# IPv6 and DDoS: The Address Space Changes the Defence

> Blocking by address works because addresses are scarce. In IPv6 they are not, and a single attacker may hold more addresses than the entire IPv4 internet. What that breaks, and what replaces it.

- Category: Technical Deep Dive
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/ipv6-ddos

---

Most DDoS tooling was built when an address was a meaningful unit of identity. Blocklists, per-address rate limits, and reputation scores all assume that an attacker has a limited number of addresses and that burning one costs something. IPv6 removes that assumption.

## Why Per-Address Logic Breaks

A typical IPv6 allocation to a single customer contains an enormous number of usable addresses. An attacker who controls one such allocation can send every request from an address never seen before. Per-address rate limits never trigger, blocklists grow without bound, and reputation systems have nothing to accumulate.

> **Rate limit by prefix** — The practical fix is to apply limits to a network prefix rather than a single address, so that an entire allocation shares one budget. Choosing the prefix length is a trade-off between catching the attacker and grouping unrelated customers together.

## Other Differences That Matter

- Extension headers add parsing work and have historically been used to slip past filters that stop reading too early.
- Neighbour discovery replaces ARP and has its own exhaustion attacks against routers on the local segment.
- Fragmentation behaves differently, and fragment handling is a recurring source of filter bypasses.
- Dual-stack services effectively have two attack surfaces, and controls are often configured on only one of them.

## The Most Common Real-World Failure

It is not an exotic protocol attack. It is a firewall or rate limiting policy that was carefully written for IPv4 and never mirrored for IPv6, on a host that quietly answers on both. The attacker does not need to defeat the control; they simply connect over the transport where it does not exist.

## What to Do

- Audit every filtering rule for a matching IPv6 rule, and test from an IPv6 client rather than assuming.
- Express rate limits and blocks in terms of prefixes, with a sensible default length for customer allocations.
- Log the full address and the prefix, so analysis can group traffic after the fact.
- If you do not serve IPv6 deliberately, make sure you are not serving it accidentally — a published record with no matching protection is a bypass waiting to be found.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.