IPv6
Understand IPv6 address scope and neighbor behavior, and review dual-stack exposure without assuming IPv4 controls cover every path.
The idea
IPv6 uses 128-bit addresses and supports mechanisms that differ from IPv4, including Neighbor Discovery. Addresses can have different scopes and lifetimes. Dual-stack systems may expose both protocols, so filtering and monitoring need to account for both. Large address space does not remove the need for access policy. Read actual configurations and supported guidance rather than applying every IPv4 rule unchanged.
In practice
A host has both IPv4 and IPv6 connectivity. A control review checks that the intended service restrictions apply on both paths.
A common misunderstanding
Disabling or ignoring IPv6 in one tool does not prove it is absent from the network.
Check your understanding
Why review dual-stack exposure?
Think it through: A service may be reachable through a protocol path that the existing inventory or firewall review missed.
More addresses do not remove boundaries
Imagine a fictional academy enables IPv6 while retaining IPv4. A service can become reachable through both protocol families. If the security review checks only IPv4 listeners and rules, the diagram may miss a working alternative path to the same application.
The problem is not that IPv6 is inherently less safe. It is that the documented policy and actual exposure must cover every enabled path. Review service binding, routing, name resolution, and host controls together rather than treating a protocol-family checkbox as the whole deployment.
Scope affects how an address is used
IPv6 interfaces can have several addresses with different scopes and lifetimes. A link-local address serves a different context from a globally routed address. When recording an observation, retain the relevant interface and scope information instead of assuming every textual address can be used from any location.
Neighbor Discovery performs local-link tasks that IPv4 learners may associate with several different mechanisms. Do not use an ARP-only explanation for an IPv6 troubleshooting case. Configuration and router information need examination in their own protocol context.
Follow one service across both families
Suppose learners report that the portal works on one network and fails on another. The clients could be choosing different resolved addresses or protocol paths. A successful IPv4 test cannot automatically explain an IPv6 failure, or vice versa. Record the selected endpoint and actual exchange before changing a firewall rule.
For a safe exercise, inspect a device you control and list its enabled addresses without publishing them. Explain which are local in scope and which services listen on each family. Compare the intended access policy with both paths. Then state what evidence would demonstrate a restriction is effective. The goal is an accurate inventory and consistent policy, not disabling an unfamiliar protocol merely to make the diagram simpler.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
Cisco: Networking basicsIETF: IPv6 specificationIETF: IPv6 Neighbor Discovery