--- title: "IPv4 vs IPv6: Differences, NAT, Geolocation, and How to Check Yours" description: "How IPv4 and IPv6 differ in practice: address size, NAT, dual-stack exits and geolocation drift, plus commands to check your IPv6 on Windows, macOS and Linux." url: https://cdnping.org/en/blog/ipv4-vs-ipv6-how-to-check-yours language: en published: 2026-10-23 category: "Networking basics" tags: ["IPv6","IPv4","dual stack","egress IP","network check"] source: cdnping.org license: Free to quote and summarize with a link to the url above. --- # IPv4 vs IPv6: Differences, NAT, Geolocation, and How to Check Yours The most direct difference between IPv4 and IPv6 is address length: IPv4 is 32 bits and IPv6 is 128 bits, so IPv6 no longer needs NAT to let a group of devices share one public address. What affects day-to-day use more is something else: many home and mobile networks are now "dual stack," meaning one computer has both an IPv4 and an IPv6 exit. Which one a given site uses, and whether the two exits show the same location and ISP, is not guaranteed. This post explains the differences first, then gives a step-by-step self-check: does your machine have IPv6, what are your two exits, and which one does your browser actually use. ## What actually differs between IPv4 and IPv6? Plenty of comparison tables online contradict each other, for example "IPv6 is more secure" or "IPv6 has no broadcast so it is faster." The list below only includes differences you can confirm at the protocol level and that affect troubleshooting. | Item | IPv4 | IPv6 | |---|---|---| | Address length | 32 bits, about 4.3 billion addresses (2^32) | 128 bits | | Notation | Dotted decimal, e.g. `203.0.113.7` | 8 colon-separated hex groups; leading zeros can be dropped, and one run of all-zero groups can be compressed with `::`, e.g. `2001:db8::7` | | In a URL | Written directly: `http://203.0.113.7:8080/` | Must use brackets: `http://[2001:db8::7]:8080/` | | Where the public address comes from | The ISP gives the router one address (sometimes even that is a shared address behind CGNAT), and home devices go through NAT | The ISP delegates a prefix, and every device at home gets its own globally routable address | | Address configuration on the LAN | DHCP | SLAAC (the router sends advertisements and devices generate their own addresses) and/or DHCPv6 | | Layer-2 address resolution | ARP | NDP, based on ICMPv6 | | Broadcast | Yes | No; uses multicast instead, e.g. `ff02::1` for all nodes on the link | | Header | Variable length, has a checksum, routers can fragment | Fixed 40-byte base header, no checksum, fragmentation only at the source, other features moved into extension headers | ### Is "IPv6 is more secure" true? Not entirely. Early specifications required IPv6 implementations to support IPsec, and many articles turned that into "IPv6 has built-in encryption." Later specifications relaxed that requirement to "should support," and "supported" does not mean "enabled by default." The encryption you rely on when visiting a website is still HTTPS, regardless of whether you go over v4 or v6. The security difference that really matters is on the other side: with IPv4, home devices sit behind NAT and outsiders cannot reach them by default. With IPv6, every device has a public address, and whether it can be reached from outside depends entirely on the firewall rules of your router and operating system. Also, you cannot block ICMPv6 wholesale the way some people treat ICMP on IPv4, because neighbor discovery and path MTU discovery depend on it. ### What does having no NAT mean? On IPv4, a website usually sees "your router's public address," or, if the ISP also runs CGNAT, an address shared by many users (for how that affects IP reputation, see [Do shared IPs and CGNAT affect IP reputation?](/en/blog/shared-ip-cgnat-reputation)). On IPv6, the website sees your device's own address. So that a fixed address does not expose a device's identity for long, mainstream operating systems enable "privacy extensions" by default: they generate temporary addresses in addition to the stable one, prefer the temporary address for outgoing connections, and rotate it regularly. So the IPv6 exit you look up today may change in a few hours, although the network prefix in front usually stays the same. ## Why can one machine have two exits? On a dual-stack network, the system has both IPv4 and IPv6 addresses and default routes. When you visit a domain, the system looks up both the A record (v4) and the AAAA record (v6). If the site has both, modern browsers and operating systems use a strategy called Happy Eyeballs: try IPv6 first, and if it has not connected after a short wait, start IPv4 in parallel and use whichever succeeds first. This has a few easily overlooked consequences: - Different resources on the same page can use different protocols. The main site has an AAAA record and goes over v6, while a third-party API that only has an A record goes over v4. - When v6 is flaky, the system quietly falls back. The page still opens, just occasionally a beat slower, and you may not realize v6 has a problem. - The two exits can belong to different networks. For example, the v4 exit may pass through a company gateway or another forwarding path, while the v6 exit goes straight out through the local ISP. If a website sees both, it will think your location is inconsistent. If the last case involves a proxy, the cause and troubleshooting steps are covered separately in [IPv6 proxy not working: why IPv4 and IPv6 exits differ on dual-stack networks](/en/blog/ipv6-dual-stack-proxy-mismatch). This post does not go into proxy configuration. ## Why is IPv6 geolocation often inaccurate? Looking up an IPv4 address can often get you down to the city. For IPv6 you commonly get only the province or state, or just the country, and different geolocation databases can give results that are far apart. There are three main reasons: 1. Sparse data. Geolocation databases derive locations from registration records, public ISP information, measurements and user feedback. IPv4 blocks have been in use for decades and have accumulated a lot of data. IPv6 address space is enormous, so the same amount of data is spread very thin. 2. Coarse allocation. ISPs get very large IPv6 blocks from the registry and then split them across provinces and cities according to their own plans. That internal split is often not public, so databases can only estimate at the level of the large block. 3. Addresses change. Privacy extensions rotate device addresses, and some ISPs' delegated prefixes change after a reconnect, so location data accumulated for a single address rarely stays valid for long. For how geolocation databases work and where they disagree, see [Why 11 IP databases give different locations](/en/blog/ip-geolocation-databases-differ) and [Why IP geolocation is inaccurate](/en/blog/why-ip-location-is-inaccurate). A more reliable approach than trusting any single database is to look at who owns the network block: querying RDAP for the registration record of the block that contains the address confirms the ISP and the registered country. That information comes from the registry and is much more stable than geographic location. In China, residential broadband IPv6 addresses commonly start with `240e`, `2408` or `2409`, which correspond to large blocks of the three major carriers, but rely on the RDAP result for the actual owner. ## How do I check whether I have IPv6? Check the machine first, then the exit, then the browser. You need all three results together to tell what is going on. ### Step 1: Does the machine have a global IPv6 address? **Windows** (Command Prompt or PowerShell): ```powershell ipconfig # Look at "IPv6 Address" and "Temporary IPv6 Address" under the current adapter # "Link-local IPv6 Address" (starts with fe80) is not a public address Get-NetIPAddress -AddressFamily IPv6 | Format-Table InterfaceAlias,IPAddress,PrefixOrigin,SuffixOrigin # PrefixOrigin of RouterAdvertisement means SLAAC; Dhcp means DHCPv6 route print -6 # Only if there is a ::/0 default route does the system know how to send v6 traffic out ``` **macOS**: ```bash ifconfig en0 | grep inet6 # "secured" marks the stable address; "temporary" marks the temporary address from privacy extensions # Wi-Fi is usually en0; wired may be en1 or another number netstat -rn -f inet6 | grep default ``` **Linux**: ```bash ip -6 addr show scope global # Output means you got a global address; the temporary flag marks a temporary address ip -6 route show default ``` Read the type of each address from its prefix: | Prefix | Type | Reaches the internet? | |---|---|---| | `2` or `3` (e.g. `240e:`, `2408:`, `2001:`) | Global unicast address | Yes | | `fe80:` | Link-local address, every NIC has one | No | | `fd` or `fc` | Unique local address (ULA), similar to 192.168 on v4 | No | | `::1` | Loopback | No | If you only see `fe80` and nothing starting with `2` or `3`, you can be fairly sure the network is not delegating IPv6 to you. ### Step 2: What are your two exits? Use `curl` to force v4 and v6 separately and send a request to Cloudflare's trace endpoint. The `ip=` line in the response is the exit address the other side sees. Windows 10 (1803 and later) and Windows 11 ship with curl; in PowerShell write it as `curl.exe` so the alias does not replace it. ```bash curl -4 -s https://cloudflare.com/cdn-cgi/trace | grep -E 'ip=|loc=' curl -6 -s https://cloudflare.com/cdn-cgi/trace | grep -E 'ip=|loc=' ``` Windows PowerShell: ```powershell curl.exe -4 -s https://cloudflare.com/cdn-cgi/trace curl.exe -6 -s https://cloudflare.com/cdn-cgi/trace ``` `loc=` is the country code as Cloudflare judges it, so treat it as a reference only. If the `-6` command errors or times out even though Step 1 showed a global address, the usual causes are the IPv6 firewall on the router or ONT (the fiber modem), or a problem upstream. You can narrow it down with `ping -6` (`ping6` on macOS) against a domain that supports IPv6. To see which hop on the path has the problem, use `traceroute -6`, `mtr -6`, or `tracert -6` on Windows; reading the output is the same as for v4, see [How to read traceroute and mtr results](/en/blog/traceroute-mtr-how-to-read). Also check whether the site you want to reach supports IPv6 at all: ```bash dig AAAA example.com +short # Windows: nslookup -type=AAAA example.com ``` A site without an AAAA record will only ever be reached over IPv4, no matter how complete your own network is. ### Step 3: Which one does the browser actually use? Command-line results are not the same as browser behavior. A browser has its own DNS settings (for example, if DoH is on; for setup see [DNS over HTTPS setup guide](/en/blog/dns-over-https-setup-guide)), may have extensions installed, and then Happy Eyeballs races the two protocols. Which protocol is finally used can only be measured in the browser. Open [cdnping's IP and environment check](/en/ip) and look at the IPv4/IPv6 detection to confirm the browser's connectivity and exit address over each protocol. The exit IP intelligence on that page runs a vote across 11 geolocation databases and reports a confidence level, uses RDAP for the block registration record, and classifies IP type as datacenter, residential, mobile or Tor. Compare the v4 and v6 addresses side by side to see whether they belong to the same ISP and whether the locations agree. The same page also has DNS leak and WebRTC leak tests. On a dual-stack network, WebRTC can expose the machine's IPv6 address to web pages; for how that works see [DNS leak and WebRTC leak](/en/learn/dns-leak-webrtc-leak), and for how to turn it off see [How to disable WebRTC leaks](/en/blog/fix-webrtc-leak-chrome-firefox-safari). ## How do I read the results? Compare the results of the three steps against this table: | Global v6 address on the machine | `curl -6` | Browser check | What it means | |---|---|---|---| | None | Fails | v4 only | The network has no IPv6. This is normal and does not affect use | | Yes | Fails | v4 only | The address was delegated but traffic cannot get out; check the router firewall, the default route and the upstream | | Yes | Works | v4 only | The browser fell back to v4; the site may have no AAAA record, or browser DNS settings or extensions are interfering | | Yes | Works | v4 and v6 both work, same ISP | A standard dual-stack network | | Yes | Works | v4 and v6 both work, different ISP or location | The two paths are inconsistent; first confirm whether forwarding or a proxy is involved, then see whether it affects the services you use | The last case is the one most likely to cause trouble with region-sensitive services, because the server may record both exits. Whether you need to unify the exit and how depends on your network environment, and should comply with the terms of the service you use and local regulations. The troubleshooting approach is in the dual-stack exit article mentioned above. ## What else should developers watch for? - The IP field in server logs must be able to hold IPv6. A `VARCHAR(15)` designed for IPv4 cannot store an IPv6 address; the longest full form is 39 characters. Use the database's native address type, or at least 45 characters, to be safe. - When rate limiting by IP, count v6 by prefix. A device's temporary address rotates, and a home network usually gets a whole prefix, so counting individual /128 addresses is almost the same as not limiting at all. Aggregating at /64 or a shorter prefix is closer to "one user." - Use brackets when writing IPv6 addresses in config. This applies to API addresses, proxy addresses and `curl` URLs alike; `http://2001:db8::1:8080` will be parsed wrongly. - Test connectivity over each protocol separately. Run `curl -4` and `curl -6` once each. If you test only one, the fallback mechanism hides failures on the other path. If you want to check your exit IP, DNS and latency to AI APIs together, follow the order in the [developer network self-check list (2026 edition)](/en/blog/developer-network-self-check-2026). How each cdnping check is measured is documented on the [methodology](/en/methodology) page.