0

When using WireShark, WNetWatcher, or any packet analysis tool, it's very easy "at a glance" to identify packets that are originating from the local network versus the Internet, since their address is of the format 192.168.x.x. From my understanding, Ipv6 obsoletes the need for NAT, giving each local device an Internet address instead of a local address.

If this is true, the ability to quickly identify whether an IP address belongs to the local network vs the Internet would seem more difficult. So will be there a way to easily identify local devices at a glance with Ipv6, like there is with Ipv4, just based upon the IP address?

Improve this question

2 Answers 2

Reset to default
2

When using WireShark, WNetWatcher, or any packet analysis tool, it's very easy "at a glance" to identify packets that are originating from the local network versus the Internet, since their address is of the format 192.168.x.x.

IPv4 has three Private address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) defined by RFC 1918, Address Allocation for Private Internets. Not all IPv4 networks use Private addressing, and some with Private addressing use addresses from one of the other Private IPv4 address ranges.

IPv4 Private addressing is not expected to be unique, but reused on other networks around the world. The NAPT variant of NAT used with IPv4 Private addresses is a kludge to extend the life of IPv4 until IPv6 is ubiquitous, and it breaks the end-to-end IP paradigm. IPv6 uses unique addressing (other than Link-Local addressing) to restore the IP end-to-end paradigm where every interface has a unique IP address.

On the local LAN, IPv6 will use multiple networks. IPv6, unlike IPv4, uses multiple addresses and address types on the same network interface.

Every IPv6 interface, even multiple interfaces in the same device, has an address from the same Link-Local address range (fe80::/64). IPv6 interfaces may also have multiple Global (in the 2000::/3 range) and or ULA (in the fc00::/7 range, although the standard has some caveats that will restrict locally defined addresses to the fd00::/8 range with 40 random bits following the first eight bits to define the prefix).

  • Link-Local addresses are confined to the link, and the may be repeated on other links because they are confined to the link, and packets with those addresses cannot be routed to other links.
  • ULA addresses can be routed within an organization or between organizations, but packets with ULA addresses cannot be routed on the public Internet.
  • Global addresses must be unique and can be routed on the public Internet. You should know the prefix used in your local network, e.g. 2001:db8::/64 (in most cases, IPv6 will use /64 networks).

You should be able to determine the locally used networks from the interface(s) of the device (how to do that varies by OS and is off-topic here). You can tell from the prefix of an address if it is one of the local network because the first 64 bits (first four 16-bit address fields) will match the address in your device.

Improve this answer
2

You can identify global unicast addresses by their prefix - either that doesn't change at all or at least the (shorter) ISP prefix doesn't change.

Somewhat similar to IPv4's private RFC 1918 addresses are IPv6 unique local addresses from fd00::/8.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.