EUI-64 and IPv6 Address Generation: From MAC to Interface Identifier

IPv6 stateless address autoconfiguration originally derived its interface identifier from the MAC address. That design created a serious privacy problem and has since been replaced. The history is worth knowing, because older devices and some embedded systems still use the original method.

The EUI-64 conversion

Expanding a 48-bit MAC into a 64-bit interface identifier takes two steps:

1. Insert FF:FE in the middle. Split the MAC in half and insert two bytes, FF:FE, between the first three bytes and the last three.
2. Flip the U/L bit. Invert the second least significant bit of the first byte.

Using 40:6C:8F:18:2C:03:

Original MAC:   40:6C:8F:18:2C:03
Insert FF:FE:   40:6C:8F:FF:FE:18:2C:03
Flip U/L bit:   42:6C:8F:FF:FE:18:2C:03

The first byte 0x40 is binary 01000000. Its second least significant bit is 0, and flipping it gives 01000010, which is 0x42. So the interface identifier is 426C:8FFF:FE18:2C03.

Note that the polarity here is the reverse of the MAC convention. In a MAC address a U/L bit of 0 means globally unique, while in an EUI-64 identifier 1 means globally unique. The inversion is a historical design choice with no technical necessity, and it is the step people most often get wrong when working by hand. The bit meanings are covered in reading the first byte of a MAC address.

Assembling the full address

A router advertises a 64-bit prefix and the host concatenates prefix and identifier. With a prefix of 2001:db8:1234:5678::/64:

2001:db8:1234:5678:426c:8fff:fe18:2c03

The link-local address uses the fixed prefix fe80::/64:

fe80::426c:8fff:fe18:2c03

Seeing FF:FE in the middle of an address is a reliable sign of EUI-64 generation. Stitch the first three and last three bytes back together and you can recover the MAC and look up its vendor on the lookup page.

Why it was abandoned

EUI-64 keeps the lower 64 bits of an IPv6 address constant for the lifetime of the device, regardless of which network it joins. The prefix changes and the interface identifier does not. That effectively hands every device a globally unique, permanent tracking label, easier to correlate than a NATed address ever was in the IPv4 era. Any website can recognise a returning device from the second half of its address.

It also leaks vendor information. The OUI is readable straight from the address, letting an attacker infer the device type and narrow a vulnerability scan.

What is used now

RFC 4941 temporary addresses, the privacy extensions. Randomly generated interface identifiers that rotate periodically. Enabled by default on most systems for outbound connections.

RFC 7217 stable privacy addresses. The identifier is a hash over the prefix, the interface name and a host-local secret key. Stable within one network and completely different on another, which balances manageability against privacy. This is the current recommendation.

To inspect the active policy:

# Linux
sysctl net.ipv6.conf.all.use_tempaddr
ip -6 addr show

# Windows
netsh interface ipv6 show privacy

On Linux a use_tempaddr value of 2 means temporary addresses are enabled and preferred. Addresses flagged temporary in the output are the privacy ones.

Troubleshooting notes

An IPv6 address of the form ...ff:fe... on your network means some device is still using EUI-64, commonly printers, cameras and industrial controllers. Such devices usually do not support address randomisation either, so their MACs remain stable asset identifiers, which is actually useful when doing network inventory.