IPv6 Addresses - LLA & EUI 64

Link Local Addresses

When IPv6 was created, it gave an opportunity to really fix the issues with IPv4 and add some extra features. One of the things that they wanted to do was, when you connect the machine to the network, it automatically be able to create an address and be able to talk onto that network. When you're communicating on a local area network, you need an address to do that, and IPv6 has a method of setting up a link local address that can communicate on that local link.

The local address is an address that's automatically created. It's an IPv6 address. If you have an interface that connects to your network and it's IPv6 enabled, then it will automatically create this link local address. The idea behind this is that when a machine connects into the network, it doesn't need to speak to a DHCP server or be able to find anything else to talk on the local network. It will automatically create this address and be able then to use that address to communicate to all other machines. So that's the link local address.

The address starts out with an FE80 for the IPv6 address, followed by quite a few zeros after that. In fact, the first part of this, the first 64 bits, that's all the network side of it, so the host side of it is another 64 bits, which is pretty big — that's 2 to the 64th power.

So what a link local address will do to be created is it could do one of two methods. It could either randomly create an address with this fixed FE80 part of it, or it could generate it using an EUI-64 and generate the last 64 bits. If it is randomly generated, then that's obviously a huge number, and the chances that some other machine are going to generate that same thing on that network is unlikely, but we would want to just protect against that, because occasionally that would come up. So randomly generated has its weakness, where it could accidentally create an address that something else has as well.

Then you have the EUI-64. The EUI-64 generates based off of the MAC address — and we'll get more in depth into that — generates this address that goes into the link local address. Now that a link local address is created on the machine, then it can connect to the network and start communicating out to all other devices on that network using that link local address.

The MAC Address

That network interface has what's called a MAC address on it, or we also call it a burned in address. That MAC address allows it to communicate to all the devices on a layer 2 network. So this all is a layer 2 network, and that MAC address allows it to communicate on that layer 2 network. Without this MAC address you couldn't communicate out to the rest of the world, because you still have to communicate to the default gateway and get to the rest of the world, and you do that via using these MAC addresses.

So the MAC address is what's called a burned in address, which means it's a physical address. On the factory, when they create these network interfaces, they burn on, or they associate, a MAC address, this physical address, onto that device, and then it gets sent out, and that's what is on all of your devices. So that is a unique 48-bit number. The MAC address is a unique 48-bit number, and no other device in the world should have that same MAC address.

Because of that, we can actually use the MAC address. It's only 48 bits; we're looking for 64 bits for our link local address, for the host portion of that. So what we can do is we can use that MAC address as part of that link local address and incorporate it into that link local address, and it makes it a very unique link local address, and no other devices on your network is going to have that, which is great. So since each of these devices have a different MAC address, it's an easy way of creating a unique address that can communicate to the rest of the network.

How EUI-64 Converts a MAC Address

The EUI-64 is interesting in how it converts from a MAC address into this link local address. Here we have a MAC address right here. You can see it's hexadecimal, and we can see that there are 12 different characters here. So if we take each one of those, it represents four bits, so 4 times 12 is 48. So we've got a total of 48 bits here that we have to work with, whereas the link local needs 64 bits for the host portion of it.

So one of the first steps that happens is that we need to add some characters to this. We need to add a little bit to this, and so what we add is an FFFE to the middle of it. So we split the MAC address in two and we add this FFFE in the middle.

The next step I find a little bit interesting is that we invert the seventh bit. So here we have an A8. A is the first four bits, the 8 is the second four bits, and the seventh bit is this one right here, so it's a two, it changes it by two. So if we get eight, nine, ten, which would be the equivalent of an A. So we've inverted that bit and it changes this to an A.

Now what we can do is we can change that to a formatting that looks a little more in line with IPv6. So this is the host portion of the IPv6 address. Then all we need to do is add the FE80 to the beginning of this, and now we have our link local address.

Security Concerns

One thing to note is that there are some security concerns over this — not so much for a link local address. When you're generating a link local address, it has a MAC address incorporated into it. When you're communicating on your local network, which is all your link local address can do, then you're going to be sending your MAC address back and forth anyways and everybody will see it. But if you were to use this to create something like a global unique address, a GUA, then what can happen is this is like a fingerprint for your machine. So now you're going around the world, and if it's creating a globally unique address based off of EUI-64, essentially it's a little bit of a tracker for wherever your machine has gone. So there's a little bit of concern from a security perspective if you're using EUI-64 to generate all of your addresses, not just your link local. Like I said, it's not as much of a concern with link local, but with some of your other addresses it could be a concern.

Duplicate Address Detection

There really should be no other machines on your network that generate the same address. It should be unique in the world, because your MAC address is unique in the world. However, there is a slight potential that there could be somebody else that's conflicting. There's ways that you could assign a MAC address on a machine, or there are ways that maybe a manufacturer is cheap and is sending out cheap products with similar MAC addresses, the same MAC addresses, or there's maybe some scenarios that something has gone awry and you need that to be unique.

More importantly, this is more when you're randomly generating. If you're randomly generating, your 2 to the 64th power is how many possible combinations you can have, so it's probably going to be unique. But just the odds are, every once in a while you're going to have a conflict, and that is going to be a problem. So we need a mechanism that protects against that, and that's duplicate address detection.

Duplicate address detection allows a machine to auto generate its link local address and then send out a message to it and say, okay, I'm trying to reach this, and hear if there's any responses to it. So that's duplicate address detection, a way to make sure that the machine, that its IPv6 addresses, are unique to the whole network and there's no other devices on the network that have that same address.

Link local addresses are pretty cool. They allow us to just connect on the network without doing a lot of configuration. It can just generate this link local address; a machine will automatically generate it, whether it be off of randomly or EUI-64. In either case, we want to make sure there's no other devices on our network that have the same IP addresses, so it will use that duplicate address detection to make sure that whatever it's come up with is a unique IPv6 address on that network.