SLAAC

An address splits down the middle. The first 64 bits are the prefix the router advertises, and they say where you are. The last 64 bits are the interface identifier, and the device decides them. That second half is where the whole story sits.

The original recipe built the identifier from the network card's own hardware address, padding it in the middle with a fixed pattern. That pattern is still the giveaway: an address with ff and fe in the middle of its second half was almost certainly made this way. It also means the identifier never changes, and the standard that replaced the practice says why that matters. Eavesdroppers "may trivially correlate network activity when the same address is employed for multiple transactions by the same host".

Two answers exist. Temporary addresses, refreshed on a timer, were specified in their current form in February 2021. A stable identifier that is different on every network, and reveals nothing about the hardware, was specified in April 2014. Current desktop and mobile systems use one or the other by default.

We read the public register of RIPE Atlas, a fleet of volunteer measurement probes, on 20 September 2026. Of 13,919 connected probes, 8,346 had an IPv6 address, which is 60.0 percent. Among the 2,890 on home lines, 1,936 had one, or 67.0 percent. That is the same figure we measured for a different page the day before.

The second halves are the interesting part. On home lines 83.0 percent of the addresses were built from the hardware address and 8.0 percent were random, so 91.0 percent were built by the device itself. Only 9.0 percent were small hand-set numbers. Away from home lines the picture splits almost evenly: 42.5 percent hardware-derived against 41.9 percent hand-set. That is what a population of servers looks like.

One caveat belongs next to those numbers. A measurement probe is a small appliance running its own firmware. It does not turn on the privacy behaviour a phone or a laptop has by default. So this is not what your own devices send. What it does show is that the oldest recipe in IPv6 is still in daily use. Where it runs, the address carries a permanent name for the machine.

An IPv4 address is shared, translated and reassigned, so it identifies a household at best. An IPv6 address made the old way identifies a machine, and it keeps doing so after you move to another network, because only the first half changed. A site that logs the second half has a name for your device.

A proxy replaces the address a site sees, but only for traffic that actually goes through it. Traffic that leaves over IPv6 while your proxy is IPv4 carries your own address, identifier and all. That is the leak worth checking, and it is why a dual-stack machine needs to know which of its two addresses is really being used.

The two are not rivals so much as roommates. The router's advertisement carries flags that say whether a device should build its own address, ask a server for one, or do both and take other settings from the server. A network can run either, and many run both at once.

The practical difference is who keeps the record. With a server there is a list of who holds what, which is what a business network wants. Without one there is nothing to keep, which is what makes IPv6 work on a link where nobody has configured anything at all.

One old objection has expired. Teaching material still says a device cannot learn its DNS servers this way, so a server is needed anyway. Router advertisements have carried DNS servers and a search list since March 2017, and our own count puts 91.0 percent of home addresses in the hands of the device.