Chapter 10 · IPv6The student-friendly guide + hands-on Kali labs

Chapter 10 · The student-friendly guide

IPv6

We ran out of IPv4 addresses. IPv6 replaces 32-bit addresses with 128-bit ones — a fresh header, a colon-hex notation, and new address types built for a world of billions of devices.

128-bit addressesThe IPv6 header Extension headersUnicast · Multicast · Anycast

Use ← → arrow keys, the dots below, or the ☰ menu to navigate. Switch to the Lab Guide up top.

The big picture

Four things to master

🌍
1

Why IPv6

IPv4 ran out — a bigger address space was essential.

🧱
2

The header

Fixed 40-byte header, streamlined vs IPv4.

🧩
3

Extension headers

Optional functions chained after the base header.

🏷️
4

Address types

Unicast, multicast, anycast; GUA & link-local.

Part 1 · Why IPv6

Why we needed a bigger address space

👥

More users

~320 M Internet users in 2000 → ~5.35 B in 2024 (≈66% of the planet).

📱

More devices

405 M mobile phones in 2000 → over 17.2 B in 2024, plus billions of IoT “appliances.”

🚪

Always-on

Every device wants its own permanent, reachable address.

⚠️
IPv4 has only 2³² ≈ 4.3 billion addresses — fewer than there are people, let alone devices. IPv6 fixes this permanently.

Part 1 · Why IPv6

128 bits: how big is that?

2128 =
340,282,366,920,938,463,463,374,607,431,768,211,456
≈ 340 undecillion addresses — about 340 billion billion billion billion.
💡
Put it this way… that’s enough to give every grain of sand on Earth its own huge network. Fixed-length 128-bit addresses were chosen to balance vast space with efficient CPU processing and low header overhead.

Part 1 · Why IPv6

What the huge space buys us

🏗️

Hierarchy

Room for many levels of structure & route aggregation.

🔧

Auto-config

Devices can configure their own address (SLAAC).

🗂️

Easier mgmt

Simpler address management & delegation than IPv4.

🔒

End-to-end

NAT no longer needed → end-to-end IPsec is possible.

📌
Full circle: Chapter 5’s NAT existed because IPv4 addresses were scarce. With IPv6, every device can have a real global address — NAT becomes unnecessary.

Part 2 · The header

The IPv6 header: fixed 40 bytes, 8 fields

FieldJob
VersionAlways 6 (0110)
Traffic ClassPriority / QoS (like IPv4 TOS)
Flow LabelMarks a flow needing special handling
Payload LengthSize of payload + extension headers
Next HeaderType of the following header
Hop LimitDecrement per hop (was TTL)

Two 128-bit addresses

The Source and Destination addresses are 16 bytes each — together they’re 32 of the header’s 40 bytes.

4 + 4 + 16 + 16 = 40 bytes

Part 2 · The header

What changed from the IPv4 header

Streamlined

No header checksum · no fragmentation fields in the base header · no options · no header-length field · fixed size.

Revised

TTL → Hop Limit
Protocol → Next Header
TOS → Traffic Class
32-bit → 128-bit addresses

Extended

A new Flow Label field was added for flow-based handling.

🧠
The theme: IPv6 moved everything optional out of the base header (into extension headers) so routers can process the fixed 40-byte header fast.

Part 2 · The header

Extension headers & the Next-Header chain

Chaining

The Next Header field points to what comes next — another header type. Optional functions become extension headers chained after the base header, each pointing to the next.

Order (RFC 2460)

Hop-by-Hop → Destination → Routing → Fragment → Authentication → ESP → Destination

IPv6 base
Next=Routing
Routing
Next=TCP
TCP data

Self-Test #1

Why IPv6 & the header

Tap a green answer to reveal it.

Q How many bits is an IPv6 address, and how many total addresses does that give?
A 128 bits → 2¹²⁸ ≈ 340 undecillion addresses.
Q Which IPv4 fields were removed from the IPv6 base header?
A Header checksum, header length, options, and the in-base fragmentation fields.
Q What replaced IPv4’s TTL and Protocol fields?
A Hop Limit (TTL) and Next Header (Protocol).
Q How big is the fixed IPv6 base header?
A 40 bytes (8 fields, including two 16-byte addresses).

Part 3 · Addresses

Writing an IPv6 address

2001:0718:1c01:0016:020d:56ff:fe77:52a3

The rules

128 bits = 32 hex digits, arranged in 8 groups of 4, separated by colons. Each group is 16 bits.

DNS to the rescue

Nobody types these by hand — DNS (Chapter 7!) maps names to IPv6 addresses via AAAA records.

Part 3 · Addresses

Shrinking addresses: zero rules

1 · Drop leading zeros

2001:0718:0016:...
→ 2001:718:16:...

2 · Collapse a run of zeros

2001:db8:0:0:0:0:0:1
→ 2001:db8::1
⚠️
The :: rule: a double colon replaces one or more all-zero groups — but you may use it only once per address (otherwise it’s ambiguous how many groups it stands for).

Part 3 · Addresses

Three kinds of IPv6 address

🎯

Unicast

Uniquely identifies one interface. One-to-one delivery.

📢

Multicast

One packet to many destinations at once. One-to-many.

📍

Anycast

Assigned to several devices; routed to the nearest one.

📌
No broadcast! Unlike IPv4, IPv6 has no broadcast address. The all-nodes multicast (ff02::1) does the same job more efficiently.

Part 3 · Addresses

Prefix length & the magic /64

Prefix length

Slash notation marks the network portion, from /0 to /128 — just like IPv4’s CIDR.

Why /64?

The recommended LAN prefix. It leaves a 64-bit interface ID — exactly what SLAAC auto-configuration needs, and it keeps subnetting simple.

🧠
Memory hook: think “/64 for every LAN.” Network in the first 64 bits, host (interface ID) in the last 64.

Part 3 · Unicast

Two unicast addresses per interface

Global Unicast (GUA)

Like a public IPv4 address — globally unique and Internet-routable. Currently assigned from 2000::/3, so they begin with a 2 or 3.

Link-Local (LLA)

Required on every IPv6 interface; used to talk to devices on the same link only — not routable. Always in fe80::/10.

📌
An IPv6 host typically has both at once: an LLA (auto-created for local chatter, e.g. Neighbor Discovery) and a GUA (for the wider Internet).

Part 3 · Unicast

GUA structure & the ULA

Global Routing Prefix
assigned by ISP (~/48)
Subnet ID
your subnets
Interface ID
/64 host part

Unique Local Address (ULA) — fc00::/7

Similar to IPv4’s RFC 1918 private ranges: used for local addressing within a site, not globally routed. But note — ULAs were not designed to “hide” a network for security; that was never their purpose.

Self-Test #2

IPv6 addresses

Tap a green answer to reveal it.

Q Compress 2001:0db8:0000:0000:0000:0000:0000:0001.
A 2001:db8::1 (drop leading zeros, collapse the zero run with :: once).
Q Which range is a link-local address in, and can it be routed?
A fe80::/10 — not routable, link-only.
Q IPv6 has no broadcast. What replaces it?
A The all-nodes multicast address ff02::1.
Q What are the three parts of a GUA?
A Global routing prefix + subnet ID + interface ID (usually /64).

One-page cheat sheet

Chapter 10 in a single glance

Why IPv6

  • IPv4 = 2³² (~4.3 B) — ran out
  • IPv6 = 2¹²⁸ (~340 undecillion)
  • Autoconfig · no NAT · end-to-end

The header

  • Fixed 40 bytes, 8 fields
  • Hop Limit · Next Header · Traffic Class · Flow Label
  • No checksum, no options in base

Notation

  • 8 groups of 4 hex, colon-separated
  • Drop leading zeros
  • :: collapses zeros (once only)

Address types

  • Unicast · Multicast · Anycast
  • No broadcast → ff02::1 all-nodes

Unicast kinds

  • GUA 2000::/3 (starts 2 or 3)
  • LLA fe80::/10 (link only)
  • ULA fc00::/7 (private-ish)

Prefix

  • /64 for every LAN
  • 64-bit interface ID (SLAAC)
  • Prefix + Subnet ID + Interface ID

The address space of the future.

IPv6 trades 32 bits for 128, streamlines the header, chains optional functions as extension headers, and introduces unicast / multicast / anycast with GUA & link-local addresses. That’s the full NSSA-241 networking journey — from data communications to IPv6.

🎓 You’ve completed the NSSA-241 deck series — Chapters 1–10.

Ready to make it real? Switch to the 🧪 Lab Guide up top and run IPv6 on Kali Linux.

1 / 18

Chapter 10 · Hands-on labs

IPv6, live on Kali Linux

Six short labs that turn the slides into commands you actually run — find your own IPv6 addresses, compress them by the rules, ping over IPv6, meet multicast (the broadcast replacement), and watch Neighbor Discovery stand in for ARP. Each maps to a Chapter 10 topic.

SET-UP  ·  Open the Kali Terminal. Tools: iproute2 (ip), iputils-ping, ndisc6, ipv6calc, tcpdump. Install missing ones: sudo apt install -y ndisc6 ipv6calc tcpdump. Most machines have IPv6 on the loopback and a link-local address even without an IPv6 internet connection. The ❯ is just the prompt.
USE RESPONSIBLY  ·  Only scan/ping hosts and links you own or are permitted to test — your own machine and LAN here.
1 · Your addresses2 · Compression3 · Ping v6 4 · Multicast5 · Prefix & SLAAC6 · ND on the wire✓ Answers
1

Find Your IPv6 Addresses

Maps to Ch.10:Address types — GUA vs link-local; every interface has an LLA. You’ll learn:Spot your link-local (fe80::) and any global (2xxx::) address and tell them apart. Tools:ip -6 addr
1

List your IPv6 addresses:

ip -6 addr
Representative
lo    inet6 ::1/128 scope host
eth0  inet6 2001:db8:acad:1:20d:56ff:fe77:52a3/64 scope global
eth0  inet6 fe80::20d:56ff:fe77:52a3/64 scope link

Read the scope: link = your link-local (fe80::, every interface has one); global = a routable GUA (2xxx::). ::1 is the IPv6 loopback.

2

Just the link-local of each interface:

ip -6 addr show scope link
Why it works  ·  The slides said every IPv6 interface auto-creates a link-local (fe80::/10) and may also carry a global (2000::/3). You just saw both, tagged by scope.
Your turn  ·  Which of your addresses could a host on the other side of the Internet reach, and which one is confined to your link? (answer below)
2

Notation & Zero Compression

Maps to Ch.10:Colon-hex notation and the zero-compression rules (leading zeros, :: once). You’ll learn:Expand and compress addresses and prove the :: rule to yourself. Tools:ipv6calc, sipcalc
1

Expand a compressed address to all 32 digits:

ipv6calc --in ipv6addr --out ipv6addr --printfull 2001:db8::1
Full form
2001:0db8:0000:0000:0000:0000:0000:0001
2

Compress it back to shortest form:

ipv6calc --in ipv6addr --out ipv6addr --printcompressed 2001:0db8:0000:0000:0000:0000:0000:0001
Shortest form
2001:db8::1
Why it works  ·  The tool applies the exact two rules from the slide: drop leading zeros in each group, and replace one run of all-zero groups with :: (once).
Your turn  ·  Why is 2001::db8::1 illegal? Compress fe80:0:0:0:0:0:0:1 by hand, then check it. (answer below)
3

Ping Over IPv6

Maps to Ch.10:Unicast delivery over IPv6; link-local vs global reachability. You’ll learn:Ping the IPv6 loopback and a link-local neighbour — and see why LLAs need a zone index. Tools:ping / ping6
1

Ping the IPv6 loopback:

ping -6 -c 3 ::1
2

Ping a link-local address — it needs the interface (zone) after a %:

ping -6 -c 3 fe80::1%eth0
Why the %eth0?
fe80:: is the SAME range on every link, so the OS
must be told WHICH interface to send out.
3

Ping a global v6 host (if your network has IPv6 Internet):

ping -6 -c 3 ipv6.google.com
Why it works  ·  Link-local addresses aren’t routable and repeat on every link, so a bare fe80:: is ambiguous — the %interface zone index tells the kernel which link to use. GUAs need no zone.
Your turn  ·  Why does ::1 need no % but fe80::… does? (answer below)
4

Multicast: the Broadcast Replacement

Maps to Ch.10:Address types — multicast; IPv6 has no broadcast (all-nodes ff02::1). You’ll learn:Use the all-nodes multicast to discover every IPv6 device on your link at once. Tools:ping, ndisc6 / rdisc6
1

Ping the all-nodes multicast — every IPv6 host on the link answers:

ping -6 -c 3 ff02::1%eth0
Representative — replies from several neighbours
64 bytes from fe80::1%eth0: icmp_seq=1 ...
64 bytes from fe80::a11:22ff:fe33:4455%eth0 (DUP!) ...

That single packet reached many destinations — one-to-many multicast doing the job IPv4 needed a broadcast for.

2

Find routers on the link with router discovery:

rdisc6 eth0
Why it works  ·  ff02::1 is the all-nodes multicast group from the slide — IPv6’s efficient replacement for broadcast. Every node joins it, so one ping finds them all.
Your turn  ·  Multicast vs broadcast: why is “only interested hosts listen” better than “every host must process it”? (answer below)
5

Prefix, /64 & the Interface ID

Maps to Ch.10:Prefix length /64, GUA structure (prefix + subnet + interface ID), SLAAC. You’ll learn:Split your address into its network and interface halves and see the /64 boundary. Tools:ip -6 route, ipv6calc
1

Your on-link IPv6 prefixes (the network side):

ip -6 route show
Representative — note the /64
2001:db8:acad:1::/64 dev eth0 proto kernel ...
fe80::/64 dev eth0 proto kernel ...
2

Split an address at /64 — first 64 bits = network, last 64 = interface ID:

ipv6calc --showinfo 2001:db8:acad:1:20d:56ff:fe77:52a3 2>/dev/null | grep -iE "prefix|interface|EUI"

An interface ID containing ff:fe in the middle was built from the MAC via EUI-64 — a form of SLAAC auto-configuration.

Why it works  ·  The /64 is the network/host boundary from the slide: prefix + subnet in the first 64 bits, a 64-bit interface ID in the last — exactly what SLAAC fills in automatically.
Your turn  ·  Why does SLAAC essentially require a /64, and what would break if you used /100 on a LAN? (answer below)
6

Neighbor Discovery on the Wire

Maps to Ch.10:The IPv6 header (Next Header, Hop Limit) & how IPv6 replaces ARP with ICMPv6 Neighbor Discovery. You’ll learn:Capture IPv6 packets, read the Hop Limit, and watch Neighbor Solicitation/Advertisement do ARP’s old job. Tools:tcpdump, ip -6 neigh, two terminals
1

Capture IPv6 & ICMPv6 in Terminal A:

sudo tcpdump -i any -n -vv ip6
2

Trigger neighbor discovery in Terminal B (ping a link neighbour), then read the capture:

ping -6 -c 2 ff02::1%eth0
ip -6 neigh
Terminal A — note hlim (Hop Limit) and ICMP6 ND
IP6 (hlim 255, next-header ICMPv6) fe80::... > ff02::1:
       ICMP6, neighbor solicitation, who has 2001:db8::1
IP6 fe80::a1... > fe80::...: ICMP6, neighbor advertisement, tgt is 2001:db8::1

Read the header live: hlim = the Hop Limit field, next-header = the Next Header field pointing to ICMPv6. And Neighbor Solicitation / Advertisement is ICMPv6 doing exactly what ARP did in IPv4.

Why it works  ·  You saw two header fields from the slides (Hop Limit, Next Header) on a real packet, and watched IPv6’s Neighbor Discovery resolve a link address — the IPv6 replacement for ARP (Chapter 3).
Your turn  ·  ARP is gone in IPv6 — which protocol and message types took over its job? (answer below)
✓

Answer Key & Where Next

Lab 1. The global (GUA, 2xxx::) address is Internet-reachable; the link-local (fe80::) is confined to your link and can’t be routed.

Lab 2. 2001::db8::1 is illegal because :: may appear only once — two of them make the number of zero-groups ambiguous. fe80:0:0:0:0:0:0:1 → fe80::1.

Lab 3. ::1 is unique (loopback, one interface), so no zone is needed. fe80:: repeats on every link, so the %interface zone index says which link to use.

Lab 4. Multicast means only interested/joined hosts process the packet, and switches can limit where it floods — far less wasted work than a broadcast every host must inspect.

Lab 5. SLAAC builds a 64-bit interface ID, so it needs a 64-bit host portion → a /64 network. A /100 leaves only 28 host bits, so SLAAC (and easy subnetting) break.

Lab 6. ICMPv6 Neighbor Discovery — specifically Neighbor Solicitation and Neighbor Advertisement messages — replaces ARP.

This lab’s toolConnects to…
ip -6 addr / route (Labs 1, 5)Chapter 6 — subnetting, now with a 128-bit address
AAAA / DNS names (Lab 3)Chapter 7 — DNS AAAA records for IPv6
ICMPv6 Neighbor Discovery (Lab 6)Chapter 3 — ARP, and Chapter 5 — ICMP
multicast ff02::1 (Lab 4)Address types — one-to-many delivery
Congratulations 🎓  ·  That’s the whole NSSA-241 series — Chapters 1–10 — from data communications all the way to IPv6, seen and run on Kali Linux. Go build something.
Chapter 10 — IPv6 · Slides + Hands-On Kali Labs