IPv4 vs IPv6

Why IPv4 ran out

An IPv4 address is 32 bits long, which allows 2³², or 4,294,967,296, addresses. That looked generous when the protocol was specified in 1981. It is fewer than one per person alive today.

Not all of that space is usable. Large parts are reserved for private networks, loopback, multicast and future use. Early allocations were also generous: some organisations received a /8, a block of 16,777,216 addresses.

IANA, which holds the global pool, handed its last five /8 blocks to the regional registries on 3 February 2011. The registries then ran short one after another: APNIC in April 2011, RIPE NCC in September 2012, LACNIC in June 2014 and ARIN in September 2015. A network that needs IPv4 space today joins a waiting list or buys a block from another organisation.

The internet kept growing by sharing. Home routers put every device behind one public address with NAT, and many providers now add a second layer, carrier-grade NAT, that puts many customers behind one address. It works, but it has costs. Inbound connections need port forwarding or fail outright, and one customer's abuse can land a shared address on a blocklist for everyone using it.

What IPv6 changes

An IPv6 address is 128 bits long. That allows 2¹²⁸ addresses, about 3.4 × 10³⁸. A single standard subnet, a /64, holds 2⁶⁴ addresses, roughly four billion times the entire IPv4 internet.

• No NAT needed. Every device can have its own globally unique address, so nothing has to be shared or translated. The router's firewall, not NAT, is what keeps unsolicited traffic out.
• Devices configure themselves. With stateless address autoconfiguration, or SLAAC, the router announces the network prefix and each device builds the rest of its own address, then checks that no neighbour is already using it. No DHCP server is required, although DHCPv6 exists for networks that want one.
• Privacy extensions. Early implementations built the device half of the address from the network card's hardware address, which made a device recognisable on every network it joined. Current versions of Windows, macOS, iOS and Android generate random identifiers instead, and use temporary addresses for outgoing connections that they replace regularly, often daily.
• Simpler plumbing. The header is a fixed 40 bytes with no checksum, routers never fragment packets, multicast replaces broadcast, and Neighbor Discovery replaces ARP.

How to read an IPv6 address

The full form is eight groups of four hexadecimal digits separated by colons. Two rules shorten it:

1. Drop the leading zeros in any group, so 0db8 becomes db8 and 0000 becomes 0.
2. Replace one run of consecutive all-zero groups with ::. This is allowed only once per address, because with two gaps nobody could tell how many groups each one stands for.

By convention the result is written in lower case and the :: goes on the longest run of zero groups, never on a single group. That is why the second example keeps its lone 0 and compresses the run of three. When two runs tie, as in the third example, the first one is compressed.

A slash and a number give the prefix length, the count of leading bits that identify the network. 2001:db8::/32 is the block reserved for documentation, which is why the examples in this guide use it. The subnet calculator shows the range behind any prefix.

Side by side

Dual-stack and the transition

The two protocols cannot talk to each other directly. An IPv4-only device cannot exchange packets with an IPv6-only one unless something translates in between. So the move is a long overlap, not a switch-over day.

• Dual-stack. The connection carries both protocols. Your device tries both, prefers IPv6 when it works, and falls back to IPv4 within a fraction of a second when it does not. Where a home broadband provider offers IPv6, this is the usual arrangement.
• NAT64 and DNS64. The network runs IPv6 only. When a site has only an IPv4 address, the DNS64 resolver builds an IPv6 address that embeds the IPv4 one, commonly under 64:ff9b::/96, and a NAT64 gateway translates the traffic.
• 464XLAT. This adds a small translator on the device itself, so apps that insist on IPv4 still work across an IPv6-only network. Many mobile networks run this way, which is why a phone on mobile data may have no IPv4 address from the carrier yet still reaches IPv4 sites.
• Tunnels. IPv6 packets travel inside IPv4 ones, as with 6in4 tunnels from a tunnel broker or 6rd run by some providers. DS-Lite does the reverse and carries IPv4 inside IPv6 to a carrier-grade NAT. The older automatic tunnels, 6to4 and Teredo, have largely been retired.

What it means at home

• Usually there is nothing to do. If your provider and router support IPv6, your devices pick it up on their own.
• No IPv6 is not a fault. Everything remains reachable over IPv4. If you want IPv6, check that it is switched on in the router's settings, then ask the provider whether they offer it.
• Hosting works differently. Port forwarding is not needed over IPv6. You allow inbound traffic to the device's own address in the router's firewall instead, then test it with the port checker.
• Check your VPN. A VPN that only tunnels IPv4 leaves IPv6 traffic going out directly. With the VPN on, My IP should not show an IPv6 address from your usual provider.
• Do not expect a speed change. Neither protocol is faster by design.

How to check your connection

The IPv6 test shows whether your connection can reach an IPv6-only server and which protocol your browser prefers when both work. My IP shows both of your addresses side by side. To see whether a website is reachable over IPv6, run a DNS lookup and look for an AAAA record.