Determining the way the IPv6 interface identifier was created

Question

In IPv6 the 64bit interface identifier of an IPv6 address can be determined in one of 3 ways:

1. Stateless Address Autoconfiguration: put in the MAC address of the NIC (+ FF:FE and flip a bit).
2. Privacy Extensions for Stateless Address Autoconfiguration: Effectively choose a "random" value.
3. Use DHCPv6 to explicitly specify the address.

For analytics purposes I would like to know which of these was used.

For the first case (which I expect to be used the most) I would start by looking at a combination of the "FF:FE" and looking for known MAC prefixes. But is it the most accurate way of doing this?

Is there a relatively reliable way to determine which of these is used when I only have the resulting IPv6 address (like in a webserver logfile)? Or is doing an educated guess (like what I mentioned above) the best I can hope for?

P.S. Perhaps someone knows of "ready to run" code sample that does such a classification "as best as possible" ?

Answer 1

In the same LAN, you can compare the identifier with the host's Ethernet MAC address, to see if they match. But aside from that – especially if the host is behind one or more routers – an educated guess is the best you can get. The host is free to choose any identifier for its addresses (including even other hosts' MAC addresses), as long as it remains unique within the subnet.