Why might one IPv6 device use several different addresses?¶
title: "Why might one IPv6 device use several different addresses?" status: "complete" source_document: "https://docs.google.com/document/d/1JWqz_Go55o1vVi5dfVcd5Vnd8TLC8gmepKbzUvA7LHQ/edit?usp=drivesdk"
Why might one IPv6 device use several different addresses?¶
Why might one IPv6 device use several different addresses?¶
One device can use several IPv6 addresses at the same time or move between different addresses over time.
An IPv6 address normally contains a network prefix and an interface-related part. When a device joins a network, it may receive or generate more than one address for different purposes. For example, it will commonly have a link-local address for communication on the local network and one or more addresses that can be used beyond it.
The device may have a stable address intended to remain consistent while it uses that network. It may also generate temporary privacy addresses for outgoing connections. These temporary addresses reduce the ability of external services to track the device through one long-lasting address.
Temporary addresses can change periodically. Old addresses may remain associated with the interface for a time so that existing connections continue to work while new connections use a newer address. A single device can therefore appear in records under several IPv6 addresses during the same general period.
Different network interfaces can add further addresses. A phone may use Wi-Fi and mobile data. A laptop may have Wi-Fi, Ethernet, a VPN and virtual network interfaces. Each interface or network connection may have its own IPv6 addressing.
The network prefix can change as well. Moving between home, work, public Wi-Fi and mobile data places the device on different networks. Providers can also change the prefix delegated to a customer connection. An address used yesterday may therefore no longer be assigned to the same device or network today.
Matching IPv6 addresses can provide a strong technical association when the full address, timestamp and allocation context are understood. However, investigators shouldn't assume that two different IPv6 addresses necessarily indicate two different devices—or that one device will always appear under the same address.
Provider and local-network records may be needed to determine which connection, interface or device used a particular address at the relevant time.
An IPv6 address identifies an address used in a particular network context. The presence of several addresses is normal and doesn't, by itself, indicate concealment, multiple devices or multiple users.