A host has five IPv6 addresses. How does it decide which one to use as the source?
Show the answer
Say this first
RFC 6724 defines the rules. For the source: prefer the same address as the destination, then matching scope, avoid deprecated addresses, prefer the outgoing interface, prefer a matching label from the policy table, prefer temporary addresses, then the longest matching prefix. The same RFC also orders destinations when DNS returns several, which is why IPv6 is normally tried before IPv4 and why ULA loses to IPv4.
Go deeper
Source address rules, in order
- Prefer the same address as the destination.
- Prefer the appropriate scope (link-local for link-local destinations, global for global).
- Avoid deprecated addresses (preferred lifetime expired).
- Prefer home addresses (Mobile IPv6).
- Prefer addresses on the outgoing interface.
- Prefer a matching label in the policy table.
- Prefer temporary addresses.
- Use the longest matching prefix.
Default policy table
| Prefix | Precedence | Label |
|---|---|---|
::1/128 | 50 | 0 |
::/0 | 40 | 1 |
::ffff:0:0/96 (IPv4) | 35 | 4 |
2002::/16 (6to4) | 30 | 2 |
2001::/32 (Teredo) | 5 | 5 |
fc00::/7 (ULA) | 3 | 13 |
Destination ordering
With several AAAA and A records, rules such as "prefer matching label" and "prefer higher precedence" put native IPv6 above IPv4, and IPv4 above Teredo, 6to4 and ULA. Happy Eyeballs then races the attempts so a broken path costs only a short delay.
Where to change it
- Linux (glibc):
/etc/gai.conf. - Windows:
netsh interface ipv6 show prefixpolicies, andset prefixpolicyto change it.
They will ask next
Why might a dual-stack laptop use IPv4 to reach an internal server that has a ULA AAAA record?
ULA has precedence 3 and IPv4 has 35, so the A record is tried first. Changing the policy table, or using global addresses internally, fixes it.
The host keeps using an old address after renumbering. Why?
It is still valid. If its preferred lifetime has not expired, rule 3 does not push it down. Deprecate the old prefix by advertising it with a preferred lifetime of 0.
Traps
- Saying the host uses "its first address".
- Forgetting that applications can bind to a specific source and bypass the rules.