Summary

  • RFC 8981 rotates randomized IPv6 interface identifiers to narrow the period in which reuse of one address makes activity trivially linkable.
  • The mechanism does not conceal the network prefix or prevent correlation through packet size, timing, DNS, cookies, accounts or other stable identifiers.
  • An on-link observer, including a default router, can still see the host’s changing addresses.
  • A privacy claim therefore needs evidence across the address, prefix, observer, transport and application layers rather than a single configuration flag.

Picture a laptop that receives a fresh temporary IPv6 address overnight. A monitoring screen now shows two interface identifiers, and an inventory report marks privacy extensions as enabled. Yet both addresses sit under the same lightly populated /64, contact the same services at the same cadence and resume the same authenticated sessions. The address changed; the correlation surface barely did.

This is a hypothetical trace, not an allegation about a named network. It exposes a category error: address rotation is a privacy control with a defined scope, not an anonymity certificate.

What temporary addressing changes

RFC 8981 extends Stateless Address Autoconfiguration so a host can generate temporary addresses with randomized interface identifiers for each eligible advertised prefix. Those addresses change over time. The immediate benefit is precise: an observer has a shorter interval in which repeated use of exactly the same address makes separate transactions easy to correlate.

That can matter. A long-lived address can become a durable handle in peer logs, and an address exposed by an outgoing connection can remain a target. Rotation reduces both the correlation window and the period for which a revealed address remains useful.

Hosts may retain stable addresses as well as temporary ones, and applications can influence which kind they use. Seeing the feature enabled does not prove that a particular application selected a temporary source address, that every flow moved to it or that old addresses and logs expired on schedule.

What remains visible

The standard is explicit about the limits. Temporary addresses do not prevent an on-path party from correlating cleartext content or traffic characteristics such as packet size and timing. They do not stop an on-link observer, including the default router, from tracking the addresses used by the same host.

The prefix can remain constant too. A rotating interface identifier under a household or enterprise prefix still discloses the same topological group. If the prefix contains only one or a few active hosts, the anonymity set may be too small for rotation to obscure much.

Other identifiers can bridge the change. A DNS name, browser cookie, authenticated account, transport token or distinctive activity pattern can join transactions made before and after rotation. RFC 7721 treats address-generation choices as trade-offs against specific threats, not as a universal answer to tracking.

Prove the narrow benefit

An operator should test the path actually taken. Record which temporary and stable addresses were configured, their preferred and valid lifetimes, which source address each application selected, whether the prefix changed, and how quickly the retired address disappeared from use. Then examine what an observer at each relevant position can still connect.

The result may justify a useful but bounded claim: direct correlation by reuse of one address became harder after a measured interval. It cannot justify “anonymous” unless the remaining correlation channels have been assessed independently.