IPv6 Address Architecture: Scopes and Topological Boundaries
In traditional IPv4 networking, a device generally possesses a single IP address per network interface, which is either public (Internet-routable) or private (RFC 1918 space behind NAT). In stark contrast, IPv6 mandates multiple concurrent addresses per interface, each designated for a specific architectural scope.
An IPv6 host routinely operates with three or more active addresses on the same Ethernet or Wi-Fi adapter: a Link-Local Unicast address for communicating with local switches and default routers, a Global Unicast addressfor Internet access, and multiple Multicast group memberships for Neighbor Discovery and service discovery. Understanding the scope boundaries defined by RFC 4291 is vital for diagnosing connectivity failures and firewall security leaks.
The Core IPv6 Address Scopes
Automatically generated on every interface upon boot. Non-routable beyond the local physical link (Layer 2 switch or VLAN). Used exclusively for Neighbor Discovery Protocol (NDP), Router Advertisements (RA), and next-hop gateway peering.
Defined by RFC 4193. Replaces IPv4 RFC 1918 private space. Routable across private corporate networks, VPN mesh overlays, and inter-data center circuits, but strictly filtered and blocked by public Internet transit routers.
Globally routable public addresses allocated by Regional Internet Registries (ARIN, RIPE NCC, APNIC). Comprises all addresses from 2000:: through 3fff:ffff:....
Multicast Addressing Structure (ff00::/8)
Because broadcast is obsolete in IPv6, all one-to-many communication uses multicast. An IPv6 multicast address begins with the prefix ff00::/8 followed by a 4-bit Flags field and a 4-bit Scope field:
| Scope Value | Scope Name | Propagation Boundary | Common Group Example |
|---|---|---|---|
| 0x1 | Interface-Local | Single interface on local host (never exits device) | ff01::1 (All-Nodes) |
| 0x2 | Link-Local | Same Layer 2 switch/VLAN (routers do not forward) | ff02::1 (All Nodes), ff02::2 (All Routers) |
| 0x5 | Site-Local | Spans single corporate campus or enterprise location | ff05::1:3 (All DHCP Servers) |
| 0x8 | Organization-Local | Spans multiple sites within enterprise boundaries | Enterprise media streaming |
| 0xE | Global Scope | Unrestricted worldwide Internet multicast | NTP or global multicast TV |
Privacy Advisory: The EUI-64 MAC Address Leak
In original IPv6 implementations, SLAAC constructed the 64-bit interface identifier by inserting the 16-bit marker ff:fe into the host's 48-bit hardware MAC address (Modified EUI-64 format). While convenient, this creates an enormous privacy and tracking vulnerability: the device's immutable hardware serial number is permanently exposed in every web request and server connection, allowing advertisers and malicious actors to track the user across different Wi-Fi networks.
Modern operating systems mitigate this vulnerability by implementing RFC 4941 Privacy Extensions (which randomize the interface identifier on a daily or hourly basis) and RFC 7217 Stable Semantically Opaque addresses for server hosts.
Frequently Asked Questions (FAQ)
Yes. Because Link-Local addresses (fe80::/10) are confined strictly to the local Layer 2 link, they do not need to be globally unique. To ping a link-local address, you must append the interface zone index (e.g. fe80::1%eth0 on Linux or fe80::1%12 on Windows).
Site-Local addresses caused routing ambiguity because routers could not define where a "site" began or ended. They were formally deprecated and replaced by Unique Local Addresses (RFC 4193), which utilize a 40-bit pseudo-random global ID to prevent address collisions when merging corporate networks.
Defined by RFC 6666, 100::/64 is designated as the Discard-Only prefix. Network operators use it to blackhole traffic and configure routing null routes without generating ICMP destination unreachable storms.