DHCPv6 vs SLAAC: How Devices Get IPv6 Addresses

When a device joins an IPv6 network, it needs an address. Unlike IPv4 where DHCP is the standard approach, IPv6 offers two mechanisms: SLAAC (Stateless Address Autoconfiguration) and DHCPv6. Understanding when to use each is essential for network engineers.

SLAAC: Stateless Address Autoconfiguration#

SLAAC allows devices to configure themselves without maintaining state on the network. The router periodically sends Router Advertisement (RA) messages containing the network prefix, and devices generate their own addresses.

How Router Advertisements Work#

Routers multicast RA messages to ff02::1 (all-nodes multicast) every 200 seconds by default. Devices can also request an RA immediately by sending a Router Solicitation (RS) to ff02::2 (all-routers multicast).

An RA contains:

• Network prefix (e.g., 2001:db8::/64)
• Default gateway address
• Prefix lifetime (valid and preferred)
• M and O flags (explained below)

The device combines the advertised prefix with a self-generated 64-bit Interface ID to create its address.

Interface ID Generation#

Two common methods exist:

EUI-64 (Modified Extended Unique Identifier) Derives the Interface ID from the MAC address. For MAC 00:11:22:33:44:55:

1. Insert ff:fe in the middle: 00:11:22:ff:fe:33:44:55
2. Flip the 7th bit: 02:11:22:ff:fe:33:44:55
3. Result: 2001:db8::211:22ff:fe33:4455

This is deterministic but reveals hardware identity, creating privacy concerns.

Privacy Extensions (RFC 4941) Generates random Interface IDs. Modern operating systems create temporary addresses that change periodically (daily on most systems). The device maintains both a stable address (for incoming connections) and temporary addresses (for outbound connections).

# Linux: View address types
ip -6 addr show eth0
 
# You'll see scope global for stable addresses
# and scope global temporary for privacy addresses

This command shows all IPv6 addresses assigned to the interface, including their scope and flags.

What SLAAC Provides#

SLAAC handles:

• IPv6 address assignment
• Default gateway
• Prefix length

What it doesn't provide by default:

• DNS servers
• Domain search list
• NTP servers

RDNSS (Recursive DNS Server) Option RFC 8106 allows routers to advertise DNS servers in RA messages. Most modern systems support this, eliminating the need for DHCPv6 in simple networks.

DHCPv6: Managed Configuration#

DHCPv6 works similarly to DHCPv4: clients request configuration from a server. It operates in two modes.

Stateful DHCPv6#

The server assigns addresses and tracks which client has which address. Clients perform a four-message exchange:

1. Solicit: Client requests configuration
2. Advertise: Server offers an address
3. Request: Client accepts the offer
4. Reply: Server confirms assignment

Addresses are leased with preferred and valid lifetimes, requiring renewal.

Stateless DHCPv6#

Devices use SLAAC for addresses but query DHCPv6 for additional options like DNS servers, domain name, or NTP servers. The server doesn't track addresses, hence "stateless."

M and O Flags#

Router Advertisements contain two critical flags:

M Flag (Managed Address Configuration) When set to 1, devices should use DHCPv6 to obtain addresses. SLAAC addresses may still be generated depending on the A flag in the prefix information.

O Flag (Other Configuration) When set to 1, devices should use DHCPv6 to obtain additional options (DNS, NTP, etc.) but not addresses.

Flag combinations:

• M=0, O=0: SLAAC only (use RDNSS for DNS)
• M=0, O=1: SLAAC + Stateless DHCPv6
• M=1, O=0: DHCPv6 for addresses (rare configuration)
• M=1, O=1: DHCPv6 for addresses and options

SLAAC vs DHCPv6 Comparison#

Common Configurations#

SLAAC Only (with RDNSS)#

Best for simple networks where address tracking isn't required. Example radvd.conf on Linux:

interface eth0 {
    AdvSendAdvert on;
    prefix 2001:db8:1::/64 {
        AdvOnLink on;
        AdvAutonomous on;
    };
    RDNSS 2001:4860:4860::8888 2001:4860:4860::8844 {
        AdvRDNSSLifetime 300;
    };
};

This configuration provides everything most clients need without DHCPv6. The AdvSendAdvert directive enables Router Advertisements, while AdvOnLink and AdvAutonomous allow SLAAC.

SLAAC + Stateless DHCPv6#

Use when RDNSS isn't supported or when additional options are needed. Set O flag in radvd:

interface eth0 {
    AdvSendAdvert on;
    AdvOtherConfigFlag on;  # O=1
    prefix 2001:db8:1::/64 {
        AdvOnLink on;
        AdvAutonomous on;
    };
};

DHCPv6 server provides DNS and other options but doesn't assign addresses.

DHCPv6 Only (Managed)#

Enterprises often prefer this for accountability and access control. Set M flag:

interface eth0 {
    AdvSendAdvert on;
    AdvManagedFlag on;  # M=1
    AdvOtherConfigFlag on;  # O=1
    prefix 2001:db8:1::/64 {
        AdvOnLink on;
        AdvAutonomous off;  # Don't use SLAAC
    };
};

Note: Some clients will still generate link-local addresses and may create SLAAC addresses despite AdvAutonomous off. Network security policies should not rely solely on disabling SLAAC.

Which to Use When#

Use SLAAC when:

• Small to medium networks
• Devices are trusted
• Address tracking isn't required
• Simplicity is prioritized
• All clients support RDNSS

Use DHCPv6 when:

• Need centralized address management
• Compliance requires address logging
• Require prefix delegation (ISP to customer router)
• Need to provide complex options beyond DNS
• Windows networks (better DHCPv6 support historically)

Hybrid approach (SLAAC + Stateless DHCPv6):

• Good compromise for many networks
• Resilient (SLAAC works if DHCPv6 fails)
• Provides flexibility for additional options

Troubleshooting Address Assignment#

Device has link-local only (fe80::/10) No Router Advertisements received. Check:

# Linux: Capture RAs
tcpdump -i eth0 'icmp6 && ip6[40] == 134'

This captures ICMPv6 type 134 (Router Advertisement) packets.

# Verify router is sending RAs
radvdump

This displays received Router Advertisements with all their options.

Device has SLAAC address but no DNS Router isn't sending RDNSS, or client doesn't support it. Check RA contents:

radvdump | grep RDNSS

If missing, add RDNSS to router configuration or enable stateless DHCPv6.

DHCPv6 not working Verify M or O flag is set in RAs:

radvdump | grep -E "M flag|O flag"

Check DHCPv6 server is running and reachable on UDP port 547:

# Server side
ss -ulnp | grep 547

This shows if the DHCPv6 server is listening.

# Client side
tcpdump -i eth0 port 547

This captures DHCPv6 traffic to verify communication.

Multiple addresses on interface This is normal. You might see:

• Link-local address (always present)
• SLAAC stable address (EUI-64)
• SLAAC temporary addresses (privacy extensions)
• DHCPv6 address (if using stateful DHCPv6)

All are valid; the OS selects the appropriate source address based on RFC 6724.

Related Articles#

• How to Enable IPv6 - Step-by-step guide to configuring IPv6 on common operating systems and routers
• IPv6 Privacy Extensions - Protect your privacy with temporary IPv6 addresses

Frequently Asked Questions#