LLA & EUI 64

Let's take a deeper dive into the link local address and EUI-64 and the relationship between those two. We're going to be talking about link local addresses and what they're used for, how the link local address is created, what role EUI-64 plays a part in creating these link local addresses, and then finally DAD, which is duplicate address detection.

Why link local addresses exist

When we went from IPv4 to 6, it was an opportunity to really think of how we were doing things and do things a little differently, and that's exactly what happened. So although there are some similarities between IPv4 and IPv6, there are a lot of differences.

IPv6 was designed so that you could take a machine, plug it into the network, and it could start communicating. It didn't need to reach out to a server, it didn't need to reach out and get information; it could create its own address that would communicate on the network. And that's what link local addresses do: when you plug in a machine, it creates its own link local address and then it is able to communicate to other devices on the network. It didn't need a router, it didn't need a server, it didn't need anything else for it to establish that connection. A link local address is the mechanism that helps do that.

But in addition to that, if it does need information to get outside of that network, to be able to browse the internet, or to reach out to a router or reach out to a server to get additional information, it has some built-in mechanisms that do that as well. It uses something called Neighbor Discovery Protocol, or NDP, and it reaches out and grabs some of that information using this Neighbor Discovery Protocol. But in order for all of that to work, it has to have this link local address; it needs to be created.

How the link local address is created

Your link local address does stay within your network. It does not go beyond your layer 3 device, so it stays to your subnet. That is the link local address, but in order to get out to the outside world you have to get some additional information, and it can use the link local address and some other mechanisms to actually do that, by communicating to other devices on the network.

So it needs to create this link local address, and it can do that in a couple of different ways. One is it could be randomly generated, so on the machine, the machine could randomly generate it. Or it can use this EUI-64, which takes your MAC address and goes through a process to turn it into a link local address. Then you should have a unique address on the network, because your MAC address should be unique in the world, and so this link local address should be unique as well.

A lot of equipment used to use this EUI-64 — Windows used to use it, that was the preferred method originally. But when you are creating things like your global unicast address, and it's going to the outside world, if that did have something like your MAC address incorporated into it, there could be some security concerns with that. And so now it's gone out of favor, to use more of this random method, so now Windows will use a random method of generating it.

Just a side note: in fact, when you create your GUA, your global unicast address, it can actually be set up to be temporary, so then it will cycle through it. As an extra security precaution, you could actually have it change every so often, so you're constantly changing out your global addresses. That's just a side note there.

But this link local address creation here can use a couple of different methods to create it, and it must use it for things like Neighbor Discovery Protocol.

The EUI-64 process

So what does this EUI-64 process look like? First of all, what we do is we split the MAC address in half. Here's a MAC address: we've got a MAC address of aabcc112233. Notice that we've now split this in half and we've inserted in the middle FFFE. So whenever you see this, you can think that this is an address that was created using EUI-64, because it's got this FFFE incorporated into the middle of it.

If that was the only step it would be pretty straightforward. There is a little bit of a catch to this. Step two can be a little more difficult to get down, but that is that the seventh bit needs to be flipped. What that means is if the seventh bit is a zero it needs to become a one, and if it's a one it needs to become a zero. So that's kind of an interesting little twist to this.

If we see this AA right here, then A is 1010, so we translate that into its binary equivalent, which is 10101010. We count seven bits in and we flip that to a zero, so now we see that that is now a zero, so now we've got 10101000. So what that translates to is A8.

If you have noticed, what I've done is I dropped the dashes here. Although you see MAC addresses with both dashes and you see them with colons, I've added colons here, and I've created them as being lowercase. So now this is a little more in the format that we would see in an IPv6 address. And then we insert that into this FE80. So FE80, and now we have a link local address.

So this process of taking the MAC address and putting it through this EUI-64 process, we then have a link local address, and because it has the MAC address incorporated into it, it should be unique on your network.

Duplicate address detection

Now, I say this should be unique, but MAC addresses can be adjusted on your machine, and a random number that comes up has the potential of lining up with somebody else's link local address as well that they elected to take. Even though it's unlikely — how many numbers are involved in this makes it real unlikely that there's going to be another device that chooses the same address as what your device has chosen — it is a possibility, and when it's a possibility it will come up now and then. So we need some sort of mechanism that helps discover if there's a duplicate address.

Because there is nothing orchestrating this — there is no DHCP server that hands out addresses to make sure that there's not duplicates on the network, because there's not a single source for assigning these addresses — we have to have this method that detects if there's duplicate addresses on the network. And so that's what this process does: the duplicate address detection, or DAD.

The duplicate address detection is a way for a device to come up with its link local address without consulting anything else on the network, and then what it will do is it will send out a test message to see if anybody responds to that test message. If they do send a message back, then this machine knows I'm going to have to choose some other number, because some device on the network already has elected to take that link local address. So that's the mechanism that allows us to do that double check: it's duplicate address detection, or DAD.

What we've talked about is link local addresses and how it's a must for IPv6 interfaces to have this link local address. We talked about the link local address creation, and there's a couple of ways that it can be created; one of those methods is to go through the process of the EUI-64, and it takes the MAC address to generate that. And finally we talked about how, since it is a process that could come up with a duplicate address on the network, it's got to use duplicate address detection to make sure no other device is assigned that same link local address.