only hosts and routers. Deployment therefore uses three broad coexistence patterns.

Dual stack runs IPv4 and IPv6 together. Applications can listen on both families, DNS can publish A and AAAA records, and clients select a working path.

Tunneling carries one protocol inside another across a network that does not support it natively. The extra encapsulation changes packet size and adds tunnel endpoints that must be monitored.

Translation converts between IPv6-only and IPv4-only communication at a boundary. Translation helps connect unequal address families but cannot make every protocol or embedded address literal work automatically.

Dual-stack systems have two network paths that can fail independently. Successful IPv4 health checks do not prove that IPv6 DNS, routing, filtering, and listening sockets work. A complete rollout tests both families from clients that can use them.

Hard-coded IPv4 literals also prevent protocol selection. Hostnames let DNS and connection logic choose between address families as deployments change.

IPv6 restores abundant end-to-end addressing, but a globally scoped address does not require a host to accept unsolicited traffic. Stateful firewalls can permit return traffic for outbound connections while denying unexpected inbound connections.

Address abundance also makes sequential scanning of an entire /64 impractical, but it is not an access-control mechanism. Attackers can discover addresses through DNS, logs, application responses, predictable assignments, local discovery, and other observations.

IPv6 supports IPsec, as IPv4 does, but ordinary IPv6 traffic is not encrypted merely because it uses IPv6. Applications still need protocols such as TLS when confidentiality and peer authentication are required.

Privacy addresses rotate an interface identifier; they do not hide the network prefix or application identity. ULAs provide local scope; they do not authenticate insiders. Every address type still relies on explicit security policy.

Dual-stack networks must enforce comparable policy for both protocols. An application protected by an IPv4 firewall rule can remain reachable over IPv6 if the equivalent IPv6 rule is missing. Monitoring and asset inventories also need to collect both families.

Linux displays IPv6 addresses with:

An interface can show several entries:

The first two share a global prefix but have different interface identifiers and address roles. The third is restricted to the local link.

On macOS, inspect IPv6 entries with:

On Windows, use:

Query a hostname's IPv6 records with:

Test an IPv6 HTTP path with:

Replace api.example.com with the service under test; the example name is illustrative. The command succeeds only when DNS returns a usable AAAA record, the client has IPv6 connectivity, the path is routed, filtering permits it, and the service listens on IPv6.

Capture IPv6 packets on the active interface with:

Replace en0 with the local interface name. Add icmp6 to focus on neighbor discovery, router advertisements, and IPv6 error messages:

Link-local testing must specify the interface when the destination is ambiguous:

Some operating systems use ping6 instead of ping -6. The zone identifier ensures that the kernel sends the packet on the intended local link.

A hostname has an AAAA record, but the service times out over IPv6. DNS publication alone does not establish connectivity. Check the client's IPv6 address, route, firewall policy, server listener, and return path.

The server accepts IPv4 but refuses IPv6. The process may be bound only to an IPv4 address, or an IPv6 wildcard socket may be configured as IPv6-only when the deployment expected dual-family behavior.

A link-local address works on one command but fails in an application. The application may have omitted the zone identifier or used the wrong interface index.

Small requests work while large responses stall. Overly broad ICMPv6 filtering can hide path MTU errors. The connection setup can succeed before a larger packet exposes the problem.

An allow list contains an expanded address but misses its compressed form. Compare parsed 128-bit values or normalized address objects rather than raw strings.

Outbound connections use changing source addresses. Temporary privacy addresses may rotate. Policies that expect one permanent client address need a more stable identity.

localhost behaves differently across machines. It can resolve to ::1, 127.0.0.1, or both. The client, server, and socket configuration determine which family succeeds.

IPv4 monitoring is healthy while some users still fail. IPv6 follows separate DNS, routing, firewall, and service-listener state. Test both paths explicitly.

IPv6 is more than a larger IPv4 address. It has a different base header, extension mechanism, fragmentation behavior, discovery protocol, and configuration model.

One :: can compress several zero groups. It can appear only once because the full address must expand to exactly eight groups.

Leading zeroes and zero groups follow different rules. Leading zeroes can be removed within every group; :: replaces one consecutive run of complete zero groups.

A /64 is common, not universal. Ordinary IPv6 LANs normally use /64, while allocations, point-to-point links, and individual routes can use other prefix lengths.

IPv6 has no broadcast. Multicast groups provide the required one-to-many behavior with defined receiver sets and scopes.

A global IPv6 address is not automatically exposed. Reachability still depends on routing, firewall policy, and a listening service.

IPv6 does not make traffic encrypted. IPsec support and actual use of authenticated encryption are separate facts.

IPv6 does not use ARP. ICMPv6 Neighbor Discovery resolves local neighbors and supports router and prefix discovery.

Blocking all ICMPv6 is harmful. Neighbor discovery, router advertisements, error reporting, and path MTU handling depend on it.

::ffff:192.0.2.128 can be an API representation. Its appearance does not prove that an IPv6 packet or a translation gateway was involved.

IPv4 and IPv6 do not communicate directly. Dual stack gives an endpoint both protocols; tunneling and translation solve different coexistence problems.

IPv6 expands network addresses to 128 bits. Its eight hexadecimal groups allow leading-zero and one-run compression, and prefixes still identify common leading bits; /64 is standard for an ordinary LAN.

Global, unique local, link-local, loopback, unspecified, multicast, and IPv4-mapped addresses have different scopes and API roles. IPv6 replaces broadcast with multicast, supports anycast through ordinary unicast syntax, and commonly gives one interface link-local, stable, and temporary addresses.

The fixed 40-byte base header uses extension headers and leaves fragmentation to the source. ICMPv6 Neighbor Discovery replaces ARP while providing router discovery, address resolution, duplicate detection, and automatic configuration. Applications must handle AAAA records, bracketed URL literals, 128-bit storage, and explicit socket behavior.

Dual stack, tunneling, and translation support coexistence with IPv4. IPv6 provides address capacity, but not automatic reachability, encryption, identity, or security policy.

IPv6 operation depends on address scope, multiple addresses per interface, ICMPv6 control traffic, and correct application support.