Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 79 down vote favorite
49

On my Macs, each IPv6 address includes the MAC address of a specific computer (not of my router). Sites such as ipv6-test.com not only show it, but even tell me it belongs to an Apple computer.

This feels like a super cookie, and might apply to other operating systems as well. How can I avoid my MAC addresses from being exposed?

Background: the MAC address is not in plain sight. Like for 2001:0db8:1:2:60:8ff:fe52:f9d8:

  • Take the last 64 bits (the host identifier) and add leading zeroes: 0060:08ff:fe52:f9d8.
  • Strip the ff:fe part from the middle. If these bytes are not there, then there's no MAC address.
  • For the first byte: complement the second low-order bit (the universal/local bit; if the bit is a 1, make it 0, and if it is a 0, make it 1). So: 0x00 (00000000) becomes 0x02 (00000010).
  • Presto: 60:8ff:fe52:f9d8 translates back to MAC address 02:60:08:52:f9:d8.

This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself

share|improve this question
9  
Wow I did not know that about IPV6, nice find. – Kyle Feb 9 '11 at 17:34
3  
Well, of course it shows an Apple computer. It is a MAC address, after all. – Graeme Perrow Nov 14 '11 at 17:05
@Kronos, an image has gone missing on the blog entry; blog.superuser.com/2011/02/11/… Adding ".stack" to the URL helps: i.stack.imgur.com/RNXoA.png – Arjan Dec 1 '12 at 11:34
...but, @KronoS, adding ".stack" actually makes another image form that same blog post disappear, like i.imgur.com/vjK73.png (okay) vs i.stack.imgur.com/vjK73.png (not okay). In other words: maybe all images on the blog that do not currently use .stack should be re-uploaded...? – Arjan Dec 1 '12 at 16:37
@Arjan I'm not sure. I'm going to have to check into this. I would like for a feature that all images uploaded to the blog are automatically uploaded to stack's imgur account. Similar to what the regular sites do currently – KronoS Dec 1 '12 at 19:29

2 Answers

up vote 84 down vote accepted

This is what IPv6 Privacy Addressing is for. When enabled, the system will generate a temporary address with a random suffix in addition to the EUI-64-based address.

  • Windows (starting with XP SP2) – enabled by default in XP, Vista, 7:

    netsh interface ipv6 set privacy state=enabled

  • Linux:

    To enable temporary addresses and make them preferred for outgoing connections:

    sysctl net.ipv6.conf.all.use_tempaddr=2
sysctl net.ipv6.conf.default.use_tempaddr=2

    To enable temporary address generation, but keep the old (Autoconf) address as preferred:

    sysctl net.ipv6.conf.all.use_tempaddr=1
sysctl net.ipv6.conf.default.use_tempaddr=1

    The all or default part can be replaced with a specific interface name; e.g. net.ipv6.conf.eth0.use_tempaddr.

    (I used ip link set eth0 down && ip link set eth0 up to force an address assignment, but you can just wait a minute for the next periodic Router Advertisement.)

  • Mac OS X – enabled by default since OS X 10.7 Lion:

    sysctl -w net.inet6.ip6.use_tempaddr=1

    Temporary addresses, if enabled, will be preferred.

  • FreeBSD:

    sysctl net.inet6.ip6.use_tempaddr=1

sysctl net.inet6.ip6.prefer_tempaddr=1

  • NetBSD:

    sysctl -w net.inet6.ip6.use_tempaddr=1

    Temporary addresses preference? I have no idea. The autoconf address seems to be preferred. ifconfig doesn't appear to list any address properties.

Notes on configuration:

  • On Linux, OS X, and all BSDs, edit /etc/sysctl.conf to make the setting permanent.

  • On Windows, the changes will persist automatically.

    (Append store=active to the netsh command if you want it to only last until reboot.)

Partially based on IPv6 Operating Systems at IPv6INT.net. See also General IPv6 Notes

If the hardware address is used in the IPv6 address, it usually means your network uses IPv6 Stateless Autoconfiguration. In such case, you can simply pick your own address suffix and configure IPv6 manually.

However, even though the manually added address will not have your hardware info, it will still be static (unlike with Privacy Addressing, which changes addresses every so often). Also, static addresses can be a pain in a network larger than 2-3 devices.

share|improve this answer
1  
Nice side effect on my Mac and a FRITZ!Box 7340 router: I get two addresses in ifconfig. Outgoing connections use the random autoconf temporary address, which changes every now and then. Good! But for incoming connections (when opened up in my router), I can still use the autoconf address. I don't mind exposing that in DNS records (though maybe I could even somehow choose another address for that too). – Arjan Feb 9 '11 at 18:56
Ahh, after whois-spamming we now get IPv6 spamming: dig -t AAAA www.v6.facebook.com ;-) – Arjan Feb 9 '11 at 20:10
3  
@Arjan: IPv6 addresses along the lines of de4d:b33f aren't that bad for memorizing; also, they're put in place by their owner, whereas whois spam is a) annoying and b) caused by outsiders who don't have control of your domain. – grawity Feb 9 '11 at 20:13
up vote 2 down vote

FYI, this only applies to certain IP addressing schemes. More than likely you (or your ISP) are using IPv6 autoconfiguration, which requires a fairly large block of IPs to accomplish in the first place. The solution could be to turn this feature off. Your ISP might use DHCP to assign addresses as well, which is still possible with IPv6.

share|improve this answer
1  
As for large blocks: according to Wikipedia in "General allocation": RIRs assign smaller blocks to ISPs, which then distribute this in /48 sized parts to their clients. Indeed, my ISP also assigns /48 prefixes to consumer-grade subscribers. Not too odd then? – Arjan Feb 9 '11 at 21:47
A single /48 will be sufficient for every last customer they have until the end of time, regardless of growth (2^80 hosts!). While this might seem like overkill, it certainly makes routing simple. A /96 network would be sufficient to provide IP addresses for the entire IPv4 internet. Any network smaller than a /64 wouldn't allow MAC autoconfiguration. – Ernie Dunbar Feb 10 '11 at 17:27
1  
I mean that I myself have a /48 block for my Macs, printer, Squeezebox, fridge and toaster, and whatever other 2^80 machines I decide to hook up. And so do all other subscribers at my ISP. And all of that appears to be quite common according to Wikipedia. – Arjan Feb 10 '11 at 18:22
1  
I think when Arin says "customer" they mean "ISP". Any ISP (including very, very large ones) can allocate a single /64 for their entire network and be done with it. No further routing required. But allocating blocks of IP addresses numbering in the trillions to joe-average residential customers is downright foolhardy. – Ernie Dunbar Feb 10 '11 at 19:42
1  
Just noticed that the link in my above comment links to a now old version: see IPv6 Addressing Plans­ for the current Arin proposal. No changes in All customers get one /48 unless they can show that they need more than 65k subnets. [...] If you have lots of consumer customers you may want to assign /56s to private residence sites. though. – Arjan Apr 12 '11 at 11:38
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.