Did you know that IPv6 may include your MAC address? Here’s how to stop it.

Super User Question of the Week [7 February 2011 – 14 February 2011]

With the roll out of IPv6 and IPv4 addresses quickly running out, there will be soon a greater migration over to IPv6.  But there seems to be an issue, your computer’s MAC address may be included with the new IPv6 address.  In comes Arjan’s great question:

How to avoid exposing my MAC address when using IPv6?

On my Macs, each IPv6 address includes the MAC address of a specific computer (not of my router). Sites such as ipv6-test.com not only show it, but even tell me it belongs to an Apple computer.

This feels like a super cookie, and might apply to other operating systems as well. How can I avoid my MAC addresses from being exposed?

Grawity gives us an amazing answer.  But before I get into that we really need to focus and congratulate him.  As Arjan comments in the meta post for this weeks Question of the week:

The key is:

Grawity answered my question before I asked it. Even more: before I knew I had that question!

The full story:

I’d always assumed that I could not stop exposing my MAC address in my IPv6 addresses, as I did not find any settings for that in my router. Kudos for the commenting system, as enters grawity on one of my answers.

So kudos to you @Grawity!  It’s your answer that’s really being featured today.

Here’s how your IPv6 address may include your MAC address.  An example IPv6 address is something like this:

2001:0db8:1:2:60:8ff:fe52:f9d8

• Take the last 64 bits (the host identifier) and add lead zeroes: 00:08ff:fe52:f9d8
• Strip “ff:fe” from the middle.  (If these bytes are not there, then there’s no MAC address.)
• For the first byte: complement the second low-order bit (the universal/local bit; if ther bit is a 1, make it 0, and if it is a 0, make it 1) So: 0x00 (00000000) become 0x02 (00000010)
• “60:8ff:fe52:f9d8” now becomes “02:60:08:52:f9:d8”!

Privacy addressing is used to hide you MAC address from IPv6.  What Privacy addressing does is generate a random, temporary address that doesn’t contain your MAC address.  Here’s how you enable Privacy addressing:

• Windows (starting with XP SP2) – This is enabled by default in XP, VISTA, and 7
  • Open a command window as an administrator.
  • Enter this: “netsh inter ipv6 set privacy state=enabled”  
• Linux:
  • To enable temporary addresses and make them preferred for outgoing connections:
    • Open a terminal and run this as sudo: ”sysctl net.ipv6.conf.eth0.use_tempaddr”
  • Each of the commands above can be changed for a single interface:
    • “net.ipv6.conf.eth0.use_tempaddr”
  Grawity also gives the commands on how to do this on FreeBSD and also NetBSD on his answer.