What are IPv6 privacy addresses, and what do they mean for network operations?
Show the answer
Say this first
Temporary addresses (RFC 8981, which replaced RFC 4941) are SLAAC addresses with a random interface ID that changes regularly, about once a day. Hosts prefer them for outgoing connections, so websites cannot track a device by a fixed address. Alongside them hosts keep a stable address, often an opaque ID per network (RFC 7217) rather than EUI-64. For operations it means one host has several addresses that change, so per-host ACLs on addresses fail and logs need address-to-device mapping.
Go deeper
Two problems, two fixes
| Problem | Fix |
|---|---|
| EUI-64 carries the MAC, trackable across every network | stable opaque IDs (RFC 7217): fixed per network, different between networks |
| One stable address per network lets websites track a session over weeks | temporary addresses (RFC 8981): random, rotated |
Defaults today
- Windows, macOS, iOS and Android create temporary addresses and use them for outgoing traffic.
- Linux:
net.ipv6.conf.<if>.use_tempaddr(0 off, 1 create, 2 create and prefer) andaddr_gen_modefor stable-privacy IDs. Desktop distributions usually turn both on through NetworkManager. - Source address selection (RFC 6724, rule 7) prefers temporary addresses.
What changes for the network team
- Logging: the address in a firewall log may be gone tomorrow. Keep a history of NDP caches, or use switch device tracking (SISF on Cisco), to map address to MAC and port at any time.
- ACLs: write policies per /64 or per identity (802.1X, user-ID on the firewall), not per host address.
- Neighbor tables: more addresses per host means bigger NDP caches on gateways.
- Servers: give them static or stable addresses and turn temporary addresses off.
They will ask next
How would you find which user had an IPv6 address last Tuesday?
Correlate three records: the address-to-MAC binding (NDP cache exports or switch device tracking logs), the MAC-to-port record, and the port's authentication log (802.1X or NAC). Without the first one the address alone tells you only the subnet.
Do privacy addresses hide a device from the local network?
No. The MAC is still visible on the link. They only stop tracking by remote servers.
Traps
- Thinking a host has one IPv6 address you can whitelist.
- Confusing stable opaque IDs with temporary addresses. One stays per network, the other rotates.