Why Your Device Has Several IPv6 Addresses at Once

Look at a device’s network details and the old-style address appears once, while the IPv6 section lists several entries. That is not a fault or a duplicate reading. Each of those addresses has a different scope and a different job, and only some of them ever reach a website. Knowing which is which turns an intimidating block of hexadecimal into three useful facts: what identifies your line, what identifies this particular device, and which half of that you have any control over.

It also settles a question people ask in the wrong form. Rotating addresses are a real privacy feature and they do less than the name suggests, for a reason that is visible in the structure of the address itself.

The one that never leaves the segment

Every IPv6-capable interface gives itself an address beginning fe80: as soon as it comes up, without asking anyone. It is used to talk to the router and to other devices on the same segment, and it is not routable — a packet with that source cannot cross the gateway.

This is why an interface can show an IPv6 address while having no working internet connection at all, and it is a genuine difference from the old family, where a self-assigned address in the 169.254. range means something has failed. A link-local IPv6 address means the interface is alive. It says nothing about whether anything beyond the room is reachable.

For privacy purposes it belongs in the same category as a hardware address: visible to the network in front of you and to nothing else, per what MAC address randomization hides.

The routable address is two halves with two different owners

The address a website can reach is assembled from a prefix the network advertises and an interface identifier your device chooses.

The prefix comes from your router, which received it from your access provider. It identifies your line, and everything on your network shares it. You do not choose it and cannot change it except by changing providers or waiting for your provider to change it.

The identifier is the remaining portion, and your device makes it up. Historically it was derived from the hardware address, which had an unfortunate consequence: the same device carried a recognisable identifier onto every network it joined, so a destination could match a laptop at home against the same laptop in an office even though the prefix was completely different. That is why current systems generate an identifier with no relationship to the hardware.

That split is the thing to remember. Prefix identifies the line; identifier identifies the device within it. Almost every claim about IPv6 privacy is a claim about one half or the other, and they behave nothing alike.

The rotating address, and what it is for

Most systems generate additional addresses that are used as the source for outbound connections and replaced periodically, while a stable address stays available for anything that needs to reach the device.

That is where the extra entries in your list come from. Some are current, some are older ones being retired gracefully so existing connections do not break. The effect is that the identifier half a destination sees changes over time without the device losing the ability to be addressed.

What it defeats is linkage by identifier over long periods: connections made this week do not carry the same trailing value as connections made last week, so a destination cannot use that value alone to recognise a returning device months later.

What it does not defeat follows directly from the two-halves structure. The prefix does not rotate, so every rotating address you produce still names your line. Every device on your network produces addresses under the same prefix, so anything that groups by prefix groups your household together. And inside a single rotation window all of that device’s connections share one value, which is more than enough for anything that only needs to correlate a session. None of it touches accounts, cookies, or browser characteristics, which identify you far more precisely than any address ever could.

Why this changes the shape of the privacy question

Under the old family a household typically presents one address for every device, because translation at the router collapses them. Under IPv6 each device usually holds a routable address of its own, so a destination that receives two connections can often tell whether they came from one machine or two.

The trade runs in both directions and it is worth stating honestly. Per-device distinction became easier. Per-household identification became roughly as easy as it already was, and in some cases easier, because a prefix is a cleaner grouping than a shared address that may cover many unrelated subscribers under carrier-grade translation. Whether your prefix is stable over weeks or changes when the line reconnects is a separate matter, decided the same way the old-family address is — see why your home IP address changes.

What the tunnel does with the list

A tunnel can add an address to this picture, remove the family from it, or ignore it entirely, and the third case is the one that hurts.

If the client tunnels the family, the tunnel interface holds its own routable IPv6 address and destinations see that instead. If it blocks the family, your routable addresses stop being usable while connected and traffic falls back to the old family inside the tunnel. If it does neither, your ordinary addresses keep working outside the tunnel and a meaningful share of traffic goes with them, which is the failure covered in why IPv6 is the leak people forget.

The two things to look at are therefore whether the tunnel interface has a routable IPv6 address of its own, and whether any IPv6 route points at it. Both are readable on your own machine and neither depends on trusting the client’s status display.

Reading your own list

You can classify the entries by looking at them:

1. Anything starting fe80: is link-local. Expect exactly one per interface and ignore it.
2. A routable address matching the prefix your router advertises is the one your device is reachable at.
3. Additional routable addresses under the same prefix are usually the temporary ones, current and retiring.
4. Addresses in the range set aside for internal use appear on some networks and behave like private old-style addresses: routable inside, not beyond.
5. An address on the tunnel interface belongs to the VPN’s own network, not to yours.

Then check which one a destination actually reports, because that is the only entry in the list that anyone outside your network has an opinion about.

What to do with any of this

Leave temporary addresses enabled, which is usually the default; it costs nothing and removes the long-term identifier problem. Do not disable the family as a reflex to avoid leaks — it is the blunt last resort rather than the fix, and it breaks local features and any service that only speaks the new family.

And keep the mental model rather than the hexadecimal: the prefix is your line and you do not control it, the identifier is your device and it now rotates, and the entry on the tunnel interface is the only one whose existence tells you the tunnel is carrying this family at all.