IPv4 vs IPv6: Key Differences and Why IPv6 Matters

IPv6 was created to solve one critical problem: IPv4 address exhaustion. IPv4 uses 32-bit addresses, which allows for approximately 4.3 billion unique addresses. While that seemed like an enormous number when IPv4 was designed in the 1980s, the explosion of internet-connected devices — smartphones, tablets, IoT devices, smart appliances, and more — has exhausted the available supply.

IANA (the Internet Assigned Numbers Authority) allocated the last blocks of IPv4 addresses to Regional Internet Registries in 2011. Most RIRs have since exhausted their pools as well. New organizations requesting IP addresses now primarily receive IPv6 allocations, though IPv4 addresses can still be obtained through transfers and market purchases at significant cost.

Address size: IPv4 uses 32-bit addresses (4.3 billion possible). IPv6 uses 128-bit addresses (340 undecillion — that's 340 followed by 36 zeros).

Address format: IPv4 uses decimal notation (192.168.1.1). IPv6 uses hexadecimal notation (2001:0db8:85a3::8a2e:0370:7334).

Header complexity: IPv6 has a simplified header compared to IPv4, making routing more efficient. The IPv6 header is fixed at 40 bytes, while IPv4 headers vary between 20 and 60 bytes.

NAT requirement: IPv4 relies heavily on NAT (Network Address Translation) because there aren't enough public addresses. IPv6 provides enough addresses for every device to have its own public IP, making NAT unnecessary (though it's still sometimes used).

Security: IPv6 was designed with IPsec (encryption and authentication) as a mandatory component, while in IPv4 it's optional. In practice, both protocols can be equally secure when properly configured.

Auto-configuration: IPv6 supports SLAAC (Stateless Address Autoconfiguration), allowing devices to automatically generate their own IP addresses without a DHCP server. IPv4 typically requires DHCP for automatic addressing.

IPv6 adoption has been steadily growing but remains far from universal. As of 2025, approximately 40-45% of global internet traffic uses IPv6, though this varies dramatically by country:

High adoption (>50%): India, Germany, France, the United States, Malaysia, Japan, and Brazil lead in IPv6 deployment.

Low adoption (<10%): Many countries in Africa, Central Asia, and parts of Eastern Europe still have minimal IPv6 deployment.

Major content providers and cloud platforms (Google, Facebook, Netflix, AWS, Azure) fully support IPv6. Most modern operating systems, mobile devices, and home routers support IPv6 out of the box.

The biggest barrier to adoption is the cost and complexity of upgrading legacy infrastructure. Many organizations continue running IPv4 internally because their existing systems work and migration requires significant effort.

For website owners: Make sure your hosting provider supports IPv6 and that your domain has AAAA records alongside A records. This ensures your site is accessible to IPv6-only networks, which are becoming more common on mobile networks.

For email administrators: Configure both A and AAAA records for your mail servers. Some networks are starting to prefer IPv6 for mail delivery.

For home users: Most modern ISPs provide dual-stack connectivity (both IPv4 and IPv6). Your devices likely already use IPv6 without you noticing. You can check whether you have IPv6 connectivity by looking up your IP on LookMyIP.

For developers: If you're building network applications, ensure they support both IPv4 and IPv6. Use address-family-independent APIs and test with both protocols.

The transition to IPv6 is inevitable. While IPv4 will continue to function for years to come, IPv6 adoption is accelerating, and new networks are increasingly IPv6-first.

Almost nobody runs IPv6 alone. The dominant deployment model is dual-stack: the host holds both an IPv4 and an IPv6 address and picks between them per connection.

The picking is not arbitrary. Left to the naive approach — try IPv6, wait for it to time out, fall back to IPv4 — a broken IPv6 path would make every page load take 20 seconds, which is exactly what happened during early deployments and is why several large sites disabled IPv6 entirely around 2010.

The fix is Happy Eyeballs (RFC 8305), implemented in every modern browser and operating system. The client resolves both A and AAAA records, starts the IPv6 connection first, and if it has not completed within roughly 250 milliseconds, starts the IPv4 connection in parallel. Whichever handshake finishes first wins, and the loser is abandoned. The result is that a broken IPv6 path costs a quarter of a second rather than a timeout.

Two practical consequences follow.

Broken IPv6 hides itself. Because the fallback is so fast, users do not report it and you do not notice. A misconfigured AAAA record pointing at a server that no longer listens on IPv6 can sit in your zone for a year, adding 250ms to every connection for IPv6-capable users, with nobody complaining. Test explicitly:

curl -6 -sS -o /dev/null -w '%{http_code}\n' https://example.com
curl -4 -sS -o /dev/null -w '%{http_code}\n' https://example.com

If the first fails and the second succeeds, you have a broken AAAA record.

Your logs will show a mix. Server access logs will contain both address families for the same user across sessions, which breaks naive IP-based rate limiting and session pinning. Rate limit on the IPv6 /64 rather than the individual address, because a single subscriber is routinely allocated an entire /64 and can trivially rotate through billions of addresses inside it.

The gap between IPv4 exhaustion and full IPv6 deployment is bridged by several mechanisms, and knowing which one you are behind explains a lot of otherwise strange behaviour.

CGNAT (Carrier-Grade NAT). Your ISP places many subscribers behind one public IPv4 address, giving you a 100.64.0.0/10 address. Inbound connections are impossible: port forwarding does nothing, and self-hosting requires a tunnel or a relay. This is by far the most common mechanism you will personally hit.

NAT64 / DNS64. Used on IPv6-only networks, notably mobile carriers like T-Mobile US. The network runs a DNS64 resolver that synthesises AAAA records for IPv4-only destinations, mapping them into a special prefix, and a NAT64 gateway translates the traffic. It works transparently for anything using hostnames — and breaks anything that hard-codes a literal IPv4 address, which is why Apple requires iOS apps to work on IPv6-only networks.

464XLAT. Adds a client-side translator so that even IPv4-literal traffic works over an IPv6-only network. This is what makes IPv6-only mobile networks viable in practice.

6to4 and Teredo. Legacy tunnelling mechanisms from the 2000s. Both are deprecated, unreliable, and disabled by default on current systems. If you find one enabled, turn it off — they cause more problems than they solve.

Tunnel brokers. Services like Hurricane Electric provide a routed IPv6 allocation over an IPv4 tunnel. Genuinely useful for learning and testing, but the tunnel endpoint's geolocation will be wrong and many services will classify the addresses as VPN traffic.

If a service tells you your location is hundreds of miles off and you are not using a VPN, a tunnel broker or a CGNAT gateway is the usual explanation.

Beyond address length, several IPv6 design decisions change how you configure things day to day.

No broadcast. IPv6 removed broadcast entirely in favour of multicast groups. ff02::1 reaches all nodes on the link, ff02::2 all routers. Anything that relied on IPv4 broadcast — some discovery protocols, some legacy backup software — needs a different approach.

ARP is replaced by NDP. Neighbour Discovery Protocol runs over ICMPv6 rather than at layer 2. This has a direct security consequence: you cannot block ICMPv6 the way people habitually block ICMP on IPv4. Filtering it wholesale breaks address resolution, router discovery and Path MTU Discovery, and produces networks that half-work in ways that are miserable to debug. RFC 4890 specifies which ICMPv6 types must be permitted.

No fragmentation by routers. IPv4 routers may fragment oversized packets; IPv6 routers may not. The source host must discover the path MTU and size packets accordingly, which relies on receiving ICMPv6 "Packet Too Big" messages. Block those and you get connections that establish fine and then hang on the first large response — the single most common IPv6 firewall mistake.

Addresses are configured by the network, not just by DHCP. SLAAC (Stateless Address Autoconfiguration) lets a host derive its own address from a prefix advertised by the router. DHCPv6 exists but is optional, and Android still does not support it. Networks that assume DHCP-based address assignment for inventory or access control need rethinking.

Subnets are /64, essentially always. SLAAC requires it. Resist the instinct to conserve addresses by using /112 or /120 subnets — the address space is designed to be spent, and non-/64 subnets break autoconfiguration. Even a point-to-point link between two routers conventionally gets a /64.

Every interface has multiple addresses. A link-local fe80:: address always exists alongside any global address, and privacy extensions add rotating temporary addresses. Code that assumes one interface equals one address will misbehave.

Do I need to do anything to use IPv6?

Usually not. If your ISP and router support it, your devices configure themselves and roughly 45% of your traffic to major sites already runs over IPv6 without you noticing. Check what you are actually using with the IP lookup tool — if it reports an address with colons, you are on IPv6 right now.

Should I add AAAA records to my website?

Yes, provided the server genuinely listens on IPv6 and you have tested it. An AAAA record pointing at a server that does not answer costs every IPv6-capable visitor a Happy Eyeballs delay. Adding the record without testing is worse than not adding it.

Is IPv6 more secure than IPv4?

Marginally, and not for the reasons usually claimed. IPsec support is mandatory to implement but not to use, so in practice it is not enabled by default. The lack of NAT means hosts are directly addressable, which removes an accidental firewall many networks were relying on — a stateful firewall becomes genuinely mandatory rather than optional. The vast address space does make brute-force network scanning impractical, which is a real gain.

Will IPv4 ever be turned off?

Not on any foreseeable timetable. Large parts of the internet will stay dual-stack indefinitely. What is changing is the cost: IPv4 addresses now trade at $30–60 each and cloud providers have begun charging for them explicitly, which shifts the economics toward IPv6-only backends with translation at the edge.

Why does my IPv6 address keep changing?

Privacy extensions (RFC 4941) rotate the host portion of your address, typically daily, to make long-term tracking harder. The network prefix stays stable while the last 64 bits change. This is deliberate and generally should be left enabled on client machines — though servers need a stable address, so disable it there.