IPv6 Packet · Topic 1 of 2
IPv6 Header and Fields
Learn the fixed 40 byte IPv6 header, what each field does, how it differs from the IPv4 header, and how extension headers are chained with Next Header.
- 4 min
- The IPv6 base header is a fixed 40 bytes.
- It has Version, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, and two 128 bit addresses.
- Next Header replaces the IPv4 Protocol field.
What it is
The IPv6 header is a fixed 40 byte header that carries just the fields a router needs to forward a packet.
IPv4 headers vary in size and carry fields for options, fragmentation and a checksum. IPv6 removed or moved most of them. The result is a header that routers can process quickly in a predictable way.
Anything optional goes into extension headers, which sit between the main header and the payload.
How it works
The header has eight fields, and the two addresses take most of the space.
The eight header fields
| Field | Size | Purpose |
|---|---|---|
| Version | 4 bits | Always 6 |
| Traffic Class | 8 bits | Priority marking, like DSCP in IPv4 |
| Flow Label | 20 bits | Labels packets of one flow |
| Payload Length | 16 bits | Size of everything after the base header |
| Next Header | 8 bits | Type of the header or protocol that follows |
| Hop Limit | 8 bits | Counts down at each router |
| Source Address | 128 bits | Sender |
| Destination Address | 128 bits | Receiver |
Add the fields up and you get 40 bytes. Two addresses of 16 bytes each make 32 bytes, and the other fields make 8 bytes.
Traffic Class lets networks give some packets better treatment. Flow Label lets a router keep packets of one conversation together without looking inside them. Payload Length does not count the 40 byte base header.
Hop Limit replaces the IPv4 Time to Live. Each router subtracts one. When it reaches zero, the router drops the packet and sends back an ICMPv6 Time Exceeded message.
Comparing with IPv4
| IPv4 field | What happened in IPv6 |
|---|---|
| Header length | Removed, because the header has a fixed size |
| Type of service | Renamed Traffic Class |
| Total length | Became Payload Length |
| Identification, flags, fragment offset | Moved into a Fragment extension header |
| Time to live | Renamed Hop Limit |
| Protocol | Renamed Next Header |
| Header checksum | Removed |
| Options | Moved into extension headers |
| Flow label | New in IPv6 |
The checksum was dropped because link layers and transport protocols already protect the data. Routers no longer recompute it at each hop, which saves work. TCP and UDP checksums still exist, and in IPv6 the UDP checksum is required.
Extension headers and Next Header
The Next Header field says what comes after the current header. In a plain packet it names the transport protocol. When extension headers are present, each one points at the next, and the last one points at the payload.
| Value | Meaning |
|---|---|
| 0 | Hop by Hop Options |
| 6 | TCP |
| 17 | UDP |
| 43 | Routing header |
| 44 | Fragment header |
| 50 | ESP, used by IPsec |
| 51 | AH, used by IPsec |
| 58 | ICMPv6 |
| 59 | No next header |
| 60 | Destination Options |
An example chain: the base header has Next Header 44, so a Fragment header follows. The Fragment header has Next Header 6, so a TCP segment follows.
Only the Hop by Hop Options header is read by every router on the path. Others are read by the destination, or by routers named in a routing header. This keeps forwarding fast.
Fragmentation in IPv6
Routers do not fragment IPv6 packets. If a packet is too big for a link, the router drops it and sends a Packet Too Big message.
A sender that must send a large packet fragments it itself, using the Fragment header. The next page covers this in detail.
Seeing header fields on RouterOS
The IPv6 firewall can match several header fields. You can match on the hop limit, on the traffic class through the DSCP value, and on the presence of extension headers. The Next Header value of the upper protocol is what you select with the protocol setting, for example icmpv6.
/ipv6 firewall filter add chain=forward protocol=icmpv6 action=acceptUse the Next Header table to decode a packet capture. Value 58 means ICMPv6, 6 means TCP and 17 means UDP.
What to remember for the exam
Eight facts cover most questions on this topic.
- The IPv6 base header is a fixed 40 bytes.
- It has Version, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, and two 128 bit addresses.
- Next Header replaces the IPv4 Protocol field.
- Hop Limit replaces Time to Live.
- There is no header checksum and no header length field.
- Fragmentation information moved into the Fragment extension header.
- Extension headers are chained using Next Header.
- Next Header values include 6 for TCP, 17 for UDP, 58 for ICMPv6 and 44 for Fragment.
Payload Length excludes the 40 byte base header, so it is not the same as the IPv4 Total Length.
Common mistakes
These four mistakes appear often.
Expecting a header checksum. IPv6 has none. Upper layer protocols carry their own checksums.
Assuming routers fragment. Only the source node fragments an IPv6 packet.
Confusing Next Header with Protocol in the same position. It does the same job, but it can also point at an extension header.
Counting the base header in Payload Length. The field covers only what follows the base header.
Check yourself
Work through these three questions.
How large is the IPv6 base header?
It is a fixed 40 bytes.
Which IPv6 field replaces the IPv4 Time to Live?
The Hop Limit field.
What does the Next Header value 58 mean?
The packet carries ICMPv6.
Topic 1 of 2 in IPv6 Packet
Test yourself on IPv6 Packet
The full MikroTik MTCIPv6E question bank has 486 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.