How do you read IPv6 addresses? It looks like a string of gibberish 240e starting with the 240e, but when you open it, it's actually just three layers

the night I tinkered with the optical modem on IPv6 last month, I was stuck for ten minutes by one sentence: "The 240e on the router's WAN port is a borrowed SLAAC address, no prefix to be added downward." I wrote that article following the investigation process and posted it, but honestly, I only half understood what that sentence meant at the time. Later, I thoroughly read through the entire IPv6 address structure and realized this string of "garbled text" made more sense than I had imagined—along with the old questions like the fe80 in the phone's WiFi details and "why does the phone's IPv6 address change every day?" This article lays out the score.

Why do IPv6 addresses look like this: There are so many addresses that it's endless

first recall why IPv4 looks the way it does. 192.168.1.1, four segments of numbers, each segment from 0 to 255, separated by dots—because the IPv4 address is 32 bits, split into four segments of 8 bits, each segment written in decimal for display. How many addresses can 32 bits represent in total? 2 to the 32nd power is about 4.3 billion units. It was sufficient in the early days, but now global devices have long exceeded this number, which is why NAT sharing exists and the "whole family shares one public IP" solution that has been settling for twenty years.

IPv6 directly increased the address from 32 bits to 128 bits, quadrupling the length. The writing method has also changed: 128 bits are split into 8 groups, each group has 16 bits, written in hexadecimal, separated by colons between groups, like this:

240e:038a:09c1:25d0:7f2e:11aa:33cc:5d16

up to 4 characters per group, 0 to 9 plus a to f. The number of addresses 128 bits can represent is 2 to the power of 128, about 3.4×10^38—340 followed by 36 zeros. This number is so large it doesn't feel real. To put it another way: the prefix segments casually assigned by operators to a single household are far larger than the 4.3 billion IPv4 addresses total. Only with so many addresses do they dare to propose the 'one real public network per device' approach, without squeezing into a single address.

break it down into three layers: carrier

looks scary, but in fact, one address contains three sections of responsibility. Here's the address on my phone right now:

240e:38a:9c1:25d0:7f2e:11aa:33cc:5d16

key dividing line is called '/64', pronounced 'slash 64': the first 64 digits (the first four groups) are the 'network part' and are managed by the network; The last 64 bits (the last four groups) are the 'equipment section', managed by the equipment itself.

the first four groups can still be dismantled. The first three groups 240e:38a:9c1 were distributed by the carrier to my broadband. Telecom home broadband all started with 240e, China Unicom 2408, and China Mobile 2409. You can basically tell which company's cable is from the first group (I mentioned this in the about IPv6 in ). The fourth set of 25d0 is the "subnet number" assigned by the home router—the carrier sends a segment to the home (usually called the /56 prefix). The router selects a small segment of /64 from it and attaches it to the local area network. The fourth group is the segment number.

7f2e:11aa:33cc:5d16 are generated by the device itself; the router doesn't have the final say, and the carrier can't control it either.

here, the phrase that stuck me can be translated into plain language: the optical modem receives a segment of the prefix from the carrier and sends it down to the router, so the router has a 'fourth group' to share with the home devices. If the optical modem isn't sent down (the PD prefix isn't assigned properly), the router can only attach an address to the WAN port for its own use—in other words, the courier has their own work badge but doesn't get permission to give you a home address, so all other devices at home can't get it. This is the root of the problem in the about IPv6 on the optical modem. After a long investigation, the real issue was this structural issue. In the IPv4 world, this work is done by DHCP and the gateway. I wrote about the logic in the about gateways in ; v6 just uses a different scoring method.

"::" is an ellipsis, and FE80 is an extension number

two basic skills for reading addresses.

First, a set with all zeros can be compressed. A whole group of consecutive zeros in an address can be shortened to two colons: 240e:38a:9c1:25d0:0:0:0:5a1abbreviated as 240e:38a:9c1:25d0::5a1. The rule is that the "::" can only appear once in an address—if it appears twice, you can't tell how many groups are missing each location, and the addresses don't match. So when you see: Don't be confused, it's just an ellipsis.

Second, addresses starting with fe80 are 'internal lines.' Once each network card is activated, you don't have to wait for the carrier or router; you can assign yourself an address starting with FE80, called the local link address. In the mobile WiFi details, the string starting with FE80 is this one. Its activity range is limited to within the subnet—routers send notifications, neighbor devices discover each other, and no one recognizes them outside the house. So don't get excited when you see the FE80—that doesn't count as having public V6 at home; To recognize the "global address sent by the carrier," you need to look at the numbers 240e, 2408, 2409.

Why does the phone's IPv6 address change every day: The address used to hide MAC

a while, every few days I would check the V6 address on my phone and find that the last four groups kept changing. At one point, I thought it was the router fault. After checking, they found out it was intentional, and there was a privacy dispute behind it.

oldest address generation method is called EUI-64: split the MAC address of the network card into two halves, insert a ff in the middle, and fe to make 64 bits, then stuff the last four groups of addresses. For example, my old laptop's network card MAC is a4:5e:60:c8:1f:3d. The last four groups generated this way are a65e:60ff:fec8:1f3d — the first byte also has a flag bit, changing A4 to A6. Then the problem arises: the MAC is unique worldwide, which clearly displays the device's fingerprint on the address. Wherever the phone goes to a network, the prefix changes, but the last four groups remain the same, yet people still recognize it as the same device. It's the same logic as I wrote before random MACs, except this time it's the IP address clocking in for you.

so the current system defaults to a "temporary address": the last four groups are randomly generated, prioritized for external connections, replaced with a new one every 24 hours, and the old address becomes completely invalid after 7 days. When ipconfigyou tap down on Windows, you can see a bold column labeled "Temporary IPv6 Address," placed next to the adjacent fixed address, making it easy to tell who is for going out and who is in the household registration book.

had a practical side effect: trying to connect directly to a device at home via V6 from outside, but the address changed and the connection went missing. That's why v6 remote access has always been paired with DDNS domain names for resolution—not just for everyone's sake.

IPv6 world doesn't have such a thing as a NAT

connect the previous sections, and a larger picture emerges.

IPv4 need NAT? 4.3 billion addresses aren't enough to be divided; dozens of devices in the family squeeze a single public IP address, relying entirely on router translation to get in— check if you have a public network IP The 100.64 starting point mentioned in that article is a product of this system. The v6 has so many addresses that it can't be used up, and its design philosophy is 'every device is a true public network,' connecting end-to-end without leaving space for the NAT.

following this line of thinking, a few things made sense. First, why the NAT6 mode Xiaomi router is called a "fake public network": it adds another layer of address translation over V6, so the device receives a fake address, which can go out but not in, completely contradicting V6's original intention—a clichéd compatibility method when "carriers don't add prefixes." Second, port forwarding (which I wrote about in port forwarding and DMZ ) doesn't exist in a pure V6 environment—the address numbers are already unique, so why bother forwarding? The access control work is handed over to the firewall. The v6 firewall on home routers defaults to "blocking incoming and outgoing stations," which feels like it inherits the protection of the NAT era; To connect to the home NAS from outside, you have to manually release the port.

to emphasize security concerns: V6 public networks don't mean naked; inbound access is completely blocked by default, and scanners can't scan your home device. What you really need to watch out for is the opposite situation—you manually opened the pass for remote access and forgot to turn it off after use.

understand these structures, where should you look when investigating

ultimately, addressing the structure isn't for exams, but to know where to look during inspections. I'll compare common situations to the seat:

the inspection order is the same: first confirm whether the carrier has provided it (if you got the prefix), then check if your home router has been split, and only after that is it your turn to discuss which route to use for remote access. The switch on the router side is located differently by manufacturer. I have written about the paths in for Mercury, Xiaomi, and Tenda. The optical modem layer is the most prone to lag, so I wrote it separately in the Telecom optical modem IPv6 and Tenda's WAN selection , flipping as needed.

in the end, here's a sentence: the IPv6 address string is garbled. The first four groups check the network (the carrier gives it plus router points), the last four look at the device (randomly generated by the user), and the middle line is a 64-point dividing line. Next time you run into it in the background or on your phone, at least you'll know who's in charge at every level, and if something goes wrong, you'll know who to go for trouble.