Welcome to IPv6
Joni Julian
June 22, 2014
About Me
Why Do I Want It?
- Just because my ISP gives me one IPv4 address to connect to the Internet, that doesn't mean all of the sites I want to reach have any or enough IPv4.
- "You can either do a planned, careful migration, or you can do it in a panic. And you should know full well that panicking is more expensive." - Martin Levy
- I'd rather learn my way around IPv6 without the time crunch panic, thank you.
- NAT makes troubleshooting ... umm ... far too interesting. NATs are stateful, so rebooting is ... interesting. The only way to avoid NAT is not to need more addresses than are available.
IPv6 Basics
- 128-bit addresses as 8 hexadecimal fields separated with colons, not those mere 32-bit addresses of IPv4
- no broadcast, just different kinds of multicast (L2 and link-local work well) and unicast
- no private addresses, just link-local with low TTL and now ULA / unique local addresses from RFC 4193 that can't be routed globally (no NAT loophole either)
- originally, no DHCP, just automatic configuration but now DHCPv6 too
- DHCP also configures additional parameters like DNS and WINS, so DHCPv6 is good for enterprises
- IP Security built-in
- less-used options in IPv4 header are now optional for less overhead
- greenfield, with lessons learned
- flow-labeling for QoS
- IP Security built-in
ICMPv6
You can't turn it off!
Multicast
"there's a multicast group for that"
Wikipedia is your friend
No Broadcast
- IPv6 multicast over Ethernet uses
33:33 + last 32 bits of IPv6 address instead of ff:ff:ff:ff:ff:ff
- IPv6 link-local (VLAN) all hosts address is
ff02::1 instead of 255.255.255.255
What's My Address?
- Unix: still
ifconfig of course
- Linux: also
ip address show
- Windows:
ipconfig or try netsh interface ipv6 show address
hope@moose$ ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:14:4F:01:A6:DA
inet addr:132.91.236.15 Bcast:132.91.239.255 Mask:255.255.252.0
inet6 addr: 2001:db8:1000:2001::13/64 Scope:Global
inet6 addr: fe80::214:4fff:fe01:a6da/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7033253 errors:0 dropped:0 overruns:0 frame:0
TX packets:3272993 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:776277559 (740.3 MiB) TX bytes:718801387 (685.5 MiB)
Many Other IPv6 Addresses
IPv6 can have random addresses that change often thanks to RFC 4941 - Privacy Extensions for Stateless Address Autoconfiguration in IPv6 (the update to RFC 3041)
IPv6 Addresses
A wise co-worker once told me that if you have a handle on IPv6 addresses, you're most of the way to understanding IPv6.
- I have two favorite tools to decode IPv6 addresses, tavian and v6decode.
- Down one layer, the IPv6 ethertype is 0x86DD
IPv6 Scopes
- loopback: local NIC
::1
- link local: (V)LAN only, automatic, unrouted
fe80::/10
- site local:
fec0::/10, deprecated for ULA using fdxx::/8
- global unicast: IANA-assigned unique address
- documentation:
2001:db8::/32
- anycast: one-to-nearest, routers only
IPv6 Scopes for Multicast
- multicast:
ff00:/8 and again with the scopes ...
ff01::1: interface local, all nodes
ff02::1: link local, all nodes
ff01::2: interface local, all routers
ff02::2: link local, all routers
IPv6 Addresses
- You may want to recognize some IPv6 address types on sight.
::1 loopback
fe80::xxxx/10 link-local unicast (VLAN)
x:OUIff:feSN EUI-64 interpretation of host's MAC address
2002::/16 the accepted 6to4 range from IANA but some older versions appear to use 2000 or 2001 if I read SubnetOnline right: just ask tavian or v6decode; 6to4 relay uses 192.88.99.1, the 6to4 anycast IPv4
ff00::/8 multicast
IPv6 Performance
Since "prefer v6" goes 6 then 4, there may be a timeout. Web pages may be partly or entirely blank, and IE has it the worst since it doesn't render as pieces arrive.
ndp
- NDP, Neighbor Discovery Protocol, is part of ICMPv6 from RFC 4443
- NDP starts with a neighbor solicitation (request, ICMPv6 info 135), answered by neighbor advertisement (reply, ICMPv6 info 136)
- sent to solicited-node multicast address of
ff02::1:ff + last 24 bits/3 bytes of IPv6 unicast address + /104 (ref)
- moose has
2001:db8:1000:2001::13 or 2001:0db8:1000:2001:0000:0000:0000:0013 with zeroes, so its solicited node multicast address is ff02::1:ff for multicast plus 00:0013 for moose so ff02::1:ff00:0013 or ff02::1:ff00:13 without leading zeroes
- includes NUD, Neighbor Unreachability Detection
ndp and friends
ndp hostname
-a (all)
-d (delete)
-n (numeric, skip name resolution)
If ndp isn't present, use ip -f inet6 neighbor or ip -6 neighbor show (may use neigh instead)
hope@moose$ sudo ndisc6 bacon6 eth0
Soliciting bacon6 (2001:db8:1000:2001::5) on eth0...
Target link-layer address: 00:14:4F:01:29:8C
from 2001:db8:1000:2001::5
prefer v6
When we added IPv6 to moose's DNS registration, only non-Windows users could ssh in. So I would describe Microsoft's version of "prefer v6" to be "fail badly if IPv6 isn't working" when Linux and Mac failed over to IPv4 silently and quickly under the same circumstances. (My guess is that Mac and Linux listened to the NUD message, and Windows is just a nudnik.)
IPv6 Packet Header
- flow labelling for QoS or netflow v9+
- payload length, next header (for options), hop limit (TTL) are needed
- fewer fields, everything else is optional (no more rarely-used options from the IPv4 packet header)
TCPv6
Most higher-level protocols, like TCP and UDP, are unchanged by IPv6, but some, like FTP and NTP, need specific updates. (ref) The checksum calculation does change for TCP and UDP, though.
Conclusion
All of your network troubleshooting instincts are still valid for IPv6, but some of the commands are updated.
Don't fear the 
from Phil Benchoff
from Wikipedia