Unit 2: Addresses and subnets · Lesson 4 of 7 · 16 min
IPv6 addresses
Read, shorten and size IPv6 prefixes, and see why every subnet is a /64.
mission
- You are
- The analyst reviewing an IPv6 rollout.
- Situation
- corp.example has been given the prefix 2001:db8:abcd::/48. Logs will soon show long addresses that people write in different ways.
- Goal
- Learn to read IPv6 consistently and work out how many subnets the company has.
- Hand in
- The number of /64 subnets in the company prefix.
Reading an IPv6 address
- 1
2001:db8:abcdthe /48 given to corp.example - 2
001216 bits to number the company's subnets - 3
0:0:0:1064 bits for the host
Shorten and expand
Leading zeros in each group can be dropped, and one run of zero groups becomes ::. Python's ipaddress module does both and is the safest way to normalise logs.
python3 -c "import ipaddress as i; print(i.ip_address('2001:0db8:0000:0000:0000:0000:0000:0010'))" 2001:db8::10 python3 -c "import ipaddress as i; print(i.ip_address('2001:db8::10').exploded)" 2001:0db8:0000:0000:0000:0000:0000:0010
you should see Both spellings name the same address.
defender tip Normalise addresses before you search or count them. The same host can appear three different ways in three different logs.
Count the subnets
Every IPv6 subnet is a /64, so a /48 leaves 16 bits to number subnets.
python3 -c "import ipaddress as i; s=list(i.ip_network('2001:db8:abcd::/48').subnets(new_prefix=64)); print(len(s), s[0], s[1], s[-1])"
65536 2001:db8:abcd::/64 2001:db8:abcd:1::/64 2001:db8:abcd:ffff::/64
you should see 65,536 subnets, numbered in the fourth group.
Recognise special ranges
Some prefixes never leave the local link or the organisation. The module can tell you which.
python3 -c "import ipaddress as i; [print(a, i.ip_address(a).is_link_local) for a in ['fe80::1','fd12:3456::10','::1']]"
fe80::1 True
fd12:3456::10 False
::1 False
you should see fe80:: is link-local. fd00::/8 is the private range for organisations, and ::1 is loopback.
IPv6 ranges to know
| Command | What it does |
|---|---|
::1 | Loopback |
fe80::/10 | Link-local, every interface has one, never routed |
fc00::/7 (fd..) | Unique local, the private range |
2001:db8::/32 | Documentation, used in this course |
2000::/3 | Global unicast, the public internet |
Check whether an address belongs to a prefix
Membership tests are how you match IPv6 addresses in logs against your plan.
python3 -c "import ipaddress as i; print(i.ip_address('2001:db8:10::57') in i.ip_network('2001:db8:10::/64'), i.ip_address('2001:db8:66::57') in i.ip_network('2001:db8:10::/64'))"
True False
you should see The first address is in the office /64. The second, from 2001:db8:66::, is not part of the plan at all.
What a defender takes away
- 1Normalise IPv6 before you compare or count.
- 2Every subnet is a /64. Plan by subnets, not by hosts.
- 3Firewall rules need IPv6 versions too, or the new path is wide open.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.