← Interview Prep

IPv6 — Theory

IPv6 end to end: address types & notation (GUA/ULA/link-local/multicast), EUI-64 & privacy addresses, the 40-byte header & extension headers, ICMPv6/NDP (no ARP), SLAAC vs DHCPv6, /64 subnetting, dual-stack & NAT64, and first-hop security.

IPv6 isn't "IPv4 with longer addresses" — it changes address types, drops ARP and broadcast, autoconfigures hosts, and moves options into extension headers. This is the theory to explain end to end: addressing, how a host gets an address (SLAAC/DHCPv6), how neighbors are resolved (NDP), and how you run dual-stack.

The four things that trip people up: there is no broadcast (it's all multicast), no ARP (NDP over ICMPv6), no in-network fragmentation (host-only), and a LAN is almost always a /64 (SLAAC needs it).

Addressing & notation

128 bits, written as eight 16-bit hex groups. Rules: drop leading zeros in a group, and replace one run of all-zero groups with :: (once). 2001:0db8:0000:0000:0000:0000:0000:0001 → 2001:db8::1.

Prefix	Type	Notes
`2000::/3`	Global unicast (GUA)	Routable Internet space.
`fc00::/7` (in practice `fd00::/8`)	Unique Local (ULA)	Private, like RFC 1918; not routed on the Internet.
`fe80::/10`	Link-local	Auto-configured on every interface; never routed; used by NDP/routing protocols. Needs a zone (`fe80::1%eth0`).
`ff00::/8`	Multicast	Replaces broadcast. `ff02::1` all-nodes, `ff02::2` all-routers, solicited-node `ff02::1:ffXX:XXXX`.
`::1` / `::`	Loopback / unspecified	Like 127.0.0.1 / 0.0.0.0.
`::/0`	Default route	—

There is also anycast (same address on many nodes; nearest wins) — but no broadcast. A host has many addresses at once: a link-local, one or more GUAs, the loopback, and several multicast groups it has joined.

Interface identifiers

EUI-64: derive the low 64 bits from the 48-bit MAC — split it, insert fffe in the middle, and flip the 7th bit (U/L). Deterministic but leaks the MAC.
Privacy / temporary addresses (RFC 4941): random, rotating IIDs for outbound privacy; modern stacks also use stable-privacy (RFC 7217) — stable per-network but not MAC-derived.

The header (why it's simpler)

Fixed 40 bytes, no header checksum, no in-network fragmentation, options moved to extension headers. Full field walk in Protocol Headers.

No checksum — L2 (Ethernet FCS) and L4 (mandatory UDP/TCP checksum) already cover it; routers stay fast.
Fragmentation is host-only via a Fragment extension header — routers never fragment, so PMTUD is mandatory (a filtered ICMPv6 "Packet Too Big" is a black hole).
Extension headers chain via Next Header: Hop-by-Hop, Routing (type 4 = SRv6 SRH), Fragment, Destination Options, AH/ESP. Deep/oddly-ordered chains are a real security/parsing concern (RH0 was deprecated for an amplification attack).

ICMPv6 & NDP (there is no ARP)

ICMPv6 (Next Header 58) does far more than in v4 — it carries Neighbor Discovery, MLD, and PMTUD, so you must not blanket-filter it.

NDP message	Type	Job
Router Solicitation / Advertisement	133 / 134	Host finds routers & prefixes (RA drives SLAAC).
Neighbor Solicitation / Advertisement	135 / 136	Resolve IPv6→MAC (ARP's job) and check reachability.
Redirect	137	Better first-hop.

DAD (Duplicate Address Detection): send an NS to your own tentative address before using it.
Solicited-node multicast replaces ARP broadcast: NS goes to ff02::1:ffXX:XXXX so only the likely owner's NIC is interrupted, not the whole segment.

Address autoconfiguration

How a host gets its GUA is driven by flags in the Router Advertisement:

Method	Trigger	Gives
SLAAC	RA with A flag + prefix (`/64`)	Host builds its own address (EUI-64 or privacy). No server, no per-host state.
Stateless DHCPv6	RA O flag	SLAAC address + DHCPv6 only for DNS/NTP etc.
Stateful DHCPv6	RA M flag	DHCPv6 assigns the address (tracked leases, like v4).

SLAAC pros: zero server, plug-and-play, scales. Cons: historically no DNS in the RA (solved by RDNSS option), weaker host tracking/logging, and it needs a /64.
Android still doesn't support stateful DHCPv6 — a real deployment gotcha.

Subnetting & prefix planning

Prefix	Use
`/64`	Every LAN — required for SLAAC/EUI-64. Don't go longer on a host subnet.
`/127`	Router-to-router point-to-point links (RFC 6164) — avoids a NS scan attack.
`/128`	Loopbacks.
`/56`, `/48`	Per-site allocations (a /48 = 65 536 /64s).

Dual-stack & transition

Dual-stack (run v4 and v6 together) is the preferred model; Happy Eyeballs races A/AAAA so users don't feel a slow v6 path.
Tunneling: 6in4, 6rd, GRE — carry v6 over a v4 core.
Translation: NAT64 + DNS64 (v6-only clients reach v4 servers), 464XLAT (v4 apps on a v6-only mobile network). For a large enterprise, prefer dual-stack, falling back to NAT64/DNS64 for v6-only segments — avoid IPv6 NAT (the point of IPv6 is end-to-end addressing).

Routing IPv6

OSPFv3, IS-IS (single topology or multi-topology), and MP-BGP (AFI 2 / IPv6-unicast). Note RFC 5549: advertise IPv4 routes with an IPv6 next-hop — the basis of unnumbered BGP fabrics. See DC IPv6 Architecture.

Security & a few extras

First-hop security: RA Guard (block rogue RAs), DHCPv6 Guard, ND inspection, SEND — the v6 analog of DHCP snooping / dynamic ARP inspection.
Anycast use cases: DNS roots, 6to4 relays, CDN edges.
Mobile IPv6 keeps a node reachable at a stable home address as it roams (home agent + care-of address).
Don't rely on "no NAT = harder to scan": the /64 space is huge, but SLAAC/EUI-64 and DNS make hosts findable — firewall policy still matters.

IPv6 vs IPv4

	IPv4	IPv6
Address	32-bit	128-bit
Header	20–60 B, checksum	40 B fixed, no checksum
Broadcast	Yes	No — multicast/anycast
L2 resolution	ARP	NDP (ICMPv6)
Autoconfig	DHCP	SLAAC and/or DHCPv6
Fragmentation	Host or router	Host only
IPsec	Optional	Designed-in (AH/ESP ext. headers)

Likely interview questions

Address types and their prefixes? (GUA 2000::/3, ULA fd00::/8, link-local fe80::/10, multicast ff00::/8; no broadcast)
How does a host get an address with SLAAC, and what RA flags select SLAAC vs DHCPv6? (A / O / M)
What replaced ARP, and how does solicited-node multicast reduce noise?
Why is there no header checksum and no router fragmentation? (L2/L4 cover it; keep routers fast; PMTUD mandatory)
Why is a LAN a /64, and what do you use for p2p links? (SLAAC/EUI-64; /127)
Dual-stack vs NAT64/DNS64 vs 464XLAT — when each?
What is EUI-64 and why do privacy addresses exist?
Extension headers — how are they chained and what's the security concern?
How do you stop a rogue RA? (RA Guard)