SLAAC, short for Stateless Address Autoconfiguration, is the IPv6 mechanism through which a host configures its own addresses by combining a network prefix announced by a router with an interface identifier it generates locally. In address configuration, it is the default way IPv6 devices obtain a usable global address without any server keeping track of assignments.
SLAAC is defined in RFC 4862 and relies on Neighbor Discovery messages from RFC 4861. It is called stateless because no central component records which host holds which address, unlike DHCP, where a server maintains a lease table.
How SLAAC builds an IPv6 address
The process starts with the link-local address. As soon as an interface comes up, the host forms an address in fe80::/64 from its interface identifier and runs Duplicate Address Detection to confirm that no other node uses it. Only then can it talk to routers on the link.
Next, the host sends a Router Solicitation to the all-routers multicast group, and routers reply with a Router Advertisement. Routers also send advertisements periodically, typically every few minutes. The advertisement carries one or more Prefix Information options, and each prefix with the autonomous flag set lets the host append its interface identifier to form a global address.
The steps below summarize the sequence a host follows on a typical network.
| Step | Message or action | Result |
|---|---|---|
| 1. Link-local address | Generate fe80:: address | Local communication becomes possible |
| 2. Duplicate check | Neighbor Solicitation for the tentative address | Address confirmed as unique |
| 3. Router discovery | Router Solicitation and Advertisement | Prefixes, flags and default gateway learned |
| 4. Global address | Prefix plus interface identifier | Routable IPv6 address assigned |
| 5. Lifetime tracking | Valid and preferred lifetimes | Address renewed or deprecated over time |
SLAAC requires a /64 prefix because the interface identifier is 64 bits long. Advertising a /56 or /72 for autoconfiguration simply does not work, which is why IPv6 subnets meant for hosts are almost always /64.
Interface identifiers and privacy
The original SLAAC design derived the interface identifier from the MAC address using modified EUI-64, which inserts ff:fe into the middle of the 48-bit hardware address and flips one bit. This made the address stable but also made a device trackable across networks, since the lower 64 bits never changed.
Modern operating systems therefore use other methods by default. The table compares the main variants.
| Method | Stability | Main purpose |
|---|---|---|
| Modified EUI-64 | Same on every network | Legacy default, now discouraged for hosts |
| Stable opaque identifier (RFC 7217) | Stable per network, differs between networks | Predictable for servers without tracking |
| Temporary address (RFC 8981) | Rotates, often daily | Privacy for outgoing connections |
A typical laptop holds several IPv6 addresses at once: one link-local, one stable global address and one or more temporary addresses. Outbound connections usually prefer the temporary address, so logs on remote servers do not reveal a permanent identity.
Router advertisement flags and parameters
The router controls SLAAC behavior through flags and lifetimes in each advertisement. Getting them right decides whether hosts use SLAAC, DHCPv6 or both.
| Setting | Typical value | Effect on hosts |
|---|---|---|
| A flag (autonomous) | Set per prefix | Allows SLAAC for that prefix |
| M flag (managed) | 0 or 1 | Signals that addresses come from DHCPv6 |
| O flag (other config) | 0 or 1 | Signals that DNS and other options come from DHCPv6 |
| Valid lifetime | Often 30 days or less | When the address stops working |
| Preferred lifetime | Often 7 days or less | When new connections stop using the address |
| RDNSS option (RFC 8106) | One or more DNS server addresses | Supplies DNS without DHCPv6 |
When the preferred lifetime expires, the address becomes deprecated: existing sessions continue, but new ones use another address. When the valid lifetime expires, the address is removed. This gives administrators a graceful way to renumber a network.
SLAAC compared with DHCP and DHCPv6
SLAAC and DHCP solve the same problem in different ways, and many networks combine them. The decisive difference is who decides the address and whether anyone keeps a record.
| Aspect | SLAAC | Stateful DHCPv6 or DHCP |
|---|---|---|
| Address chosen by | The host itself | The server |
| Lease records | None | Central lease table |
| Fixed assignment | Only via stable identifier | Reservations by DUID or MAC |
| DNS servers | RDNSS option or stateless DHCPv6 | DHCP options |
| Android support | Yes | No stateful DHCPv6 address client |
The last row matters in practice: Android devices do not request addresses through stateful DHCPv6, so a network that disables SLAAC leaves them without global IPv6 connectivity. In IPv4 networks, DHCP and DHCP reservations remain the standard, because SLAAC exists only for IPv6.
Common SLAAC problems
Most SLAAC failures trace back to router advertisements, either missing, wrong or forged. The following issues appear regularly.
- No /64 prefix: an advertised prefix of another length silently prevents address formation.
- Rogue router advertisements: any host on the link can send them, so switches should enable RA Guard to accept advertisements only from router ports.
- Missing DNS: hosts get addresses but cannot resolve names when neither RDNSS nor stateless DHCPv6 is configured.
- Audit gaps: without lease records, mapping an address to a device requires neighbor cache logs or switch data.
- Firewall blocking ICMPv6: dropping Neighbor Discovery traffic breaks SLAAC entirely, so these ICMPv6 types must remain allowed.
The simple explanation
Imagine moving into a new street where the sign at the corner tells you the street name. You choose your own house number, check that no neighbor already uses it, and start receiving mail. Nobody at city hall needs to hand you a number.
That is SLAAC in everyday terms. The router announces the network part of the address, and each device completes the rest on its own. The benefit is that a network works without a central address server, while the trade-off is that nobody keeps an official list of who lives where.
How it is used in practice
An office network receives a /56 prefix from its internet provider. The administrator assigns one /64 per VLAN on the router and enables advertisements with the A flag set and an RDNSS option pointing to the internal DNS resolver.
Laptops, phones and printers obtain global IPv6 addresses within seconds of connecting. Workstations use temporary addresses for web browsing, while the printers keep stable RFC 7217 addresses that the administrator records in DNS. IPv4 continues to run through DHCP in parallel.
When the provider later changes the prefix, the administrator advertises the new prefix and lowers the preferred lifetime of the old one to zero. Devices move to the new addresses without manual reconfiguration, and the old prefix is withdrawn after its valid lifetime ends.