IPv6 Privacy Extensions (RFC 8981)
Definition
A mechanism defined in RFC 8981 (formerly RFC 4941) by which IPv6 hosts generate temporary randomised addresses for outbound connections, rotating them at intervals. These extensions were introduced to prevent long-term tracking of devices by server operators, but they complicate investigator attempts to link an IPv6 address observed in a log back to a specific device without ISP assistance.
- Governing RFC
- RFC 8981, superseding RFC 4941
- Mechanism
- Temporary randomised IPv6 addresses for outbound connections
- Purpose
- Prevents long-term device tracking by server operators
- Investigative effect
- Complicates linking a logged IPv6 address to a device
Common questions
How often do the temporary addresses rotate?+
Implementations vary, but operating systems commonly generate a new temporary address roughly once a day and retain each old one for a limited overlap period, which means a server-side log entry from days apart may show two different addresses for the same device.
How do investigators still attribute an IPv6 address to a device despite the rotation?+
Because rotation is client-side, the ISP retains the mapping between the assigned prefix and the subscriber at the time of the connection, so investigators typically still need ISP subscriber records rather than relying on the address alone to identify the device.
Related terms
- Autonomous System (AS)
- A collection of IP networks operated under a single routing policy and identified by a unique Autonomous System Number (ASN). ISPs, large...
- BGP (Border Gateway Protocol)
- The routing protocol that autonomous systems use to advertise the IP address ranges they control to one another. BGP is the mechanism...
- CIDR (Classless Inter-Domain Routing)
- A compact notation for IP address ranges that appends a prefix length to the address, such as 192.168.1.0/24. The prefix length states...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- RIR (Regional Internet Registry)
- One of five organisations that allocate IP address blocks by region: ARIN (Americas), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific),...