IPv4 vs IPv6: Why the Internet Needs a New Address System

Today I studied networking fundamentals: how networks are designed, how switches and routers move data, and how IP addresses work. The topic that stayed with me most was IP addressing, so this post is about IPv4, IPv6, and why we are moving from one to the other.

What an IP address does

Every device on a network needs an address, just like every house needs one so the post can reach it. When I open a website, my laptop sends packets to the server’s IP address, and the server sends replies back to mine.

IPv4: the address we all know

An IPv4 address looks like this: 192.168.1.10

It is 32 bits long, written as four numbers from 0 to 255. Each number is 8 bits.

32 bits gives about 4.3 billion addresses. In the 1980s that looked like more than enough. Today there are far more phones, laptops, servers, cameras and smart devices than that.

The free pool of IPv4 addresses ran out years ago. New addresses are now hard to get and are even bought and sold.

How IPv4 has survived so long

The main trick is NAT (Network Address Translation).

At home, all my devices use private addresses like 192.168.x.x. My router has one public IP address and shares it with all of them. These private ranges are reused in millions of homes and offices.

NAT works, but it is a patch. It adds complexity, and it hides which device inside a network actually made a connection.

IPv6: the long-term fix

An IPv6 address looks like this: 2001:0db8:0000:0000:0000:0000:0000:0001

It is 128 bits long, written in hexadecimal, in 8 groups.

That is about 340 undecillion addresses (a 39-digit number). Every device can have its own public address, so NAT is no longer needed for address shortage.

IPv6 addresses can be shortened:

• Leading zeros in a group can be dropped: 0db8 becomes db8
• One run of all-zero groups can be replaced with ::

So the address above becomes 2001:db8::1.

IPv6 also lets devices configure their own address automatically (SLAAC), so a DHCP server is not always required.

Why the change is slow

IPv4 and IPv6 cannot talk to each other directly. Old devices, software and networks all have to be updated. So for now, most networks run dual stack: IPv4 and IPv6 side by side.

Why this matters for a SOC engineer

Logs are full of IP addresses. If I only know IPv4, I will miss half the picture as more traffic moves to IPv6. An attacker’s connection could come from an IPv6 address that a simple IPv4-only rule never checks.

NAT also matters in investigations. If an alert shows one public IP, there may be many devices behind it. To find the real machine, you need the internal logs too.

Other things I covered today

• Network design: access, distribution and core layers
• Cloud and virtualization: many virtual machines on one physical server
• Number systems: converting between binary, decimal and hex
• Ethernet switching: how a switch learns MAC addresses and builds its MAC table

Next

Next I want to practice subnetting until it feels quick and natural.