CCNA guide

IPv6 Addresses Explained (Format, Shortening, Types)

The first time you see an address like 2001:db8:acad:1::1, it looks like secret code. The good news: IPv6 has fewer, more logical rules than it seems. Once you understand the format and the two shortening rules, the rest is vocabulary.

In this guide you'll learn what an IPv6 address looks like, how to shorten it and how to write it back out in full, what address types exist and how to recognize them from the first few digits, how to calculate an EUI-64 address, what SLAAC and DHCPv6 mean and how to configure IPv6 on a Cisco router. At the end there are exercises with answers.

In the Networking Academy CCNA v8 courses, IPv6 addressing is taught in CCNA 1 · ITN (module 11, IPv6 addressing, plus module 8 for Neighbor Discovery), and automatic address configuration (SLAAC and DHCPv6) is covered in more depth in CCNA 2 · IEN (module 9).

Why we need IPv6

IPv4 has 32 bits, which is nearly 4.3 billion addresses. That sounds like a lot, but they've run out: almost every regional registry exhausted its free blocks long ago, and networks have survived with NAT and private addresses. IPv6 fixes the problem at the root: it has 128 bits, which is 2^128 addresses, a 39-digit number (roughly 3.4 × 10^38).

Besides the space, IPv6 brings a few simplifications:

• no broadcast: what broadcast used to do is now done by multicast, which is far more targeted;
• automatic configuration: a device can build its own address (SLAAC);
• no ARP: its role is taken over by Neighbor Discovery (NDP), which uses ICMPv6 messages;
• a simpler header, with a fixed length of 40 bytes.

What an IPv6 address looks like

The 128 bits are written in hexadecimal, because in binary they'd be impossible to read. One hex digit (0–9, a–f) represents exactly 4 bits, so 128 bits means 32 hex digits. They're split into groups of 4, giving 8 groups separated by colons. A group is 16 bits and is called a hextet.

2001:0db8:0000:0000:0000:0c1a:00f0:0005
 |    |    |    |    |    |    |    |
 1    2    3    4    5    6    7    8    ← 8 hextets × 16 bits = 128 bits

Letters can be upper or lower case, but the recommended form (RFC 5952) is lower case. If hexadecimal is still new to you, just remember this: a=10, b=11, c=12, d=13, e=14, f=15, and f means four 1 bits (1111). To practice conversions, try the binary and hex converter.

The shortening rules

The address above is correct, but long. There are two rules that shorten it, and only two.

Rule 1: drop the leading zeros in each hextet

In each group you can delete the zeros on the left. A group made up only of zeros becomes a single 0.

0db8 → db8      0042 → 42      0000 → 0      ff00 → ff00 (stays)

Watch out for the classic trap: zeros on the right are never removed. db80 is not the same as db8. If you wrote 2001:db8:: instead of 2001:db80::, you'd change the address.

Rule 2: replace one run of all-zero groups with ::

A continuous run of one or more all-zero groups can be replaced with ::. The important rule: :: appears only once in an address. When it reads the address, the device counts the visible groups and fills in zeros up to 8. If there were two ::, it wouldn't know how to split the zeros between them.

For the canonical form (the one modern devices display), RFC 5952 adds three more recommendations:

• if there are several runs of zeros, compress the longest one;
• if they're the same length, compress the first one (from the left);
• a single zero group stays 0; it isn't replaced with ::.

Worked examples

Example 1. 2001:0db8:0000:0000:0000:0c1a:00f0:0005

1. Leading zeros: 2001:db8:0:0:0:c1a:f0:5
2. The three consecutive zero groups become :: → 2001:db8::c1a:f0:5

Example 2. 2001:0db8:0000:0001:0000:0000:0000:0001

1. Leading zeros: 2001:db8:0:1:0:0:0:1
2. There are two runs of zeros: one of a single group (the 3rd) and one of three groups (5–7). Compress the longest → 2001:db8:0:1::1

Example 3 (a tie). 2001:0db8:0000:0000:abcd:0000:0000:1234

Two runs of two groups each. You could compress either one, and both forms are valid, but the canonical form picks the first: 2001:db8::abcd:0:0:1234.

Example 4. ff02:0000:0000:0000:0000:0000:0000:0001 → ff02::1, and the address made of all zeros with a 1 at the end becomes ::1. The all-zeros address becomes ::.

How to expand an address back to full form

The reverse process is just counting. Take 2001:db8:a::12:

1. Count the visible groups: 2001, db8, a, 12 → 4 groups.
2. 8 − 4 = 4 groups are missing, and they sit where the :: is.
3. Pad every group to 4 digits with leading zeros.

2001:db8:a::12
2001:0db8:000a:0000:0000:0000:0000:0012

Invalid addresses (and why)

The prefix: network part and interface part

As with IPv4, an IPv6 address has a network part and a host part, except that IPv6 no longer uses a dotted-decimal mask, only the prefix length: 2001:db8:acad:1::1/64.

For a regular subnet (a LAN), the standard prefix is /64:

2001:0db8:acad:0001 : 0000:0000:0000:0001
|---- /64 prefix ---| |-- interface ID (64 bits) --|

• The global routing prefix is what the organization gets from its ISP (for example a /48).
• The subnet ID is the bits between the prefix you received and /64. From /48 to /64 there are 16 bits left, which means 65,536 /64 subnets. From a /56 there are 8 bits left, which means 256 subnets.
• The interface ID is the last 64 bits, the equivalent of the host part.

Subnetting in IPv6 is much more relaxed than in IPv4: you usually don't calculate how many hosts fit anymore (a /64 has 2^64 addresses); you just number the subnets in the fourth hextet: 2001:db8:acad:1::/64, 2001:db8:acad:2::/64 and so on, up to 2001:db8:acad:ffff::/64. For IPv4, where every bit counts, there's the subnetting step-by-step guide.

Don't forget: in IPv6 you no longer subtract 2. There's no broadcast address, and the address with all zeros in the interface part (for example 2001:db8:acad:1::) is the anycast address reserved for the routers on the subnet (Subnet-Router anycast), so you don't assign it to a host.

IPv6 address types

IPv6 has three broad categories: unicast (a single recipient), multicast (a group) and anycast (the nearest of several devices sharing the same address). There is no broadcast.

Global unicast (GUA)

IPv6's public addresses, the equivalent of public IPv4 addresses. Anything starting with hex digit 2 or 3 is a GUA. The prefix 2001:db8::/32 is reserved for documentation and examples, which is why you see it in every textbook (and in this guide): it will never appear on the Internet.

Link-local (LLA)

Every interface with IPv6 enabled automatically creates a link-local address, even if it has no GUA. It's valid only on the local segment: routers don't forward packets with a link-local source or destination. LLAs are used a lot:

• OSPFv3 neighbors talk to each other using their link-local addresses;
• the router announces itself on the network from its link-local address, and hosts use it as their default gateway;
• Neighbor Discovery (the ARP equivalent) uses them constantly.

Because the same link-local address can exist on several interfaces of a router, when you ping an LLA, the router also asks you for the outgoing interface.

Unique local (ULA)

These resemble IPv4 private addresses (10.0.0.0/8 and the others): they're for internal use and aren't routed on the Internet. The block is fc00::/7, but in practice only the fd00::/8 half is used, with a randomly generated identifier, so the networks of two companies that merge don't overlap.

Multicast

These start with ff. A few you need to recognize instantly:

The solicited-node address is the reason IPv6 doesn't need broadcast. When a device wants to find the MAC address of 2001:db8:acad:1::1, it doesn't ask the whole network; it sends the question to ff02::1:ff00:1, which only devices whose addresses end the same way listen to.

EUI-64: an address built from the MAC

A device needs the last 64 bits (the interface ID). A classic way to get them on its own is EUI-64, which starts from the 48-bit MAC address. That's 16 bits short, and the recipe is:

1. Split the MAC into two halves of 24 bits each.
2. Insert FFFE in the middle (the 16 missing bits).
3. Flip the seventh bit of the first byte (the "universal/local" bit). If it's 0 it becomes 1; if it's 1 it becomes 0. In practice, you add or subtract 2 in the first byte.

Example 1: MAC 00:1A:2B:3C:4D:5E

1. Split:            001A2B | 3C4D5E
2. Insert FFFE:      001A2B FFFE 3C4D5E
3. First byte:       00 = 00000000
   Flip bit 7:            00000010 = 02
   Result:           021A:2BFF:FE3C:4D5E

With the prefix 2001:db8:acad:1::/64, the full address is 2001:db8:acad:1:21a:2bff:fe3c:4d5e, and the link-local address built the same way is fe80::21a:2bff:fe3c:4d5e. (The leading zero of 021a disappears when you shorten it.)

Example 2: MAC 7A:3B:10:C4:22:9F

1. Split:            7A3B10 | C4229F
2. Insert FFFE:      7A3B10 FFFE C4229F
3. First byte:       7A = 01111010
   Flip bit 7:            01111000 = 78
   Result:           783B:10FF:FEC4:229F

Here the bit was 1 and became 0, so the first byte went down by 2. The full address with the same prefix: 2001:db8:acad:1:783b:10ff:fec4:229f.

How to spot an EUI-64 address: ff:fe in the middle of the interface ID (xxff:fexx). Cisco routers build their link-local addresses with EUI-64 by default. Modern operating systems (Windows, Android, iOS, macOS and many Linux distributions), however, prefer a randomly generated interface ID (stable within a network, plus temporary addresses that change periodically), so a device can't be tracked from network to network by its MAC address.

How a device gets its address: SLAAC and DHCPv6

In IPv6, the router periodically (and on request) sends a Router Advertisement (RA) message, an ICMPv6 type. A device that has just booted can speed things up by sending a Router Solicitation (RS) to all routers (ff02::2). The RA contains the network prefix, its length, the router's link-local address (which becomes the default gateway) and a few flags that tell the host how to get the rest. There are three options:

What to remember:

• SLAAC (Stateless Address Autoconfiguration): nobody keeps track of the addresses. The host takes the prefix and adds its own interface ID (EUI-64 or random).
• Stateless means the DHCPv6 server doesn't remember who has which address; it only hands out extra information.
• Stateful means the DHCPv6 server assigns addresses and keeps track of them, like DHCPv4.
• DHCPv6 doesn't provide the default gateway. The gateway always comes from the RA. This is a favorite exam question.
• Before using a new address, the host checks that nobody else has it: DAD (Duplicate Address Detection), a Neighbor Solicitation sent to the solicited-node address of its own address.

On a Cisco router, the flags are changed per interface: ipv6 nd other-config-flag sets O = 1 (stateless), ipv6 nd managed-config-flag sets M = 1 (stateful), and ipv6 nd prefix default no-autoconfig turns off SLAAC (A = 0).

IPv6 on a Cisco router

By default, a Cisco router doesn't route IPv6 and doesn't send RAs. You turn both on with a single global command, then address the interfaces:

R1(config)# ipv6 unicast-routing
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# ipv6 address 2001:db8:acad:2::/64 eui-64
R1(config-if)# no shutdown

• ipv6 unicast-routing makes the router route IPv6 and send Router Advertisements; without it, hosts don't get the prefix via SLAAC.
• ipv6 address fe80::1 link-local replaces the EUI-64 link-local address with a short, easy-to-recognize one. It only needs to be unique on each link.
• eui-64 at the end tells the router to fill in the interface ID from its MAC address.
• ipv6 enable enables IPv6 and creates only the link-local address, with no GUA.

Verification:

The basic router configuration commands (hostname, passwords, SSH, saving the configuration) are in the Cisco IOS commands cheat sheet.

Common mistakes

1. Using :: twice. The address becomes ambiguous, and therefore invalid.
2. Removing the trailing zeros of a group. db80 can't become db8.
3. Forgetting to count the groups when expanding. Always count the visible groups and fill in exactly up to 8.
4. Flipping the wrong bit in EUI-64. It's the seventh bit from the left of the first byte (value 2), not the first and not the last.
5. Thinking DHCPv6 provides the gateway. It doesn't; the gateway is the router's link-local address, learned from the RA.
6. Looking for the broadcast address. IPv6 doesn't have one; "all nodes" means the multicast address ff02::1.
7. Forgetting ipv6 unicast-routing. The interfaces have addresses, but the router doesn't route IPv6 and hosts don't get the prefix via SLAAC.

Exercises

1. Shorten: 2001:0db8:0000:00a0:0000:0000:0000:0bad
2. Shorten to canonical form: fd12:3400:0000:0000:0001:0000:0000:0000
3. Write out in full: 2001:db8:acad::f:1
4. Which addresses are valid? a) 2001:db8::5::1 b) fe80::a:b:c:d c) 2001:db8:0:1:1:1:1:1
5. What type is each address? a) fe80::1 b) fd00:ab::1 c) ff02::2 d) 2001:db8:1::5 e) ::1
6. Calculate the EUI-64 address for MAC D2:1C:44:9A:7B:01 and prefix 2001:db8:cafe:5::/64.
7. How many /64 subnets do you get from a /48? And from a /56?

How to learn IPv6 and make it stick

• Shorten and expand a few addresses every day until it's a reflex. In the exam there's no time to think about the rules.
• Learn the types table like dialing codes: 2 or 3 = global, fe80 = link-local, fd = ULA, ff = multicast.
• Do one complete EUI-64 on paper, in binary. After that you'll see "+2 / −2 on the first byte" without writing out the bits.
• Configure dual-stack in a lab: IPv4 and IPv6 on the same interfaces, then verify with show ipv6 interface brief and ping.
• Tie IPv6 to the layered models: IPv6 is at Layer 3, and so is ICMPv6. If the layers are still fuzzy, see OSI vs TCP/IP.

Frequently asked questions

Routerel is an independent app and is not affiliated with, sponsored by or endorsed by Cisco Systems, Inc. Cisco, CCNA, Cisco IOS and Networking Academy are trademarks of Cisco Systems, Inc.