IPv6 Addressing

View source on GitHub

Let's take a look at how Thread identifies each device in the network, and what types of addresses they use to communicate with each other.


OT Scopes

There are three scopes in a Thread network for unicast addressing:

  • Link-Local — all interfaces reachable by a single radio transmission
  • Mesh-Local — all interfaces reachable within the same Thread network
  • Global — all interfaces reachable from outside a Thread network

The first two scopes correspond to prefixes designated by a Thread network. Link-Local have prefixes of fe80::/16, while Mesh-Local have prefixes of fd00::/8.


There are multiple IPv6 unicast addresses that identify a single Thread device. Each has a different function based on the scope and use case.

Before we detail each type, let's learn more about a common one, called the Routing Locator (RLOC). The RLOC identifies a Thread interface, based on its location in the network topology.

How a Routing Locator is generated

All devices are assigned a Router ID and a Child ID. Each Router maintains a table of all their Children, the combination of which uniquely identifies a device within the topology. For example, consider the highlighted nodes in the following topology, where the number in a Router (pentagon) is the Router ID, and the number in an End Device (circle) is the Child ID:

OT RLOC Topology

Each Child's Router ID corresponds to their Parent (Router). Because a Router is not a Child, the Child ID for a Router is always 0. Together, these values are unique for each device in the Thread network, and are used to create the RLOC16, which represents the last 16 bits of the RLOC.

For example, here's how the RLOC16 is calculated for the upper-left node (Router ID = 1 and Child ID = 1):


The RLOC16 is part of the Interface Identifier (IID), which corresponds to the last 64 bits of the IPv6 address. Some IIDs can be used to identify some types of Thread interfaces. For example, the IID for RLOCs is always in this form:


The IID, combined with a Mesh-Local Prefix, results in the RLOC. For example, using a Mesh-Local Prefix of fde5:8dba:82e1:1::/64, the RLOC for a node where RLOC16 = 0x401 is:


This same logic can be used to determine the RLOC for all highlighted nodes in the sample topology above:

OT Topology w/ Address

However, because the RLOC is based on the location of the node in the topology, the RLOC of a node can change as the topology changes.

For example, perhaps node 0x400 is removed from the Thread network. Nodes 0x401 and 0x402 establish new links to different Routers, and as a result they are each assigned a new RLOC16 and RLOC:

OT Topology after Change

Unicast address types

The RLOC is just one of many IPv6 unicast addresses a Thread device can have. Another category of addresses are called Endpoint Identifiers (EIDs), which identify a unique Thread interface within a Thread network partition. EIDs are independent of Thread network topology.

Common unicast types are detailed below.

An EID that identifies a Thread interface reachable by a single radio transmission.
IIDBased on 802.15.4 Extended Address
  • Used to discover neighbors, configure links, and exchange routing information
  • Not a routable address
  • Always has a prefix of fe80::/16

Mesh-Local EID (ML-EID)

An EID that identifies a Thread interface, independent of network topology. Used to reach a Thread interface within the same Thread partition. Also called a Unique Local Address (ULA).
IIDRandom, chosen after commissioning is complete
  • Does not change as the topology changes
  • Should be used by applications
  • Always has a prefix fd00::/8

Routing Locator (RLOC)

Identifies a Thread interface, based on its location in the network topology.
  • Generated once a device attaches to a network
  • For delivering IPv6 datagrams within a Thread network
  • Changes as the topology changes
  • Generally not used by applications

Anycast Locator (ALOC)

Identifies a Thread interface via RLOC lookup, when the RLOC of a destination is not known.
  • fcXX = ALOC destination, which looks up the appropriate RLOC
  • Generally not used by applications

Global Unicast Address (GUA)

An EID that identifies a Thread interface on a global scope, beyond a Thread network.
  • SLAAC — Randomly assigned by the device itself
  • DHCP — Assigned by a DHCPv6 server
  • Manual — Assigned by the application layer
  • A public IPv6 address
  • Always has a prefix of 2000::/3


Multicast is used to communicate information to multiple devices at once. In a Thread network, specific addresses are reserved for multicast use with different groups of devices, depending on the scope.

IPv6 Address Scope Delivered to
ff02::1 Link-Local All FTDs and MEDs
ff02::2 Link-Local All FTDs
ff03::1 Mesh-Local All FTDs and MEDs
ff03::2 Mesh-Local All FTDs

You might notice that Sleepy End Devices (SEDs) are not included as a recipient in the multicast table above. Instead, Thread defines link-local and realm-local scope unicast prefix-based IPv6 multicast address used for All Thread Nodes, including SEDs. These multicast addresses vary by Thread network, because it is built on the unicast Mesh-Local prefix (see RFC 3306 for more details on unicast-prefix-based IPv6 multicast addresses).

Arbitrary scopes beyond those already listed are also supported for Thread devices.


Anycast is used to route traffic to a Thread interface when the RLOC of a destination is not known. An Anycast Locator (ALOC) identifies the location of multiple interfaces within a Thread partition. The last 16 bits of an ALOC, called the ALOC16, is in the format of 0xfcXX, which represents the type of ALOC.

For example, an ALOC16 between 0xfc01 and 0xfc0f is reserved for DHCPv6 Agents. If the specific DHCPv6 Agent RLOC is unknown (perhaps because the network topology has changed), a message can be sent to a DHCPv6 Agent ALOC to obtain the RLOC.

Thread defines the following ALOC16 values:

ALOC16 Type
0xfc00 Leader
0xfc010xfc0f DHCPv6 Agent
0xfc100xfc2f Service
0xfc300xfc37 Commissioner
0xfc400xfc4e Neighbor Discovery Agent


What you've learned:

  • A Thread network consists of three scopes: Link-Local, Mesh-Local, and Global
  • A Thread device has multiple unicast IPv6 addresses
    • An RLOC represents a device's location in the Thread network
    • An ML-EID is unique to a Thread device within a partition and should be used by applications
  • Thread uses multicast to forward data to groups of nodes and routers
  • Thread uses anycast when the RLOC of a destination is unknown

To learn more about Thread's IPv6 addressing, see sections 5.2 and 5.3 of the Thread Specification.

Check your understanding

Which three scopes are used for unicast addressing in a Thread network?
What does it mean when a device has a Child ID of 0?
The device is a Child.
The device is a REED.
Close, but incorrect.
The device is a Router.
Correct. A Router always has a Child ID of 0.
A camera, which is a node on a Thread network, receives a new RLOC16 and RLOC. Which of the following events might have caused this?
Someone remotely downloaded images from the camera.
Incorrect. This event would have no bearing on the Thread network.
A router dropped off the network.
Correct. When a router drops off a network, the network topology changes, which may result in the device promoting itself to a router and obtaining a new RLOC.
The camera entered sleep mode, which changed the network topology.
Incorrect. Entering sleep mode wouldn't necessarily cause a device to receive a new network address.
A device on a Thread network subscribes to the ff03::2 multicast address. What does this tell us about the device?
It is a Minimal End Device (MED).
It is a Full End Device (FED).
Incorrect. (Hint: It might or might not be a FED.)
It is a Minimal Thread Device (MTD).
It is a Full Thread Device (FTD).
Correct. Only Full Thread Devices subscribe to the ff03::2 multicast address. They do so in the Mesh-Local scope.
What type of addressing and routing does Thread use to forward data to groups of nodes and routers?
What type of addressing and routing does a Thread device use when the RLOC of its intended message recipient is unknown?
Correct. Anycast allows a device to reach a node whose RLOC is not known, by addressing the device's ALOC.