What Is IPv6? IPv6 Addresses, Types and Subnetting Explained (Free 38-Page PDF)

IPv6 (Internet Protocol version 6) is the current version of the Internet Protocol. It gives every device a 128-bit address, written as eight groups of four hexadecimal digits, such as 2001:db8:acad:1::10. It replaces IPv4, whose 32-bit space holds only about 4.3 billion addresses, with 2^128 (about 340 undecillion). IPv6 has no broadcast, configures hosts on its own with SLAAC, and finds neighbours with NDP instead of ARP.

This free 38-page PDF covers IPv6 from the basics to Cisco configuration, and the page below follows the same order: what IPv6 is and how its addresses look first, then address types, then subnetting, SLAAC, NDP and router config.

What is IPv6?

IPv6 is the Layer 3 protocol that addresses and routes packets across networks, the same job IPv4 does. The IETF designed it because IPv4 was running out of addresses, and the current specification is RFC 8200, a full Internet Standard since 2017.

IPv6 isn’t “IPv4 with longer addresses”. It’s a separate protocol, so an IPv4-only host and an IPv6-only host can’t talk to each other directly. That’s why dual stack, tunnels and translation exist (covered near the end).

What IPv6 changes, in one list:

• 128-bit addresses: enough for every device to have its own global address.
• A fixed 40-byte header with no checksum, so routers do less work per packet.
• Auto-configuration (SLAAC): a host can build its own address from what the router advertises.
• No broadcast: multicast and anycast do those jobs.
• NDP instead of ARP: neighbour discovery runs inside ICMPv6.

How many bits does IPv6 have?

An IPv6 address has 128 bits. It’s split into 8 groups of 16 bits, called hextets. Each hextet is written as 4 hexadecimal digits, and each hex digit is exactly 4 bits (a nibble). So 8 hextets x 16 bits = 128 bits, or 32 hex digits in full.

Unit	Size	Example
Nibble	1 hex digit = 4 bits	a
Hextet	4 hex digits = 16 bits	acad
Address	8 hextets = 128 bits	2001:0db8:acad:0001:0000:0000:0000:0010

How many IPv6 addresses are there? 2^128, which is 340,282,366,920,938,463,463,374,607,431,768,211,456. One single IPv6 LAN (a /64) holds 2^64 addresses, about 18.4 quintillion, which is more than 4 billion times the whole IPv4 internet.

What are IPv6 addresses? Format and an IPv6 address example

An IPv6 address has a network part (the prefix) and a host part (the interface ID). The prefix length is written after a slash, just like CIDR in IPv4. IPv6 never uses a dotted mask such as 255.255.255.0.

Take this IPv6 address example: 2001:db8:acad:1::10/64.

Part	Bits	Value in the example	Who sets it
Global routing prefix	48	2001:db8:acad	Your ISP or regional registry
Subnet ID	16	1 (0001)	You
Interface ID	64	::10	The host (manual, EUI-64 or random)

Almost every LAN uses /64, because SLAAC needs exactly 64 bits for the interface ID. The 2001:db8::/32 block in these examples is reserved for documentation, so you’ll see it in books and labs but never on the internet. Since 2024, 3fff::/20 is a second documentation prefix (RFC 9637), which the PDF doesn’t list yet.

How to shorten an IPv6 address

RFC 4291 gives two rules to compress an IPv6 address:

1. Drop leading zeros in any hextet: 0db8 becomes db8, 0000 becomes 0. Trailing zeros stay (abc0 stays abc0).
2. Replace one run of all-zero hextets with ::. You can use :: only once, or the length becomes ambiguous.

Full form	Compressed
2001:0db8:0000:0000:0000:ff00:0042:8329	2001:db8::ff00:42:8329
2001:0db8:acad:0001:0000:0000:0000:0010	2001:db8:acad:1::10
ff02:0000:0000:0000:0000:0000:0000:0001	ff02::1
0000:0000:0000:0000:0000:0000:0000:0001	::1

To expand, count the visible hextets and let :: fill the rest with 0000. 2001:db8:acad:1::10 shows 5 hextets, so :: hides 3.

RFC 5952 adds the canonical style that most tools print: lowercase letters, leading zeros always removed, :: on the longest zero run (the first one if two runs tie), and never :: for a single zero hextet. So 2001:db8:0:1::1 is right and 2001:db8::abcd::1 is invalid.

IPv4 vs IPv6: what changes?

Feature	IPv4	IPv6
Address length	32 bits	128 bits
Total addresses	about 4.3 billion (2^32)	about 3.4 x 10^38 (2^128)
Written as	Dotted decimal, 192.168.1.10	Hexadecimal, 2001:db8::10
Header	20 to 60 bytes, variable	40 bytes, fixed
Header checksum	Yes	No (left to Layer 2 and Layer 4)
Fragmentation	Routers and hosts	Source host only
Broadcast	Yes	No, multicast instead
Address setup	Manual or DHCP	Manual, SLAAC or DHCPv6
MAC resolution	ARP (broadcast)	NDP (ICMPv6 multicast)
IPsec	Optional	Recommended (SHOULD), not mandatory
Typical LAN size	Varies (/24, /26…)	/64 almost everywhere
DNS record	A	AAAA (“quad-A”)
Loopback	127.0.0.1	::1

One correction to a claim you’ll see almost everywhere, including in this PDF: IPv6 doesn’t have IPsec “built in”. The early specification made IPsec mandatory, but RFC 6434 changed that to SHOULD, and RFC 8504 keeps it there. IPsec works the same way over IPv4 and IPv6.

Does IPv6 still need NAT? That question has its own answer in our guide on whether NAT goes away with IPv6.

Why IPv6 exists, and how far adoption has got

IANA handed out its last free blocks of IPv4 in 2011. Work on a successor started long before: the IETF formed its IPng (IP Next Generation) area in late 1993, compared three proposals (TUBA, CATNIP and SIPP), and picked a SIPP-based design with 128-bit addresses (RFC 1752, January 1995).

Year	Milestone
1995	RFC 1883, the first IPv6 specification (Deering and Hinden)
1998	RFC 2460, the version used for almost 20 years
2011	IANA’s free IPv4 pool runs out
2012	World IPv6 Launch on 6 June: major sites and ISPs switch IPv6 on for good
2017	RFC 8200, IPv6 becomes a full Internet Standard (STD 86)
2026	Google measures more than 50% of its users on IPv6 for the first time

Why version 6 and not 5? Number 5 was already taken by the experimental Internet Stream Protocol (ST-II).

How much traffic uses IPv6 now? Google’s own measurement crossed 50% for a single day on 2026-03-28 (50.10%), then settled back into the mid-40s (Google IPv6 statistics). APNIC Labs, which measures IPv6 capability rather than Google traffic, shows a lower global figure, in the low 40s (APNIC Labs). Mobile networks drive most of the growth: your phone almost certainly has an IPv6 address already.

Types of IPv6 addresses

IPv6 has three kinds of addresses: unicast (one interface), multicast (every interface that joined a group) and anycast (the nearest of several interfaces). There’s no broadcast at all.

Type	Prefix	Starts with	Routed on the internet?	IPv4 cousin
Global unicast (GUA)	2000::/3	2 or 3	Yes	Public IP
Link-local	fe80::/10	fe80	No, one link only	169.254.x.x
Unique local (ULA)	fc00::/7	fd in practice	No	10/8, 172.16/12, 192.168/16
Multicast	ff00::/8	ff	Depends on scope	224.0.0.0/4
Loopback	::1/128	::1	No	127.0.0.1
Unspecified	::/128	::	No	0.0.0.0
IPv4-mapped	::ffff:0:0/96	::ffff:	No	IPv4 inside IPv6
Documentation	2001:db8::/32, 3fff::/20	2001:db8, 3fff	No	192.0.2.0/24

The IANA IPv6 special-purpose registry is the official list. An interface normally holds several of these at once: a link-local, one or more global addresses (stable plus temporary) and a few multicast groups. That’s normal.

Global unicast addresses

Global unicast addresses come from 2000::/3 today, so the first hex digit is 2 or 3. They’re unique on the whole internet, like public IPv4 addresses, and a host gets one by static setup, SLAAC or DHCPv6. Google’s public DNS, for example, is 2001:4860:4860::8888.

Link-local and unique local addresses

Every IPv6 interface creates a link-local address in fe80::/10 as soon as IPv6 is on. Routers never forward it, and NDP, router advertisements and routing protocols use it as the next hop. It’s the IPv6 cousin of the 169.254 address you get when DHCP fails, but it behaves very differently. We compare the two in IPv6 link-local addresses vs APIPA.

Unique local addresses (fc00::/7, RFC 4193) are IPv6’s private range. In practice they start with fd followed by a random 40-bit Global ID, so two merged companies are very unlikely to clash. For how ULAs line up against the IPv4 private ranges, see IPv6 private addresses (ULA).

Loopback and unspecified addresses

The IPv6 loopback address is ::1, a single address rather than a whole /8 like IPv4’s 127.0.0.0/8. ping ::1 tests your own IPv6 stack. The unspecified address :: means “no address yet” and is the source of a Duplicate Address Detection check. ::/0 is the default route.

Multicast and solicited-node addresses

Multicast addresses start with ff, followed by 4 flag bits, 4 scope bits and a 112-bit group ID. The ones you’ll meet first:

Address	Group
ff02::1	All nodes on the link (the job broadcast used to do)
ff02::2	All routers on the link
ff02::5 / ff02::6	OSPFv3 routers / DRs
ff02::9	RIPng routers
ff02::a	EIGRP for IPv6 routers
ff02::1:2	All DHCPv6 servers and relay agents

A host also joins one solicited-node group for every unicast address it has: the fixed prefix ff02::1:ff00:0/104 plus the last 24 bits of the address. For 2001:db8:acad:1:21a:2bff:fe3c:4d5e that’s ff02::1:ff3c:4d5e. NDP sends its “what’s your MAC?” question there, so only one or two hosts process it instead of the whole LAN. On Ethernet, IPv6 multicast frames go to MAC addresses that start with 33:33.

Anycast addresses

An anycast address is a normal unicast address configured on several devices. Routing delivers each packet to the nearest one. Public DNS resolvers, CDNs and the DNS root servers use it. Every subnet also has a subnet-router anycast address: the prefix with an all-zero interface ID, such as 2001:db8:acad:1::.

EUI-64 and random interface IDs

The last 64 bits of an address identify the interface. A device builds them in one of three ways: manually (::1), with modified EUI-64 from its MAC address, or randomly.

Modified EUI-64, step by step, for MAC 00:1A:2B:3C:4D:5E:

1. Split the MAC in half: 001A2B and 3C4D5E.
2. Insert FFFE in the middle: 001A:2BFF:FE3C:4D5E.
3. Flip the 7th bit of the first byte (the Universal/Local bit): 00 becomes 02.
4. Result: interface ID 21a:2bff:fe3c:4d5e. With prefix 2001:db8:acad:1::/64, the address is 2001:db8:acad:1:21a:2bff:fe3c:4d5e.

Quick trick for step 3: the 7th bit is worth 2 in hex, so add or subtract 2 from the first byte (1a becomes 18, a4 becomes a6). An EUI-64 address is easy to spot because it always has ff:fe in the middle of the interface ID.

EUI-64 shows your MAC address to every site you visit, so modern operating systems use random interface IDs instead: stable-private IDs that differ per network (RFC 7217) and temporary addresses that change regularly for outgoing connections (RFC 8981). Cisco routers still use EUI-64 when you add the eui-64 keyword, and for their automatic link-local addresses.

The IPv6 header: 40 bytes, 8 fields

The IPv6 header is fixed at 40 bytes, so every field sits in the same place in every packet.

Field	Bits	What it does
Version	4	Always 6
Traffic Class	8	QoS marking, the same job as DSCP and ECN in IPv4
Flow Label	20	Marks packets of the same flow
Payload Length	16	Length of everything after the 40-byte header
Next Header	8	What comes next: TCP 6, UDP 17, ICMPv6 58, or an extension header
Hop Limit	8	The IPv4 TTL, minus 1 at every router
Source address	128	Sender
Destination address	128	Receiver

The Traffic Class byte carries the same DSCP values as IPv4, such as Expedited Forwarding (DSCP 46) for voice. On Ethernet, an IPv6 packet is marked with EtherType 0x86DD, as our Ethernet frame format guide shows.

What changed from IPv4: the header checksum, the fragmentation fields, options and the header length field are gone. TTL became Hop Limit, Protocol became Next Header, and ToS became Traffic Class. Optional information now goes into extension headers chained by the Next Header field: Hop-by-Hop Options (0), Routing (43), Fragment (44), ESP and AH for IPsec (50 and 51), and Destination Options (60).

Routers never fragment IPv6. A packet that’s too big is dropped and the router sends an ICMPv6 “Packet Too Big” message back, and every link must carry at least 1,280 bytes (RFC 8200). RFC 8200 recommends an order for extension headers rather than requiring one: each should appear at most once, except Destination Options (at most twice).

IPv6 subnetting: give every LAN a /64

IPv6 subnetting is easier than IPv4 because you don’t count hosts. Every LAN gets a /64, and you only count in hex in the subnet ID bits between your site prefix and the interface ID. There’s no network or broadcast address to subtract.

The formula is the same as IPv4: subnets = 2^(new prefix – old prefix). A /48 site split into /64s gives 2^16 = 65,536 subnets, and only the 4th hextet changes:

Subnet	Network	First address (router)
1	2001:db8:acad::/64	2001:db8:acad::1
2	2001:db8:acad:1::/64	2001:db8:acad:1::1
3	2001:db8:acad:2::/64	2001:db8:acad:2::1
65,536	2001:db8:acad:ffff::/64	2001:db8:acad:ffff::1

Two habits make it easy:

• Subnet on nibble boundaries. Change the prefix in steps of 4 bits (/48, /52, /56, /60, /64), so each boundary falls on a whole hex digit. Every 4-bit step multiplies the number of subnets by 16.
• Find a subnet by keeping digits. Which subnet is 2001:db8:acad:12a4::99/60 in? A /60 keeps 15 hex digits, so keep 2001:db8:acad:12a and zero the rest: 2001:db8:acad:12a0::/60, which covers 12a0 to 12af.

For which prefix sizes ISPs hand to sites and homes, use the IPv6 prefix quick-reference in our subnet mask PDF. To test yourself, work through the IPv6 subnetting questions with answers in our subnetting guide. Router-to-router links often use /127 (RFC 6164), and loopbacks use /128.

SLAAC vs DHCPv6: how devices get an IPv6 address

A router tells hosts how to get an address with flags in its Router Advertisement (RA).

SLAAC (Stateless Address Autoconfiguration, RFC 4862) works in four steps:

1. The host sends a Router Solicitation (RS) to ff02::2.
2. The router replies with a Router Advertisement: prefix 2001:db8:acad:1::/64.
3. The host builds its address: prefix + its own interface ID (random or EUI-64).
4. The host runs Duplicate Address Detection: “is anyone already using this address?”

Method	Address from	DNS from	RA flags
Static	The admin	The admin	n/a
SLAAC only	RA prefix + own ID	RA (RDNSS option, RFC 8106)	A=1, O=0, M=0
SLAAC + stateless DHCPv6	RA prefix + own ID	DHCPv6 server	A=1, O=1, M=0
Stateful DHCPv6	DHCPv6 server	DHCPv6 server	M=1 (A often 0)

The default gateway always comes from the RA (the router’s link-local address). DHCPv6 never hands out a gateway.

DHCPv6 (RFC 8415) is a separate protocol from IPv4 DHCP, but the four messages map neatly onto DHCP’s DORA process: SOLICIT (to ff02::1:2), ADVERTISE, REQUEST, REPLY. It uses UDP port 546 on the client and 547 on the server. Home routers get their /56 or /60 from the ISP through DHCPv6 Prefix Delegation, then cut it into /64s for each LAN.

SLAAC	Stateful DHCPv6
No server needed	Central control and logging
Hosts pick their own IDs	Needs a DHCPv6 server
No central record of who has what	Android doesn’t support it for addresses

On that last row: Android still doesn’t take addresses from stateful DHCPv6. Since September 2025 it can request a prefix through DHCPv6 Prefix Delegation (RFC 9762) and build addresses from it (Android Developers Blog).

On Cisco, ipv6 nd managed-config-flag sets M=1, ipv6 nd other-config-flag sets O=1, and ipv6 nd prefix ... no-autoconfig clears A. ipv6 dhcp relay destination <server> forwards client messages to a remote server, like ip helper-address in IPv4.

Neighbor Discovery Protocol (NDP): how IPv6 replaced ARP

The Neighbor Discovery Protocol (RFC 4861) runs inside ICMPv6 and replaces ARP, ICMP router discovery and redirects. It uses five ICMPv6 message types:

ICMPv6 type	Message	What it does
133	Router Solicitation (RS)	Host: “Are there any routers here?”
134	Router Advertisement (RA)	Router: prefix, gateway, flags, MTU
135	Neighbor Solicitation (NS)	“What’s your MAC?” and the DAD check
136	Neighbor Advertisement (NA)	“Here’s my MAC”
137	Redirect	“Use a better next hop for that destination”

Address resolution works like this: PC-A (2001:db8:acad:1::10) wants to reach PC-B (::20). It sends an NS to PC-B’s solicited-node group, ff02::1:ff00:20, and PC-B answers with a unicast NA carrying its MAC. Only PC-B listens to that group, so nobody else is disturbed.

	IPv4 ARP	IPv6 NDP
Where it runs	Its own protocol (EtherType 0x0806)	Inside ICMPv6
Request sent to	Broadcast ff:ff:ff:ff:ff:ff	Solicited-node multicast
Extra jobs	None	Router discovery, DAD, redirects, unreachability detection

Duplicate Address Detection (DAD): before using a new address, a host sends an NS for it with source ::. If an NA comes back, the address is taken. The neighbour cache moves through INCOMPLETE, REACHABLE, STALE, DELAY and PROBE, and you can read it with ip -6 neigh on Linux, netsh interface ipv6 show neighbors on Windows or show ipv6 neighbors on Cisco.

Never block all ICMPv6 the way some admins blocked ICMP in IPv4. Without it there’s no NDP, no router discovery and no Path MTU discovery. RFC 4890 lists what to filter and what to allow.

IPv4 to IPv6 transition: dual stack, tunnels and translation

The internet can’t switch protocols overnight, and IPv4 and IPv6 can’t talk directly, so three families of techniques let them coexist:

Mechanism	Family	How it works	Status today
Dual stack	Coexistence	Both protocols on every device	Most common, preferred
6in4 (manual)	Tunnel	Static IPv6-in-IPv4 tunnel (IP protocol 41)	Tunnel brokers, labs
GRE	Tunnel	Generic tunnel between routers	Common on Cisco
6to4 (2002::/16)	Tunnel	Automatic, uses public IPv4	Deprecated
Teredo (2001::/32)	Tunnel	IPv6 over UDP through NAT	Mostly retired
6rd	Tunnel	ISP-run version of 6to4	Some ISPs
NAT64 + DNS64	Translation	IPv6-only client reaches an IPv4-only server via 64:ff9b::/96	Mobile networks
464XLAT	Translation	NAT64 plus a small translator on the phone	Mobile networks
DS-Lite	Tunnel	IPv4 over IPv6 to a carrier NAT	Cable and fibre ISPs

The rule of thumb: dual stack where you can, tunnel where you must, translate only when one side is single-stack. With dual stack, DNS returns both an A and an AAAA record and “Happy Eyeballs” prefers IPv6. A manual 6in4 tunnel on Cisco is interface Tunnel0, ipv6 address 2001:db8:ffff::1/64, tunnel source 203.0.113.1, tunnel destination 198.51.100.2 and tunnel mode ipv6ip.

How to configure IPv6 on a Cisco router

IPv6 addressing and IPv6 address types are CCNA 200-301 v1.1 exam topics 1.8 and 1.9, and IPv6 static routing is topic 3.3 (Cisco CCNA exam topics). A router won’t forward IPv6 until you turn routing on:

R1(config)# ipv6 unicast-routing
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ipv6 address 2001:db8:acad:2::/64 eui-64
R1(config-if)# interface Serial0/0/0
R1(config-if)# ipv6 address 2001:db8:acad:ff::1/127
R1(config-if)# exit
R1(config)# ipv6 route ::/0 2001:db8:acad:ff::0

That’s a static address, an easy-to-read link-local, an EUI-64 address, a /127 point-to-point link and a default route. Check it with:

• show ipv6 interface brief: every interface shows a link-local AND a global address.
• show ipv6 route: C (connected), L (local /128) and S (static) routes. The FF00::/8 route to Null0 is normal, so don’t remove it.
• show ipv6 neighbors: the NDP neighbour cache.

Each routing protocol has an IPv6 version: RIPng (ff02::9, UDP 521), OSPFv3 (ff02::5 and ::6, runs per interface over link-local addresses), EIGRP for IPv6 (ff02::a, needs a router ID) and MP-BGP (address family ipv6). For when to run which, see OSPF and BGP compared and our EIGRP cheat sheet PDF.

Typing these commands from a page isn’t the same as watching a link-local next hop appear in the routing table. The CCNA Workbook’s IPv6 labs come with tested IOS configs and ready-to-load EVE-NG topologies, so you can build this exact router and break it on purpose.

Check IPv6 on your own computer

• Windows: ipconfig shows a stable IPv6 address, a temporary IPv6 address, a link-local address ending in %12 (the zone ID, the interface number) and often a link-local default gateway such as fe80::1%12.
• Linux: ip -6 addr show dev eth0 shows scope global and scope link addresses, and ping -6 ::1 tests the stack.
• DNS: nslookup -type=AAAA google.com returns IPv6 records.
• Am I connected to IPv6? Visit test-ipv6.com for a score out of 10.

Python’s ipaddress module checks answers too: ipaddress.ip_address('2001:0db8:acad:0001:0000:0000:0000:0010').compressed returns '2001:db8:acad:1::10'.

What’s in the free 38-page IPv6 PDF?

The PDF is handwritten-style study notes in 18 chapters, with colour-coded diagrams, tables and sample console output:

Chapters	What they cover
1 to 3	Why IPv6, its history, and IPv4 vs IPv6 side by side
4 to 6	Address structure, hex conversion, compression and expansion, prefix lengths
7 to 10	Address types, unicast in detail, multicast and anycast, EUI-64 and random IDs
11 to 12	The IPv6 header and extension headers, then subnetting with four worked examples
13 to 16	SLAAC and DHCPv6, NDP and ICMPv6, transition mechanisms, Cisco configuration
17 to 18	Real-world output (Windows, Linux, Python) and 18 practice questions with answers

It ends with a one-page summary and a one-page cheat sheet of every prefix, formula and ICMPv6 type to keep next to you during labs.

Where does this free IPv6 PDF stop?

The notes explain IPv6 and show sample output, but they don’t give you a network to type into. The CCNA Lab Workbook does: 75 labs for the current 200-301 blueprint, a PDF plus an EVE-NG ISO with pre-loaded topology files, and Packet Tracer files for topics that don’t need EVE-NG. IPv4 and IPv6 addressing sit in its foundation phase, before switching, OSPF, NAT and ACLs.

What to read next:

• Keep the Cisco commands cheat sheet open while you configure.
• Test yourself with the CCNA 200-301 practice test PDF.
• See where IPv6 fits in the whole exam with the free CCNA 200-301 study guide.

@misc{smenodelabs2026,
  title = {What Is IPv6? IPv6 Addresses, Types and Subnetting Explained (Free 38-Page PDF)},
  author = {{SMEnode Labs}},
  year = {2026},
  url = {https://smenode-labs.com/free-pdf/networking/ipv6/},
  note = {SMEnode Labs}
}