ExamFinch.com My Study

Study guide

6.3 IPv6 Fundamentals

Practice this exam

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

6.3 IPv6 Fundamentals

Key Takeaways Explain This Topic AI

IPv6 addresses are 128 bits long, written as eight groups of four hexadecimal digits separated by colons

Leading zeros in a hextet may be dropped; one contiguous run of all-zero hextets may be replaced with ::

The interface ID is typically 64 bits; common LAN prefix length is /64

Link-local addresses use fe80::/10; unique local addresses often use fc00::/7 (commonly fd00::/8 in practice)

  • IPv6 has no broadcast — it uses unicast, multicast, and anycast addressing models
  • Last updated: July 2026

IPv4's 32-bit space is exhausted for practical global allocation. IPv6 expands the address to 128 bits , providing an enormous pool and simplifying some addressing patterns. The Cyber Test expects you to read IPv6 notation, apply compression rules, and recognize major address types — not design an enterprise dual-stack rollout.

  • Address Length and Written Form
  • Length: 128 bits
  • Grouping: eight hextets (16-bit groups)
  • Alphabet: hexadecimal digits 0–9 and a–f (case-insensitive)
  • Separator: colon ( : ), not a dot

Fully written example:

2001:0db8:0000:0000:0000:0000:0000:0001

That is one address. Writing every leading zero every time is painful, so IPv6 defines shortening rules.

  • Compression Rules (Must Memorize)
  • Rule 1 — Drop leading zeros in a hextet
  • 2001:0db8:0000:0042:0000:8a2e:0370:7334
  • becomes
  • 2001:db8:0:42:0:8a2e:370:7334

You may remove leading zeros inside each hextet, but you must leave at least one digit ( 0 stays as 0 , not empty).

Rule 2 — Replace one contiguous run of all-zero hextets with ::

The longest consecutive sequence of 0 hextets can be replaced by :: — and you may do this only once in an address. Using :: twice would make the length ambiguous.

  • Full: 2001:0db8:0000:0000:0000:0000:0000:0001
  • Compressed: 2001:db8::1

Another example:

  • fe80:0000:0000:0000:0202:b3ff:fe1e:8329 → fe80::202:b3ff:fe1e:8329
  • Ambiguity trap
  • Invalid (two compressions): 2001::db8::1

Valid choice when multiple zero runs exist: compress the longest run. If two runs are equal length, convention prefers the leftmost run (be consistent with RFC 5952 style thinking for exam purposes: one :: only).

Mixed IPv4 embedding (awareness)

You may see forms like ::ffff:192.0.2.1 for IPv4-mapped IPv6 addresses. Know that IPv6 can represent transition cases; focus first on pure hex colon notation.

Prefix Lengths and the /64 Habit

Like IPv4 CIDR, IPv6 uses prefix length after a slash:

2001:db8:abcd:0012::/64

Common meanings:

  • Prefix Typical role
  • /128 Single host address
  • /64 Standard LAN / subnet size (64-bit network + 64-bit interface ID)
  • /48 Site allocation (many /64s inside)
  • /32 Larger provider or organization block

On most Ethernet LANs, the first 64 bits identify the subnet and the last 64 bits are the interface identifier (often derived from MAC via EUI-64, or randomly assigned for privacy).

Major IPv6 Address Types

IPv6 does not use broadcast. Traffic models are:

  • Type Idea Exam examples
  • Unicast One-to-one Global unicast, link-local, unique local
  • Multicast One-to-many interested receivers Starts with ff00::/8
  • Anycast One-to-nearest of a shared address Same format as unicast; special routing treatment
  • Global unicast

Globally routable addresses, commonly in 2000::/3 (addresses starting with 2 or 3 in the first hextet). Documentation space 2001:db8::/32 appears in textbooks and examples — treat it like IPv4's 192.0.2.0/24 documentation range.

Link-local

Every IPv6 interface autoconfigures a link-local address in fe80::/10 (you will usually see addresses starting with fe80: ). Link-local traffic does not route off the local link. Neighbor Discovery uses link-local heavily (IPv6's replacement for much of IPv4 ARP behavior).

Unique local (ULA)

Private-like site-local addressing for IPv6 often uses fc00::/7 , with locally assigned addresses commonly appearing as fd00::/8 . These are not meant for global Internet routing — analogous in spirit to RFC 1918, though the rules and allocation differ.

Loopback and unspecified

  • Address Meaning
  • ::1/128 Loopback (like IPv4 127.0.0.1 )
  • ::/128 Unspecified address (like "no address yet")
  • Multicast quick ID

If the address begins with ff , think multicast. Example well-known idea: all-nodes link-local multicast ff02::1 .

Side-by-Side: IPv4 vs IPv6

  • Topic IPv4 IPv6
  • Bits 32 128
  • Text form Dotted decimal Colon hex

Compression N/A Leading zeros + one ::

  • Private-ish 10/8, 172.16/12, 192.168/16 ULA fc00::/7 (often fd… )
  • Link-local 169.254.0.0/16 (APIPA) fe80::/10
  • Broadcast Yes No (use multicast)
  • Common LAN prefix Often /24 Typically /64
  • Header Checksum in header Simpler header; no header checksum
  • Worked Notation Drill

Expand and compress practice:

  • Compressed: 2001:db8::8a2e:370:7334
  • One valid expanded form: 2001:0db8:0000:0000:0000:8a2e:0370:7334

Count hextets: left of :: has 2 ( 2001 , db8 ); right has 3 ( 8a2e , 370 , 7334 ); zeros fill the middle to total 8 hextets

Identify type quickly:

  • fe80::1 → link-local unicast
  • ff02::1 → multicast
  • ::1 → loopback
  • 2001:db8:1:2::10 → documentation/global-unicast style example on a /64-ish subnet
  • Why Cyber Operators Care

Modern DoD and commercial networks dual-stack or migrate toward IPv6. Packet filters written only for IPv4 miss IPv6 paths. Link-local and multicast addresses appear constantly in Neighbor Discovery traffic. If you only memorize IPv4 private ranges and ignore fe80:: and ff00::/8 , you will misread captures.

Neighbor Discovery vs ARP (awareness)

IPv4 uses ARP to map IP addresses to MAC addresses. IPv6 replaces that role with Neighbor Discovery Protocol (NDP) messages carried over ICMPv6, typically using link-local and multicast addresses. You do not need full NDP message formats for the Cyber Test, but you should expect that IPv6 local resolution looks different in a packet capture: look for fe80:: sources and ff02:: multicast destinations instead of Ethernet broadcasts of who-has ARP.

Dual-stack reality check

Many hosts run dual stack — both IPv4 and IPv6. A firewall that allows only IPv4 rules may still leave an IPv6 path open. When troubleshooting "the host is blocked," confirm which protocol family the application actually used. Aptitude questions may simply ask which protocol is longer, which address is link-local, or which compressed form is legal; operational awareness helps you eliminate distractors that mix IPv4 and IPv6 concepts.

Study focus for the Cyber Test

State 128-bit length and eight hextets.

Apply leading-zero and single :: compression correctly.

Recognize fe80::/10 , ::1 , ff00::/8 , and documentation 2001:db8::/32 .

Remember no broadcast and the default /64 LAN prefix habit.

Master those four themes and most IPv6 aptitude items become recognition problems rather than deep protocol engineering.