IPv6 Addressing & Dual Stack

Overview

Overview IPv6 uses 128-bit addresses written as eight 16-bit groups in colon-hex notation (e.g., 2001:0db8:85a3::8a2e:0370:7334). Leading zeros in each group can be omitted, and one consecutive run of all-zero groups can be replaced with ::.

Address types: - Link-local (fe80::/10): auto-configured, not routable, used on-link for NDP. Every interface has one. - Global unicast (2000::/3): globally routable, equivalent to IPv4 public addresses. - Unique local (fc00::/7): like RFC 1918, not globally routable. - Multicast (ff00::/8): replaces IPv4 broadcast. NDP uses multicast for neighbor discovery. - Anycast: same address assigned to multiple nodes; routing delivers to nearest.

Address configuration: - SLAAC (Stateless Address Autoconfiguration): host generates its own address from the link-local prefix + EUI-64 (derived from MAC). No DHCP server needed. Router sends RA (Router Advertisement) with prefix. - DHCPv6: like DHCPv4 but stateful. Assigns addresses from a pool. Required when you need to control specific assignments.

NDP (Neighbor Discovery Protocol): replaces ARP. Uses ICMPv6 multicast instead of broadcast. Key messages: Router Solicitation (RS), Router Advertisement (RA), Neighbor Solicitation (NS), Neighbor Advertisement (NA).

Dual-stack runs IPv4 and IPv6 simultaneously. A host gets both addresses and prefers IPv6 (Happy Eyeballs RFC 8305). NAT64 + DNS64 translates IPv6-only client connections to IPv4 backends — the DNS64 resolver synthesizes AAAA records for IPv4-only destinations.

Kubernetes dual-stack (stable in 1.23): pods and services get both IPv4 and IPv6 addresses. Requires two pod CIDRs, two service CIDRs, and a CNI that supports dual-stack (Calico, Cilium).

Key concepts

EUI-64

Method to derive a 64-bit interface ID from a 48-bit MAC address by inserting ff:fe in the middle and flipping bit 7. Used in SLAAC to generate the host portion of a link-local address.

SLAAC

Stateless Address Autoconfiguration. Host listens for Router Advertisements containing the /64 prefix, then appends its EUI-64 to form a global unicast address — no DHCP server required.

NDP

Neighbor Discovery Protocol (ICMPv6 types 133-137). Replaces ARP. Used for router discovery, prefix discovery, address resolution, and duplicate address detection.

NAT64 / DNS64

Transition mechanism for IPv6-only clients reaching IPv4 servers. DNS64 synthesizes AAAA records from A records; NAT64 gateway translates packets between IPv6 and IPv4.

Happy Eyeballs

RFC 8305 algorithm where clients race IPv4 and IPv6 connections with a 250ms delay preference for IPv6. Ensures IPv6 is used when available without penalizing IPv6-only delays.

When to use it

• Explaining why modern cloud environments prefer IPv6 for scale (AWS assigns /56 blocks to VPCs)
• Debugging NDP failures when IPv6 hosts cannot reach the gateway
• Configuring Kubernetes dual-stack and explaining CIDR planning
• Explaining NAT64 when deploying IPv6-only infrastructure with IPv4 dependencies

Interview questions

• What is the difference between SLAAC and DHCPv6, and when do you use each?
• How does Kubernetes dual-stack work, and what changes when you enable it?

More Networking topics

• HTTP/2 & HTTP/3
• HTTP/HTTPS & TLS
• Hybrid Cloud Connectivity
• IP Addressing & CIDR
• IPSec & VPN Deep Dive
• iptables and nftables
• Kubernetes Network Policies
• L4 vs L7 Load Balancing
• Latency Diagnosis
• Load Balancing Algorithms
• MPLS
• mTLS & SPIFFE/SPIRE Workload Identity