IPv4 versus IPv6: the real differences and how networks run both

Same job, different design

Both IPv4 and IPv6 are Layer 3 protocols: they give every interface an address and let routers forward packets between networks. IPv4 dates from 1981 and its 32-bit addresses allow about 4.3 billion of them, far too few for today's phones, laptops and connected devices. The regional internet registries have run out of new IPv4 blocks, which is why NAT and address trading became normal. IPv6 was standardised to fix the shortage and, while the designers were at it, to tidy up parts of IPv4 that had grown awkward. For an introduction to the address format itself, see IPv6 explained.

Side-by-side comparison

The headers compared

The IPv4 header (see the IPv4 packet header) is 20 bytes plus optional extras, so routers must read the header length first. IPv6 uses a fixed 40-byte header and moves anything optional into extension headers that follow it. Several fields were renamed or dropped:

• TTL became Hop Limit: same job, a more honest name, since it counts hops, not seconds.
• Protocol became Next Header: it names the next header, which may be TCP, UDP, ICMPv6 or an extension header.
• Type of Service became Traffic Class, still carrying DSCP values for QoS.
• The header checksum was removed. Ethernet and TCP or UDP already check for errors, so routers save work by not recalculating it at every hop.
• The fragmentation fields moved into an optional Fragment extension header, used only by the sending host.
• A new Flow Label lets a host mark packets that belong to one flow, which helps load balancing.

Twice the header size sounds wasteful, but a 40-byte header on a 1,500-byte packet is a small overhead, and the fixed layout is simple for hardware to process.

Running both: transition methods

IPv6 is not backward compatible: an IPv4-only host cannot talk to an IPv6-only host without help. Three families of methods exist:

• Dual stack: every device and router runs IPv4 and IPv6 at the same time, and applications prefer IPv6 when DNS returns both address types. This is the most common approach in enterprise and campus networks.
• Tunnelling: IPv6 packets are wrapped inside IPv4 packets (or the reverse) to cross a part of the network that only supports one version, for example with GRE or manual 6in4 tunnels.
• Translation: NAT64 with DNS64 lets IPv6-only clients reach IPv4-only servers by translating addresses at the edge. Many mobile operators run IPv6-only networks and use 464XLAT so that older IPv4-only apps on the phone still work.

Security note: NAT was never a firewall. An IPv6 network still needs a stateful firewall that blocks unsolicited inbound connections, and IPv6 must be included in firewall rules and monitoring even where you think it is not in use, because most operating systems enable it by default.

Real-world example: a university adds IPv6

A fictional university IT team decided to enable IPv6 on its campus network. Rather than switch over in one go, it ran dual stack: each VLAN kept its IPv4 subnet and gained a /64 from the university's IPv6 allocation, and routers sent router advertisements so laptops configured themselves. Before turning it on, the team copied every IPv4 firewall rule to an IPv6 equivalent and added IPv6 to its logging and monitoring. Within weeks, a large share of traffic to big cloud and video services was flowing over IPv6, which reduced the load on the campus NAT gateways. Old printers and lab equipment that only spoke IPv4 carried on working unchanged.