Most DDoS tooling was built when an address was a meaningful unit of identity. Blocklists, per-address rate limits, and reputation scores all assume that an attacker has a limited number of addresses and that burning one costs something. IPv6 removes that assumption.
Why Per-Address Logic Breaks
A typical IPv6 allocation to a single customer contains an enormous number of usable addresses. An attacker who controls one such allocation can send every request from an address never seen before. Per-address rate limits never trigger, blocklists grow without bound, and reputation systems have nothing to accumulate.
Rate limit by prefix
The practical fix is to apply limits to a network prefix rather than a single address, so that an entire allocation shares one budget. Choosing the prefix length is a trade-off between catching the attacker and grouping unrelated customers together.
Other Differences That Matter
- Extension headers add parsing work and have historically been used to slip past filters that stop reading too early.
- Neighbour discovery replaces ARP and has its own exhaustion attacks against routers on the local segment.
- Fragmentation behaves differently, and fragment handling is a recurring source of filter bypasses.
- Dual-stack services effectively have two attack surfaces, and controls are often configured on only one of them.
The Most Common Real-World Failure
It is not an exotic protocol attack. It is a firewall or rate limiting policy that was carefully written for IPv4 and never mirrored for IPv6, on a host that quietly answers on both. The attacker does not need to defeat the control; they simply connect over the transport where it does not exist.
What to Do
- Audit every filtering rule for a matching IPv6 rule, and test from an IPv6 client rather than assuming.
- Express rate limits and blocks in terms of prefixes, with a sensible default length for customer allocations.
- Log the full address and the prefix, so analysis can group traffic after the fact.
- If you do not serve IPv6 deliberately, make sure you are not serving it accidentally — a published record with no matching protection is a bypass waiting to be found.