Global IPv6 Address Format

Posted: June 10, 2010 in Uncategorized

One of the big challenges with converting from IP version 4 to IP version 6 is understanding the format of the IPv6 address. Even today, many people have a difficult time working with IPv4 addressing (ex. 172.17.33.14 255.255.240.0, or 172.16.33.14/20) without the use of a computer program so when presented with an IPv6 address (ex. 2001:0db8:30cd:a120:023c:4bff:fe36:2482/64) the job of managing the network can seem much more difficult.

Although IPv6 has many types of addresses such as global unicast, multicast, link-local, and unique-local addresses to name a few, the purpose of this posting will focus on the allocation, and format, of global unicast address assignments. The other address types will be covered in other posts.

In IPv6 the host address is 128 bits in length with the bits representing two different parts of the address. The first of these two parts is the prefix, also know as the network or sub-network, and the second part is the host id. The basic division is 64 bits for the prefix and 64 bits for the host. The reasoning behind this is that IPv6 was designed to support a feature called stateless auto-configuration that allows hosts to automatically determine and configure their address when they connect to the network. The benefit to stateless auto-configuration is that you do not have to manage individual host addresses for every device connecting to the network. The basis behind the “stateless” is that the host will automatically create it’s own host id (also know as the interface id) typically as a derivative of it’s 48-bit mac address. A common method for this is to create a 64-bit extended unique identifier (EUI-64) by expanding the 48-bit mac address to 64-bits by placing a 16-bit value label of 0xFFFE between the 24-bit company-id and the 24-bit extension identifier. Since proper layer 2 operation on a network requires that each host have a unique layer 2 identifier this helps to ensure that each host creating a EUI-64 identifier will be unique. To ensure there is no conflict with an existing host id, the host performing the auto-configuration will conduct a Duplicate Address Detection process before fully configuring its own address. With the ever growing number of devices that are connecting to the IP network, such as PC’s, VOIP phones, mobile phones, iPads, and eventually even appliances, the stateless auto-configuration capability will be a necessity.

To make the management of IPv6 addresses much easier, several conventions have been adopted.

  • The 128 bits are divided into 8 equal segments of 16 bits each with each segment separated by a colon.
  • The value for each of the 16-bit segments is represented in hexadecimal (ex. 2001:0db8:30cd:a120:023c:4bff:fe36:2482/64).
  • The prefix (network or sub-network) is identified by the prefix length represented as a forward slash followed by the number of bits that identify the prefix (ex. /64).
  • Since the address is read from least significant bit (right) to most significant bit (left) leading zeros may be omitted.  (ex. 2001:0db8:0001:0001:0000:0000:0000:0001/64 can be represented as 2001:db8:1:1:0:0:0:1/64).
  • Concurrent groups of zeros can be consolidated within two colons (::).  This can only be done once within an address since the system has to be able to determine how many bits are represented between the double colon by knowing how many bits are represented before and after the double colon. (ex 2001:db8:1:1:0:0:0:1 can be represented as 2001:db8:1:1::1/64)

To be able to fully understand the address, you must understand how addresses are allocated.  The controlling authority for address assignments is the Internet Assigned Numbers Authority (IANA).  IANA has assigned the prefix 2000::/3 as the top level prefix for Global Unicast addresses.  This means that the most significant three bits (/3) must be equal to 2 in hexadecimal so if the most significant digit of an IPv6 address is 2 or 3 (0010 or 0011) the address is in the Global Unicast category.

Under the current guidelines IANA assigns /12 prefixes to each of the five Regional Internet Registries (RIRs).  The five RIRs are the Asia-Pacific Network Information Centre (APNIC – 2400::/12), the African Network Information Center (AfriNIC – 2C00::/12), the American Registry for Internet Numbers (ARIN – 2600::/12), the Latin American and Caribbean Internet Addresses Registry (LACNIC – 2800::/12), and the Reseaux IP Europeens Network Coordination Centre (RIPE NCC – 2A00::/12).  All of these RIRs, with the exception of AfriNIC, have been assigned prefixes up to /23  but for the purpose of this document I have only identified the /12 assignments.

Each RIR is responsible for allocating address space from their prefix to entities in their respective region.  Typically this allocation only goes to Local Internet Registries (LIR, also know as Service Providers) but in special cases the RIR may allocate address space directly to the End User (EU) but this is not currently very common.  The current guideline is to assign a /32 prefix to each LIR.

The LIRs assign address prefix space to the EUs with a minimum value of /64 and a maximum value of /48 based on need.  As stated above, the common usage of the address is up to 64 bits for the prefix and 64 bits for the interface id.  Following this usage, if an EU is assigned a /48 prefix they will have 16 bits that they can use to identify individual network segments (subnets) so they would be able to assign individual prefixes for up to 65,536 network segments.  This would be the same as assigning an IPv4 class A address to an organization that subnets to the 24 bit boundary except that with IPv4 addresses you would only have 8 bits left for hosts which would only allow you 254 hosts per subnet, with IPv6 /64 prefixes you still have 64 host bits which allow you to theoretically have 18,446,744,073,709,551,614 hosts per subnet.  A current guideline for this is to assign a /64 prefix when only one subnet is needed, assign a /56 for small sites that only need “a few” (up to 256) subnets over the next 5 years, and assign a /48 to large organizations.

Assuming an organization is assigned a /48 prefix, they can use the next 16 bits to subnet the prefix for their organization to the /64 boundary.  The remaining 64 bits can be used for the host id utilizing the auto-configuration capabilities.  Addresses may also be assigned to the host level if desired, this is common to maintain some of the currently used conventions like the gateway having the first address on a subnet (ex. 2001:db8:1:1::1/64).

When reading the address of  a host in IPv6 you simply take this hierarchy of the address allocation from IANA.  A “2” or “3” as the most significant digit identifies the address as a Global Unicast Address.  The most significant 3 digits (12-bits) identify the RIR for the region of the world the address applies to (again the RIR prefix could be up to 23 bits but for the purpose of this article and the current guidelines we are focusing on the first 12 bits).  The most significant 32 bits, the first two address segments, represent the Service Provider (LIR).  The following 16 to 32 bits identify the organization  and possibly the specific subnet within the organization.  The remaining bits identify the specific host on the network segment.  An example of this breakdown is shown below.

As an additional note, the prefix show in the examples (2001:db8::/32) is a special purpose address for documentation purposes so the addresses shown are not meant to represent anyone’s personal address.

Comments
  1. So, from looking at your article, if I wanted to block all traffic from Europ, Asia, and Africa in a router (say a Cisco Router), I could do it with something like this:

    access-list blockedips deny 2400::/12 any
    access-list blockedips deny 2C00::/12 any
    access-list blockedips deny 2A00::/12 any

    The syntax of the list may be different, but essentially I could deny the /12 and it would work?

    Have a great day:)
    Patrick.

    • The basis of the article was for the current allocation policy of IPv6 prefixes so for the /12 prefixes, yes this would work.

      ipv6 access-list blocked
      deny 2400::/12 any (for Asia/Pacific)
      deny 2A00::/12 any (for Europe, Middle East, and Central Asia)
      deny 2C00::/12 any (for Africa)

      There are other prefixes assigned to these RIRs that were not listed in the article. They are the following:

      APNIC
      2001:0200::/23
      2001:0C00::/23
      2001:0E00::/23
      2001:4400::/23
      2001:8000::/19
      2001:A000::/20
      2001:B000::/20

      RIPE NCC
      2001:0600::/23
      2001:0800::/23
      2001:0A00::/23
      2001:1400::/23
      2001:1600::/23
      2001:1A00::/23
      2001:1C00::/23
      2001:2000::/20
      2001:3000::/21
      2001:3800::/22
      2001:4000::/23
      2001:4600::/23
      2001:4A00::/23
      2001:4C00::/23
      2001:5000::/20
      2003:0000::/18

      AfriNIC
      2001:4200::/23

      For full exclusion, these would have to be filtered as well. You would want to be careful with trying to consolidate the prefixes because of overlap. For example, APNIC has the prefix 2001:0200::/23 and RIPE NCC has the prefix 2001:0600::/23 and ARIN is right in the middle with 2001:0400::/23.

Leave a comment