10

This is probably going to sound like an ignorant question, so forgive me if I'm missing something obvious here.

To my understanding, the point of dynamic IP addresses with IPv4 was due to the fact that there weren't enough addresses to go around for everyone. Cycling the addresses allowed people to use an available address to avoid two people having the same IP address.

Now with IPv6, this is something that still seems to be going on. If I use an online IPv6 test, it will report different addresses on occasion. Given the sheer number of addresses IPv6 can support, why aren't the addresses static? Is there a security reason for this? Some practical reason I'm not aware of? Or is it simply just for ISPs to continue selling static IPs at higher prices?

Improve this question
1
  • 1
    I'd imagine static IPs would be impractical for phones and laptops that roam in and out of different networks from different ISPs.
    – Gen Test
    Commented Sep 5, 2019 at 17:22

2 Answers 2

Reset to default
8

Devices on the Internet are assigned a unique IPv6 address, which causes concerns for privacy and tracking.

To mitigate the problem, the IPv6 address assigned to a device by the local router is dynamically changed from time to time according to configured parameters.

The IPv6 stateless address autoconfiguration generates addresses using a combination of locally available information and information advertised by routers. Addresses are formed by combining network prefixes assigned by the ISP with an interface identifier generated locally, usually incorporating elements from the device's MAC address and a random part.

IPv6 addresses have 128 bits, where the most-significant 64 bits are the routing prefix from the ISP and the local area assigns the other 64 bits.

This is why your devices will have different IPv6 addresses whenever you restart the device or exceed some router parameters.

For assigning IPv6 addresses, there are two flavors: Stateful DHCPv6 and Stateless DHCPv6. You may read more about it in this answer of mine, and in Wikipedia IPv6 Addressing.

Improve this answer
5
  • So it's the router that makes the addresses dynamic, rather than the ISP? I assume that would have to be disabled, if you were to run a server, correct? Or would you still also need to change your ISP plan/options to make it possible to run a public server?
    – hiigaran
    Commented Sep 5, 2019 at 17:44
  • It's potentially both. The router may receive different IPv6 prefixes from the ISP and may append its variable part. There are many algorithms and configurations possible, but this is how it works in general. There exist also static IPv6 addresses, same as in IPv4.
    – harrymc
    Commented Sep 5, 2019 at 17:48
  • Right, so with SLAAC, I've noticed that online IPv6 tests mention I need to reconfigure my firewall to disable ICMPv6 message filtering. Any idea what I'd need to look for in my settings?
    – hiigaran
    Commented Sep 5, 2019 at 17:53
  • 1
    I think that rightly belongs in a new question with full details of your router.
    – harrymc
    Commented Sep 5, 2019 at 17:54
  • @hiigaran: Those are mostly unrelated. SLAAC works entirely within the LAN, while online tests usually talk about ICMPv6 messages coming from the WAN. The recommendation is to unblock the latter, and that's because ICMP is usually overblocked – admins whack it away and forget to allow the useful bits.
    – grawity_u1686
    Commented Sep 5, 2019 at 18:02
6

Now with IPv6, this is something that still seems to be going on. If I use an online IPv6 test, it will report different addresses on occasion. Given the sheer number of addresses IPv6 can support, why aren't the addresses static? Is there a security reason for this? Some practical reason I'm not aware of? Or is it simply just for ISPs to continue selling static IPs at higher prices?

IPv6 addresses are generally assigned in two or three parts: the 48–64 bit prefix (i.e. address range) given to a customer by ISP; the 0–16 bit subnet ID chosen by the customer (or their router); and the 64-bit suffix (interface ID) usually chosen by the device itself. All parts can perfectly well be static.

For home customers the prefix is usually assigned via DHCPv6 Prefix Delegation, and just like an IPv4 DHCP-assigned address it can remain static as long as the router keeps re-requesting the same lease – essentially forever.

If you get a dynamic prefix, that's sometimes a router problem (it's not using the same DUID) but more commonly the ISP deliberately gives you a different prefix every time. (As with IPv4, this can be either for 'privacy' reasons, or because of technical issues, or because they want to charge you more on a "business" plan.)

Dynamically allocated prefixes are not due to address shortage. An ISP always starts with at least a /32 address range (or even a /29 very easily), and going by the current recommendation of "/56 per customer", this already provides space for 16 million customers (or 134 million if the ISP has a /29). The latter number is practically 1/32'th of the entire IPv4 Internet, and larger ISPs can still get more.

The suffix is a different story since it's usually chosen by the device itself (the router only broadcasts the 64-bit prefix to use). In the beginning, all suffixes were based directly on the MAC address, and this was a bit of a privacy issue – e.g. with a mobile phone you would get the same suffix everywhere, so a website could easily track your movements.

To avoid this, RFC 4941 "Privacy Extensions" were introduced, which had devices additionally generate a completely random temporary suffix and change it every 10 hours. This is probably what you're seeing in websites. (The static MAC-based address still remains perfectly usable though, just not revealed to websites by default.)

More recently, to combine the best of both worlds, RFC 7217 "stable privacy" addresses were introduced. These replace MAC-based suffixes with hash-based ones; the suffix looks completely random but remains stable as long as the prefix remains stable. (However, if you move to a different network or if the ISP issues you a different prefix, the suffix becomes different as well.)

However, even if these new addresses are in use (such as in recent Windows versions), they don't supersede the periodically-rotated "Privacy Extensions" addresses – you still get both the stable one and the temporary one.

So in short:

  • If the first half of the address keeps changing, call your ISP or search various IPv6-related forums.

  • If the second half of the address keeps changing, disable 'Privacy Extensions' in your operating system.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .