8.5 SLAAC

Understanding SLAAC

Stateless Address Auto Configuration, usually shortened to SLAAC, is a method that allows IPv6 devices to configure their own IP addresses and some basic network settings without using a traditional DHCP server. It is one of the key mechanisms that makes IPv6 networks easier to deploy and manage.

SLAAC relies on the ability of IPv6 routers to advertise information about the network prefix and on the ability of hosts to build a full IPv6 address from that information plus their own interface identifier.

The Role of Router Advertisements

SLAAC is built on two types of ICMPv6 messages that routers send on a local network. These are Router Solicitation messages and Router Advertisement messages. The details of ICMPv6 and Neighbor Discovery are handled in their own chapters. For SLAAC you only need to understand how they are used for address configuration.

When a host connects to an IPv6 network, it can send a Router Solicitation message that asks: “Is there any IPv6 router here and what prefixes should I use?”. Routers periodically send Router Advertisement messages anyway, but responding to solicitations lets them answer more quickly.

A Router Advertisement contains several pieces of information that are important for SLAAC. The most important part is one or more Prefix Information options that tell the host what network prefixes exist on this link and whether hosts are allowed to auto configure addresses from them.

Each Prefix Information option includes:

If the Autonomous flag is set, the host knows that it may use this prefix to create its own IPv6 address. If the flag is not set, the prefix is not used for SLAAC, although it may still be used for routes.

Forming the Interface Identifier

Once a host receives a Router Advertisement that includes a prefix suitable for SLAAC, the next step is to create an interface identifier. The interface identifier is combined with the prefix to form a complete unicast IPv6 address.

The prefix is usually 64 bits long in a SLAAC environment. This is a convention that is strongly recommended for global unicast addresses that use SLAAC. That leaves 64 bits for the interface identifier.

There are multiple ways to generate the interface identifier. The choice affects privacy, stability, and traceability of the address. Common methods include identifiers derived from the MAC address, randomized identifiers, and stable but pseudorandom identifiers.

EUI-64 Based Interface Identifiers

Historically, many IPv6 implementations used the EUI 64 method to derive the interface identifier from the interface MAC address. This creates a stable identifier that is the same every time for that interface, as long as the MAC address does not change.

The algorithm to create an EUI 64 identifier from a 48 bit MAC address is:

1. Split the 48 bit MAC address into two 24 bit halves.
2. Insert the constant value 0xFFFE (16 bits) between the two halves.
3. Invert the Universal/Local (U/L) bit which is bit 7 of the first byte.

For example, consider a MAC address written in hexadecimal as:

AA:BB:CC:DD:EE:FF

Step by step:

1. Split it into AA:BB:CC and DD:EE:FF.
2. Insert FF:FE in the middle, so you get AA:BB:CC:FF:FE:DD:EE:FF.
3. Flip the U/L bit in the first byte AA.

The byte AA in binary is:

$$AA_{16} = 10101010_{2}$$

The U/L bit is the second least significant bit in the first byte:

Bit 1 is the U/L bit here. For 0xAA, that bit is 1 0 1 0 1 0 1 0, so the second to last bit is 1. When you flip it, you turn it from 1 to 0, which changes the byte. The updated first byte becomes A8 in hexadecimal. So the final EUI 64 interface identifier is:

A8:BB:CC:FF:FE:DD:EE:FF

So, with a prefix 2001:db8:1234:1::/64 and this interface identifier, the full IPv6 address is:

2001:db8:1234:1:A8BB:CCFF:FEDD:EEFF

For this reason, many modern systems now avoid EUI 64 based addresses for most traffic and prefer privacy oriented methods.

Privacy Extensions and Temporary Addresses

If a device always uses the same interface identifier, its IPv6 address changes only when it moves to a different network prefix. This makes it easy for remote servers to recognize the same device over time. To limit this tracking, IPv6 defines privacy extensions that allow a device to generate temporary addresses.

With privacy extensions, the host still learns the prefix from Router Advertisements. However, instead of using a MAC based identifier, the host creates a random or pseudorandom 64 bit interface identifier. This gives a new, unpredictable address that is tied to the current prefix but not directly tied to the hardware.

Typically, a host will have at least two addresses for each prefix:

1. A stable address, either based on EUI 64 or on a stable randomized scheme.
2. One or more temporary addresses based on privacy extensions.

Temporary addresses have a limited preferred lifetime. When the preferred lifetime ends, the address becomes deprecated. The host will not use it for new connections, but existing connections can continue until the valid lifetime ends. Meanwhile, the host can create a fresh temporary address and start using that one for new connections.

This rotation of temporary addresses makes it significantly harder to follow a user across time and websites, which improves privacy.

Valid and Preferred Lifetimes

Every SLAAC address has two key timers that come from the Prefix Information in Router Advertisements. These are the valid lifetime and the preferred lifetime.

The valid lifetime is the total time that an address can be used at all. As long as the valid lifetime has not expired, the address is considered valid and can be used for existing connections. When the valid lifetime reaches zero, the address is removed from the interface and must not be used.

The preferred lifetime is usually shorter than the valid lifetime. While the preferred lifetime is not expired, the address is preferred. That means the host can use it to start new connections. When the preferred lifetime expires, but the valid lifetime is still active, the address becomes deprecated.

A deprecated address is no longer chosen for new connections, but existing connections that already use it are allowed to continue. This behavior allows a network to gently move traffic away from an old prefix or away from old temporary addresses without breaking active applications.

Routers can send updated Router Advertisements that change lifetimes. Hosts must adjust address timers accordingly. This becomes important when renumbering a network or transitioning to a new prefix.

Duplicate Address Detection in SLAAC

When a host forms a new IPv6 address using SLAAC, it must ensure that no other host on the same link is already using that address. This is called Duplicate Address Detection, or DAD. It is part of the Neighbor Discovery process.

The host performs DAD by sending a special Neighbor Solicitation message for the address it wants to use, but it sends this from the unspecified address :: and to the solicited node multicast address that corresponds to the target address. If no one responds within a defined time, the host assumes that the address is unique and assigns it to the interface.

If the host receives a Neighbor Advertisement that indicates the address is already in use, the host must not use that address. With SLAAC, the host can then pick another interface identifier and try again. For example, it can generate another random identifier if it uses privacy extensions.

SLAAC depends on DAD to avoid problems where two devices accidentally pick the same address. Without DAD, SLAAC would not be safe to use on shared networks.

SLAAC vs DHCPv6

Although SLAAC can assign addresses, it does not by itself provide all the information that DHCP servers often provide in IPv4 networks. SLAAC is focused mainly on address assignment and default gateway information. Some extra information can be carried in Router Advertisements using specific options, but this is limited.

DHCPv6 is a separate protocol that can provide more detailed configuration such as DNS server addresses, domain search lists, and other options. Networks can use SLAAC alone, DHCPv6 alone, or a combination of both, depending on their design goals.

Routers can use flags in Router Advertisements to tell hosts whether to use DHCPv6. Two common flags are:

In a pure SLAAC environment, the M flag is usually 0. If the O flag is 1, hosts might still use DHCPv6 in a stateless way to learn extra parameters such as DNS servers without getting addresses from DHCPv6.

A common deployment choice is:

• SLAAC provides the IPv6 address and default gateway.
• DHCPv6 provides additional details such as DNS.

Address Types Created by SLAAC

SLAAC is mainly used to create global unicast addresses and sometimes unique local addresses, depending on the prefix that the router advertises. The prefix type determines the address type.

For example:

SLAAC can also be used to generate link local addresses. These are addresses in the fe80::/10 range that are valid only on the local link. Many systems automatically generate a link local address for each interface using a method similar to SLAAC, even when there is no router present.

Operational Considerations for SLAAC

Using SLAAC in a real network has both advantages and trade offs.

On the positive side, SLAAC reduces the need to run and manage separate DHCP servers for simple address assignment. Hosts can join the network and get an address as soon as they see a Router Advertisement from a router. This is particularly convenient in environments with many mobile or temporary devices.

SLAAC also integrates naturally with the way IPv6 routing works. When a router advertises a prefix on a link, it effectively announces both a local subnet and a set of addresses that hosts can use. If the prefix changes, routers can update the Router Advertisements and hosts will gradually move to the new prefix as old addresses become deprecated and expire.

On the other hand, SLAAC gives less direct control over the exact addresses that hosts use. In many enterprise environments, administrators want address assignments that follow strict patterns or that tie into IP management tools. In those cases, DHCPv6 with reservations or manual assignment may be preferred, or SLAAC is combined with monitoring tools that track the addresses hosts generate.

Security considerations also apply. Since addresses can be formed automatically, a malicious host can potentially create many addresses on the same link. Network devices and operating systems can implement limits and controls to reduce the impact of such abuse.

Summary of SLAAC Behavior

To see SLAAC as a sequence, imagine a laptop connecting to a Wi Fi network that supports IPv6 with SLAAC:

1. The laptop connects to the link and auto generates a link local address.
2. It sends a Router Solicitation to discover routers.
3. The router sends a Router Advertisement that includes a 2001:db8:1234:1::/64 prefix with the Autonomous flag set.
4. The laptop combines this /64 prefix with an interface identifier, which might be EUI 64 based or random.
5. The laptop performs Duplicate Address Detection for the new address.
6. If no duplicate is found, the address becomes valid and preferred for the duration of its timers.
7. If privacy extensions are enabled, the laptop also creates temporary addresses using random identifiers and rotates them over time.
8. The router can later send updated Router Advertisements that change lifetimes or introduce a new prefix, and the laptop adjusts addresses accordingly.

SLAAC is therefore a cooperative process between routers and hosts that uses Router Advertisements, interface identifiers, and lifetimes to provide flexible, mostly automatic IPv6 address configuration without needing a separate address server.