IPv6, APIPA, and choosing between static and dynamic addressing

Why this matters

Two of the three things in this lesson are diagnostic gifts. An APIPA address is a machine telling you precisely what went wrong, in a form you can read at a glance. An IPv6 link-local address is the same kind of signal. Candidates who recognise them answer those questions in seconds; candidates who do not treat them as unfamiliar numbers and guess.

The third thing — choosing between static and dynamic — is a judgement question that the exam asks in scenario form, and it has a defensible answer every time once you know what each choice costs.

IPv6 gets a smaller share of this exam than its importance in the world suggests, but what is asked is specific: read an address, shorten one, and know what the address types mean.

The lesson

IPv6 address shape, shortening rules, and reading one without panic

An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits separated by colons:

2001:0db8:0000:0000:0000:ff00:0042:8329

Two rules compress it, and both are examinable:

1. Leading zeros in a group may be dropped. 0db8 becomes db8, 0000 becomes 0.
2. One run of consecutive all-zero groups may be replaced with ::. Only one, because two would be ambiguous — a reader could not tell how many zeros belonged to each.

Applying both: 2001:db8::ff00:42:8329.

Expanding works in reverse: count the groups present, and the :: stands for however many all-zero groups are needed to reach eight.

The address types to recognise:

• Global unicast, typically beginning 2000 to 3fff. Routable on the internet, the equivalent of a public IPv4 address.
• Link-local, always beginning fe80::. Automatically configured on every IPv6 interface, valid only on that link, never routed. Seeing one is normal, not a fault.
• Unique local, beginning fc00 or fd00. The rough equivalent of the private IPv4 ranges.
• Multicast, beginning ff00. IPv6 has no broadcast at all; its jobs are done by multicast groups.
• Loopback, which is ::1.

Notation detail worth knowing: in a URL an IPv6 address is enclosed in square brackets, because the colons would otherwise collide with the port separator.

Link-local addresses, and what it means when a machine has only one

Every IPv6 interface configures a link-local address for itself, without any server. It is how neighbour discovery works — IPv6's replacement for ARP — and it exists even on a completely isolated segment.

So a machine holding only an fe80 address has a working IPv6 stack and no router advertisement and no DHCPv6 response. That is the IPv6 equivalent of the APIPA state below, and it means the same thing: the local stack is fine, and nothing upstream is telling it what network it is on.

A global IPv6 address is obtained in one of two ways, and knowing which a network uses is part of diagnosing it:

• Stateless autoconfiguration, where the router advertises a prefix and the host builds its own address from it. No server involved.
• DHCPv6, which works like IPv4 DHCP and can supply other settings.

Many networks use both: autoconfiguration for the address, DHCPv6 for the DNS servers. A host with a global address and no name resolution on an IPv6-only network is usually that combination half-working.

APIPA: the address that tells you DHCP failed, and why it is a diagnosis

When a host is configured for DHCP and gets no reply, it assigns itself an address from 169.254.0.0/16. That is APIPA, and it is the single most informative address in this exam.

What it proves, all at once:

• The network adapter is working and enabled.
• The TCP/IP stack is working.
• The host is configured for DHCP rather than static.
• No DHCP server answered.

What it does not prove is where the failure is. The candidate causes, roughly in order of frequency:

• The cable is unplugged or the port is dead, so the discover never left.
• The wireless client failed to associate, so the same.
• The DHCP service is down.
• The scope is exhausted — every address leased, none free.
• A relay is missing on a routed segment.
• A switch port issue is preventing the broadcast from reaching the server.

Hosts with APIPA addresses can talk to other APIPA hosts on the same segment, which occasionally produces the confusing report that two machines can see each other but neither can reach anything else. That is two failed DHCP clients finding one another, not a working network.

The remedial sequence is: check physical connectivity, release and renew the lease, and only then investigate the server. Most APIPA calls are resolved at step one.

When a static address is correct, and the three things that must be set with it

A static address is right when something needs to be found at a known location and cannot rely on a server to arrange it:

• The DHCP server itself, which cannot lease an address to itself.
• Routers and firewalls, which must be reachable before anything else works.
• Switch and access point management interfaces.
• Servers and network printers, where a reservation is usually the better answer, as lesson 11 argued.

When setting one by hand, three fields must be set alongside the address, and each has a failure signature if it is missed:

1. Subnet mask. Wrong value produces the delivery-decision faults from lesson 12.
2. Default gateway. Missing produces local-only connectivity.
3. DNS servers. Missing produces addresses working and names failing.

And two rules about the address itself: it must be outside the DHCP pool, or excluded from it, or a conflict is coming; and it must be recorded somewhere, because an undocumented static address is a future address conflict that nobody will be able to explain.

Dual-stack behaviour, and why a host may prefer one protocol over the other

Most modern hosts run dual-stack: IPv4 and IPv6 simultaneously, each with its own address, mask or prefix, gateway and resolver settings. The two stacks are independent, and either can fail while the other works.

That produces behaviour that is genuinely confusing without the model:

• A host generally prefers IPv6 when a name resolves to both an A and an AAAA record. If the IPv6 path is broken, the connection attempt may stall before falling back to IPv4 — which presents as a site that is slow to start and then fine.
• A ping to a name may return an IPv6 address on a network the technician thought was IPv4-only. That is not a fault; it is the AAAA record being preferred.
• Disabling IPv6 "to fix things" is a widespread habit and usually a way of hiding a misconfiguration rather than resolving it. It also breaks features on some platforms that assume IPv6 is present.

The diagnostic habit is to test each stack explicitly: force IPv4 or IPv6 in the ping and tracing tools, and compare. A name that resolves and a connection that stalls, where forcing IPv4 works immediately, is a broken IPv6 path — and that is a complete diagnosis rather than a mystery.