How IPv6 Addresses Work on Windows

An IPv6 address is 128 bits written as eight groups of four hexadecimal digits. Windows shows several of them at once because a single interface holds more than one address at a time: a link-local address that works only on the local segment, a global address learned from the router, and often a temporary address used for outbound connections. Reading them correctly means knowing which group belongs to which type and what the prefix length after the slash controls.

Reading the notation

Each group is four hex digits, separated by colons. A group of all zeros can be compressed once with ::, and leading zeros inside a group can be dropped. The address 2001:0db8:0000:0000:0000:0000:0000:0001 is written 2001:db8::1. The :: may appear only once in a valid address, because two occurrences would make the expansion ambiguous.

The part after the slash is the prefix length, counted in bits from the left. 2001:db8:1234:5678::/64 means the first 64 bits identify the subnet and the remaining 64 bits identify the interface. In the normal case the first four groups are the network part and the last four groups are the interface identifier.

The address types ipconfig shows

Run ipconfig /all and the IPv6 section lists several addresses. Each has a different scope and a different source.

Link-local (fe80::/10). Every IPv6 interface generates one from its own MAC address or a random value, before any router is contacted. It is used for Neighbor Discovery, router solicitation, and any traffic that stays on the local segment. The % suffix in fe80::1%12 is the interface index, not part of the address; it tells Windows which interface to send on, because the same link-local address can exist on several interfaces.

Global unicast. A routable address built from a prefix the router advertises plus an interface identifier. This is the address a remote host sees.

Temporary addresses. Windows generates a random interface identifier that changes over time and uses it for outbound connections, keeping the stable address for incoming traffic. The privacy extension is on by default in current Windows versions. The temporary address appears in ipconfig alongside the stable one, and both share the same /64 prefix.

Unique local (fd00::/8). The IPv6 equivalent of private addressing, but without NAT. A router can hand out a unique-local prefix for internal traffic while global addresses handle the internet. The range is not routed on the public internet.

Why /64 is the normal subnet size

SLAAC builds the interface identifier from 64 bits. If the subnet prefix were shorter, the host would have fewer than 64 bits for the identifier, and the standard method of forming it no longer applies cleanly. A /64 gives every subnet more addresses than the entire IPv4 internet, so there is no pressure to conserve. Subnets smaller than /64 exist for point-to-point links and some special cases, but a LAN that expects SLAAC uses /64. A Windows machine that receives a router advertisement with a different prefix length may still form an address, but the behaviour depends on the router’s flags and is not the normal configuration.

SLAAC and router advertisements

When an interface comes up, Windows sends a router solicitation to the all-routers multicast address ff02::2. The router replies with a router advertisement containing the prefix, the prefix length, the default route, and flags. Windows combines the advertised prefix with its own interface identifier and configures a global address. No DHCP server is involved.

The advertisement also carries a lifetime. When it expires, the address is deprecated and eventually removed. A router that stops advertising causes addresses to age out, which is why a machine can lose its global address while the link-local address remains.

Where DHCPv6 fits

DHCPv6 can supply addresses, but in most networks it supplies only information the router advertisement does not carry, such as DNS servers. The router advertisement has two flags that control this: the managed flag tells hosts to use DHCPv6 for addresses, and the other-config flag tells them to use it for other settings. A network can run SLAAC for addresses and DHCPv6 for DNS, which is common. A network can also run stateful DHCPv6 for addresses, which is closer to the IPv4 model but not the default.

To see what a Windows machine received, run:

netsh interface ipv6 show interface

The output lists each interface with its index, metric, MTU and state. An interface in Disconnected state will not process advertisements. The index is the number used in the % suffix of a link-local address.

netsh interface ipv6 show route

The output shows the routing table. A default route (::/0) via a link-local next hop means the machine has a router. The absence of that route means the machine has an address but no path off the segment.

No NAT, so the firewall does the work

IPv4 networks commonly hide hosts behind one public address using NAT. IPv6 gives each host a globally routable address, so there is no address translation in the normal design. The protection that NAT incidentally provided against unsolicited inbound connections is not present. Windows Firewall, on by default, blocks inbound connections that do not match a rule. A host with a global address and the firewall disabled is reachable from the internet if the router forwards the traffic, which is a different posture from IPv4 behind NAT.

Neighbor Discovery replaces ARP

IPv4 uses ARP to map an IP address to a MAC address. IPv6 uses Neighbor Discovery, carried over ICMPv6. A host that needs a MAC address sends a neighbor solicitation to the solicited-node multicast address derived from the target address, and the target replies with a neighbor advertisement. The mapping is cached. The command to inspect the cache is:

netsh interface ipv6 show neighbors

The output lists each known neighbor with its link-layer address and state. A state of Reachable means the entry is current; Stale means it has not been confirmed recently but is still used. An empty cache on an active segment usually means no recent traffic to those hosts.

Neighbor Discovery also handles duplicate address detection. Before using an address, a host sends a solicitation for it and waits; a reply means another host already holds it. This is why a newly configured address can take a moment to become usable.

What people get wrong

The common misreading is to treat the link-local address as the machine’s address and conclude that IPv6 is not working because the fe80:: address cannot be reached from another subnet. That is a natural mistake: ipconfig lists the link-local address first, it looks like a complete address, and in IPv4 the first address listed is usually the one that matters. The link-local address is by design confined to one segment. The address that matters for off-segment traffic is the global one, and its absence points to the router advertisement, not to the host.

A second misreading is to assume that a missing DHCP server means no address. SLAAC needs no server. A machine with a global address and no DHCP lease is behaving correctly.

A third is to look for NAT and conclude that the absence of it is a security hole. The firewall is the control, and its state is visible with:

netsh advfirewall show allprofiles state

The output reports ON or OFF for the domain, private, and public profiles. A profile that is off is the condition to correct; the presence or absence of NAT is not the relevant variable.

Predicting behaviour

A machine on a segment whose router advertises a /64 prefix will form a global address, a temporary address, and keep its link-local address. A machine on a segment with no router will keep only the link-local address and will not reach anything off the segment. A machine whose router advertisement carries the other-config flag will query DHCPv6 for DNS but still form its address by SLAAC. A machine with the firewall off and a global address is reachable from outside if the path exists. Each of these follows from the mechanism, not from a setting specific to one machine.