Did you know that IPv6 may include your MAC address? Here’s how to stop it.

February 11, 2011 by . 0 comments

Super User Question of the Week [7 February 2011 - 14 February 2011]

With the roll out of IPv6 and IPv4 addresses quickly running out, there will be soon a greater migration over to IPv6.  But there seems to be an issue, your computer’s MAC address may be included with the new IPv6 address.  In comes Arjan’s great question:

How to avoid exposing my MAC address when using IPv6?

On my Macs, each IPv6 address includes the MAC address of a specific computer (not of my router). Sites such as ipv6-test.com not only show it, but even tell me it belongs to an Apple computer.

This feels like a super cookie, and might apply to other operating systems as well. How can I avoid my MAC addresses from being exposed?

Grawity gives us an amazing answer.  But before I get into that we really need to focus and congratulate him.  As Arjan comments in the meta post for this weeks Question of the week:

The key is:

Grawity answered my question before I asked it. Even more: before I knew I had that question!

The full story:

I’d always assumed that I could not stop exposing my MAC address in my IPv6 addresses, as I did not find any settings for that in my router. Kudos for the commenting system, as enters grawity on one of my answers.

So kudos to you @Grawity!  It’s your answer that’s really being featured today.

Here’s how your IPv6 address may include your MAC address.  An example IPv6 address is something like this:

2001:0db8:1:2:60:8ff:fe52:f9d8

  • Take the last 64 bits (the host identifier) and add lead zeroes: 00:08ff:fe52:f9d8
  • Strip “ff:fe” from the middle.  (If these bytes are not there, then there’s no MAC address.)
  • For the first byte: complement the second low-order bit (the universal/local bit; if ther bit is a 1, make it 0, and if it is a 0, make it 1) So: 0×00 (00000000) become 0×02 (00000010)
  • “60:8ff:fe52:f9d8” now becomes “02:60:08:52:f9:d8”!

Privacy addressing is used to hide you MAC address from IPv6.  What Privacy addressing does is generate a random, temporary address that doesn’t contain your MAC address.  Here’s how you enable Privacy addressing:

  • Windows (starting with XP SP2) – This is enabled by default in XP, VISTA, and 7
    • Open a command window as an administrator.
    • Enter this: “netsh inter ipv6 set privacy state=enabledCapture  
  • Linux:
    • To enable temporary addresses and make them preferred for outgoing connections:
      • Open a terminal and run this as sudo: sysctl net.ipv6.conf.eth0.use_tempaddr
    • Each of the commands above can be changed for a single interface:
      • net.ipv6.conf.eth0.use_tempaddr
    Grawity also gives the commands on how to do this on FreeBSD and also NetBSD on his answer.

Filed under Question of the Week

Subscribe to comments with RSS.

Leave a comment

Log in
with Stack Exchange
or