Lion Cipher Lab
Meet IPv6: the addresses your computer already has
- Foundations
- Beginner
- ~50 min
- Free · no account required
Why it matters
Roughly half of the users reaching Google now do so over IPv6, and your laptop is almost certainly one of them: it holds IPv6 addresses right now, obtained automatically, that you have probably never looked at. That matters for security in a very concrete way. Most people's mental model of their own machine — its address, its firewall rules, the log fields they scan — is IPv4-only, so the IPv6 half runs unobserved and often unfiltered. A firewall written in `iptables` alone does not touch IPv6. A detection rule matching on 10.0.0.0/8 never fires on an IPv6 flow. An attacker, or a piece of…
What you'll learn
- listing your machine's real IPv6 addresses on Linux, macOS and Windows
- reading a 128-bit address apart: hex groups, :: compression, prefix vs interface identifier
- telling link-local (fe80::/10), unique local (fc00::/7) and global addresses apart on sight
- using a %interface zone id and understanding why link-local pings need one
- explaining why one interface holds several global addresses (SLAAC plus RFC 8981 temporary addresses)
- recognising a Router Advertisement and telling SLAAC apart from DHCPv6
- reading the NDP neighbour cache as the IPv6 replacement for the ARP table
- auditing your own host firewall for IPv4/IPv6 symmetry and finding rules that only cover one family
- judging the 'a /64 is too big to scan' myth and the 'just disable IPv6' advice
Steps in this lab
- The half of your machine you have never looked at
- Look: list the IPv6 addresses you already have
- Read one apart: 128 bits, eight hex groups, and the :: shortcut
- The /64 line: where the network stops and the machine begins
- The fe80:: address, and why pinging it needs a %zone
- Why you have SEVERAL global addresses: SLAAC and temporary addresses
- The third kind: unique local addresses (fc00::/7) — and what they are NOT
- Where the address came from: the Router Advertisement
- NDP replaced ARP, and multicast replaced broadcast
- Dual-stack in practice: dig AAAA, and which family your browser actually chose
- The payoff: audit your own firewall for a hole you cannot see
- Why NOT to rely on this: "a /64 is too big to scan, so we are fine"
- Rogue Router Advertisements: ARP spoofing's twin
- The judgment call: never "just disable IPv6" — and when you can genuinely ignore it