How to Ensure IPv6 Link-Local Address Format with MAC

Linux generates IPv6 link-local addresses using the EUI-64 format by default, which embeds the interface's MAC address. To ensure this specific format is used for network communication, you must verify that the system has not disabled EUI-64 via sysctl settings or NetworkManager configurations. This article explains how to check and enforce these settings.

Understanding EUI-64 Address Generation

When a Linux interface creates a link-local address (starting with fe80::), it typically uses the Extended Unique Identifier 64-bit (EUI-64) method. This process takes the 48-bit MAC address of the network interface and transforms it into a 64-bit interface identifier. The transformation involves inserting the hex values :ff:fe: in the middle of the MAC address and flipping the seventh bit from left to right (the Universal/Local bit). This mechanism ensures that every device on the local network segment has a unique, predictable link-local address derived directly from its hardware identity. While this is standard behavior, modern Linux distributions often disable this feature by default for privacy reasons, replacing it with temporary random addresses. Understanding this distinction is critical when troubleshooting connectivity issues or configuring static routing rules based on hardware IDs. If you are experiencing issues where link-local addresses change frequently or do not match expectations, it is likely due to privacy extensions being active. You can investigate related stability issues with IPv6 address assignment by reading about IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready message repeating every minute.

Checking Current Sysctl Settings

The primary control over EUI-64 usage lies in the kernel parameter net.ipv6.conf.all.use_tempaddr and its per-interface counterparts. If this value is set to 2, the system generates temporary IPv6 addresses for privacy, effectively overriding the stable EUI-64 link-local format in many contexts or causing confusion between stable and temporary identifiers. A value of 0 disables temporary addresses, ensuring the use of the stable EUI-64 format derived from the MAC address. To check the current status, run the following command in your terminal:

sysctl net.ipv6.conf.all.use_tempaddr
sysctl net.ipv6.conf.default.use_tempaddr

You should also check the specific interface, such as eth0 or ens33:

sysctl net.ipv6.conf.eth0.use_tempaddr

If the output is 2, temporary addresses are enabled. If it is 0, the system relies on the stable EUI-64 format. In some cases, NetworkManager may override these sysctl settings, so verifying the effective configuration through the interface details is essential.

Disabling Privacy Extensions via Sysctl

To permanently enforce the EUI-64 format, you need to set the use_tempaddr parameter to 0. This tells the kernel to stop generating random temporary addresses and stick to the hardware-derived identifier. Create or edit the file /etc/sysctl.d/99-ipv6.conf and add the following lines:

# Disable IPv6 privacy extensions to ensure EUI-64 format
net.ipv6.conf.all.use_tempaddr = 0
net.ipv6.conf.default.use_tempaddr = 0
net.ipv6.conf.eth0.use_tempaddr = 0

Replace eth0 with your actual interface name if necessary. After saving the file, apply the changes immediately without rebooting by running:

sudo sysctl -p /etc/sysctl.d/99-ipv6.conf

Verify the change took effect by checking the sysctl value again. The output should now reflect 0. This change persists across reboots because it is stored in a configuration file managed by the sysctl service.

Configuring NetworkManager

NetworkManager often manages IPv6 settings independently of raw sysctl files. If you are using a distribution like Ubuntu, Fedora, or RHEL, NetworkManager might be resetting the privacy extension settings upon connection. Check the connection profile for your network interface using nmtui or the command line tool nmcli. For example, to view the settings for a connection named Wired connection 1:

nmcli connection show "Wired connection 1" | grep ipv6

Look for the setting ipv6.method and any privacy-related flags. In newer versions of NetworkManager, you can explicitly set the IPv6 privacy policy. Ensure that the privacy policy is set to off or stable rather than random.

nmcli connection modify "Wired connection 1" ipv6.addr-gen-mode eui64

After modifying the connection profile, reload the connection to apply the changes:

nmcli connection down "Wired connection 1"
nmcli connection up "Wired connection 1"

This forces NetworkManager to respect the EUI-64 generation mode. If you find discrepancies between what ip addr shows and what is expected, refer to Why is my public IPv6 address different from the one listed in Linux? for broader context on address management.

Verifying the Link-Local Address Format

Once the settings are applied, verify that the link-local address follows the correct EUI-64 structure. Use the ip -6 addr show command to list all IPv6 addresses assigned to your interfaces.

ip -6 addr show dev eth0

Look for an address starting with fe80::. The portion after the double colon should contain the sequence :ff:fe: in the middle, indicating the insertion point for the EUI-64 conversion. For example, if your MAC address is 00:11:22:33:44:55, the interface identifier should look like 02:11:22:ff:fe:33:44:55 (with the U/L bit flipped, making the first byte 02 instead of 00). If you see a completely random string of hex characters that does not resemble your MAC address, the privacy extensions are still active. Double-check both sysctl and NetworkManager configurations to ensure consistency.

Frequently Asked Questions

Why does my link-local address change after a reboot?

If your link-local address changes, it indicates that temporary privacy addresses are being generated. This happens when use_tempaddr is set to 2 or NetworkManager is configured to use random addressing modes. Setting these parameters to 0 or eui64 will stabilize the address based on your MAC address.

Can I manually set a link-local address?

Yes, you can manually assign a link-local address using the ip -6 addr add fe80::xxxx::1 dev eth0 command. However, this is generally discouraged for standard LAN communication because it bypasses the automatic discovery mechanisms and may cause conflicts if another device claims the same address.

Does disabling EUI-64 affect internet connectivity?

No, disabling EUI-64 for link-local addresses does not affect your ability to connect to the internet. Link-local addresses are only used for communication within the local subnet, such as neighbor discovery and router solicitation. Public IPv6 addresses are assigned via SLAAC or DHCPv6 independently of the link-local format.

How do I check if my NIC supports EUI-64?

Almost all modern Ethernet and Wi-Fi network interface cards support EUI-64. You can verify the MAC address format using ip link show. If the MAC address is a valid 48-bit IEEE identifier, the kernel can always generate an EUI-64 interface identifier unless explicitly prevented by software settings.

What is the difference between SLAAC and EUI-64?

SLAAC (Stateless Address Autoconfiguration) is the protocol used to assign global IPv6 addresses, while EUI-64 is a method for creating the interface identifier part of those addresses. You can use SLAAC with EUI-64 identifiers, but you can also use SLAAC with random identifiers if privacy extensions are enabled. Link-local addresses always use the interface identifier, regardless of whether global addresses are generated.