On system startup, a node automatically creates a
link-local address on each IPv6-enabled interface, even if globally routable addresses are manually configured or obtained through
configuration protocols (see below). It does so independently and without any prior configuration by
stateless address autoconfiguration (
SLAAC), using a component of the
Neighbor Discovery Protocol. This address is selected with the prefix . In IPv4, typical
configuration protocols include DHCP or PPP. Although
DHCPv6 exists, IPv6 hosts normally use the
Neighbor Discovery Protocol to create a globally routable unicast address: the host sends router solicitation requests and an IPv6
router responds with a prefix assignment.
Interface identifier The lower 64 bits of the address are populated with a 64-bit interface identifier. It can be derived from these sources: • As the name "interface identifier" suggests, it can be the
network adapter's 48-bit
MAC address, which is guaranteed to be unique. A MAC address is turned into a 64-bit
EUI-64 by inserting in the middle: . SLAAC actually uses a modified version of EUI-64 where the meaning of the
Universal/Local bit is inverted: it becomes . • However, using the real MAC address of the adapter to derive the interface address is now frowned upon because it would leak the MAC address all over the Internet, making the user's activities very easy to track. As a result, it is now common to instead use a pseudorandom address. Existing options include the
temporary address, the
stable privacy address, and the
cryptographically generated address. This is related to, but not the same mechanism as,
MAC spoofing; the pseudo-random interface identifier does not need to match the MAC address, real or spoofed.
Temporary addresses The globally unique and static MAC addresses used by stateless address autoconfiguration to create interface identifiers offer an opportunity to track
user equipment across time and IPv6 network prefix changes. To reduce the prospect of a user identity being permanently tied to an IPv6 address portion, a node may create temporary addresses with interface identifiers based on time-varying random bit strings and relatively short lifetimes (hours to days), after which they are replaced with new addresses. Temporary addresses may be used as source addresses for originating connections, while external hosts use a public address by querying the
Domain Name System (DNS). Network interfaces configured for IPv6 use temporary addresses by default in
OS X Lion and later Apple systems as well as in
Windows Vista,
Windows 2008 Server and later Microsoft systems.
Cryptographically generated addresses As a means to enhance security for
Neighbor Discovery Protocol cryptographically generated addresses (CGAs) were introduced in 2005 as part of the
Secure Neighbor Discovery (SEND) protocol. Such an address is generated using two
hash functions that take several inputs. The first uses a public key and a random modifier; the latter being incremented repeatedly until a specific amount of zero bits of the resulting hash is acquired. The second hash function takes the network prefix and the previous hash value. The least significant 64 bits of the second hash result is appended to the 64-bit network prefix to form a 128-bit address. The hash functions can also be used to verify if a specific IPv6 address satisfies the requirement of being a valid CGA. This way, communication can be set up between trusted addresses exclusively.
Stable privacy addresses The use of the
modified EUI-64 format has serious implications for security and privacy concerns, because the underlying hardware address (most typically the
MAC address) is exposed beyond the local network, permitting the tracking of user activities and correlation of user accounts to other information. It also permits vendor-specific attack strategies and reduces the size of the address space for searching for attack targets. Stable privacy addresses were introduced to remedy these shortcomings. They are stable within a specific network but change when moving to another, to improve privacy. They are chosen deterministically, but randomly, in the entire address space of the network. Generation of a stable privacy address is based on a hash function that uses several stable parameters. It is implementation specific, but it is recommended to include at least the network prefix, the name of the network interface, a duplicate address counter, and a secret key. The resulting hash value is used to construct the final address: Typically the 64 least significant bits are concatenated to the 64-bit network prefix, to yield a 128-bit address. If the network prefix is smaller than 64 bits, more bits of the hash are used. If the resulting address does not conflict with existing or reserved addresses, it is assigned to the interface. Conflicts are resolved by adjusting the duplicate address counter.
Neighbor Discovery Protocol operation Solicited-node multicast address Each interface in SLAAC also has a
solicited-node multicast address, formed from the network prefix and the 24 least significant bits of its unicast or anycast address. This
multicast address is used in NDP to detect duplicate addresses and to establish the correspondence between IP addresses and link-layer (MAC) addresses.
Duplicate address detection The use of non-hardware-derived addresses presents a possibility of duplicate addresses. The assignment of a
unicast IPv6 address to an interface involves an internal test for the uniqueness of that address using
Neighbor Solicitation and
Neighbor Advertisement (
ICMPv6 type 135 and 136) messages. While in the process of establishing uniqueness an address has a
tentative state. The node joins the
solicited-node multicast address for the tentative address and sends neighbor solicitations, with the tentative address as the target address and the unspecified address () as its source address. The node also joins the all-hosts multicast address , so it can receive
neighbor advertisements. If a node receives a neighbor solicitation with its own tentative address as the target address, then it knows its address is not unique. The same is true if the node receives a neighbor advertisement with the tentative address as the source of the advertisement. Only after having successfully established that an address is unique may it be assigned and used by an interface. When an
anycast address is assigned to an interface (e.g. a subnet-router anycast address), due to the inherent non-uniqueness of this type of address, duplicate address detection is not performed.
Router operation In NDP the router also advertises what /64-sized prefix it has access to on the broader Internet as well as other network parameters. A node that receives this information joins the prefix with its own interface identifier to obtain its unicast address on the broader Internet. For example, if a router has access to and the machine has the interface identifier (continuing the above example), the machine would self-assign the address . DHCPv6 remains useful for other purposes. For example, it can be used by the ISP's router to hand a /64-sized or shorter prefix to the customer's router, a process called
prefix delegation.
Address lifetime Each IPv6 address that is bound to an interface has a defined lifetime. Lifetimes are infinite, unless configured to a shorter period. There are two lifetimes that govern the state of an address: the
preferred lifetime and the
valid lifetime. Lifetimes can be configured in
routers that provide the values used for autoconfiguration, or specified when manually configuring addresses on interfaces. When an address is assigned to an interface it gets the status
preferred, which it holds during its preferred-lifetime. After that lifetime expires the status becomes
deprecated and no new connections
should be made using this address. The address becomes
invalid after its valid-lifetime also expires; the address is removed from the interface and may be assigned somewhere else on the
Internet. ==Default address selection==