Using 127-Bit IPv6 Prefixes on Inter-Router Links
updated by
- rfc-6547 — RFC 3627 to Historic Status
Extracted elements (15)
RFC 3627 discouraged /127 prefixes due to conflicts with Subnet-Router anycast addresses. This document reevaluates that position, concluding that the Subnet-Router anycast address has questionable utility on point-to-point links and that operational experience shows /127 prefixes can be used successfully when anycast is explicitly disabled.
Some operators prefer not to assign a full /64 to each individual point-to-point link for address management reasons; using /127 prefixes allows all point-to-point links to be numbered out of a single /64 or small number of /64s, simplifying address planning.
Using /127 prefixes on inter-router links parallels the established IPv4 practice of using /30 or /31 prefixes (RFC 3021) on point-to-point links, driven by similar motivations: address conservation and elimination of forwarding loop attack vectors.
RFC 4291 requires interface IDs for all unicast addresses (except those starting with binary 000) to be 64 bits in Modified EUI-64 format; /127 prefixes conflict with this requirement, and operators must be aware that Subnet-Router anycast must be disabled to avoid address collisions.
The /127 prefix recommendations do not apply to the link-local address scope; they are scoped to globally routable addresses assigned by operators for management, reverse DNS, EBGP peering, and similar purposes.
The recommendations in this document apply only to inter-router point-to-point links (exactly two routers, no hosts attached); links between a router and a host, or links with both routers and hosts, are explicitly out of scope.
Addresses in which the rightmost 64 bits are assigned the highest 128 values (ffff:ffff:ffff:ff7f through ffff:ffff:ffff:ffff) SHOULD NOT be used as unicast addresses, to avoid colliding with reserved subnet anycast addresses per RFC 2526.
Per RFC 4443, a router receiving a packet on a point-to-point link destined to an address within a subnet assigned to that same link (other than its own addresses) MUST NOT forward the packet back on that link; it SHOULD generate an ICMPv6 Destination Unreachable (code 3) instead.
Routers MUST disable Subnet-Router anycast for the prefix when /127 prefixes are used on a link.
Routers MUST support the assignment of /127 prefixes on point-to-point inter-router links.
When numbering multiple point-to-point links out of a single /64, addresses with all zeros in the rightmost 64 bits SHOULD NOT be assigned as unicast addresses, to avoid colliding with the Subnet-Router anycast address defined in RFC 4291.
The /127 prefix length on an inter-router point-to-point link yields exactly two host addresses (the two router endpoints), eliminating the subnet-router anycast address and all unused addresses that would otherwise be present in a /64.
Assigning a /64 to an Ethernet inter-router link enables a neighbor cache exhaustion DoS: an attacker can send packets to the 2^64 - 3 unassigned addresses, forcing routers to create INCOMPLETE neighbor cache entries and flood the link with unanswered Neighbor Solicitations, consuming memory, CPU, and potentially preventing BGP sessions from re-establishing after a link flap.
On point-to-point links that do not use Neighbor Discovery (e.g., SONET links), assigning a prefix shorter than /127 creates a ping-pong forwarding loop attack vector: packets addressed to unused addresses in the subnet bounce between the two routers indefinitely.
Sending packets to addresses sharing a Solicited-Node multicast address with a router causes that router to spend significant processing time discarding useless Neighbor Solicitation messages; rate-limiting and garbage collection reduce but do not eliminate this impact, whereas /127 subnets eliminate it entirely.