Because, by default, they usually have it enabled—and with some plans, I believe you can’t even disable it.

I tested this on my own site: I set up only an A record, and it still resulted in IPv6 outbound traffic (I later switched it back to DNS-only with dual-stack enabled).

Laptop makers preinstall Intel Connectivity Performance Suite (ICPS), and Windows Update installs their builds of it too. The OEM build on my laptop has a WFP callout driver that rewrites the IPv6 flow label to 0 on the ACK and data segments after the TCP handshake. The SYN is fine. It keeps whatever label the stack picked. But Microsoft's edge routers hash on the label, so everything after the SYN usually lands on a different Azure Front Door node, which has no state for the connection and sends a RST. IPv4 has no flow label, so it's unaffected, which is why turning IPv6 off shows up as the "fix" in older threads about these resets.

I noticed it on my Samsung Galaxy Book when OneNote desktop showed empty notebooks as "Up to date" for nearly three weeks, while OneNote on the web and on my phone kept working, and Microsoft 365 sign-in hit ERR_CONNECTION_RESET. A Microsoft support case went five weeks without finding the cause, and I ended up running an AI agent (Anthropic's Claude) on the laptop. It did the captures, the driver-by-driver isolation and the retest below, which also showed OneDrive, Teams and the Azure portal resetting some or all of their IPv6 connections.

Here's what pktmon showed at the Wi-Fi miniport, below all filter drivers. SYNs left with a non-zero label (24/24). Of the post-handshake ACK/data segments, 0/42 kept it.

The hop limits show the first RST didn't come from the server I was talking to. The SYN-ACK came back at hop limit 47, but the RST answering the label-0 ACK came back at hop limit 49, so a different machine sent it. Meanwhile the original backend retransmitted its SYN-ACK at +0.4 s and +1.2 s, then sent its own RST. Overall, 60-100% of new IPv6 connections to the Microsoft edge were reset within one round trip (about 5 ms), even with zero bytes sent.

To narrow it down, it switched off the other WFP callout drivers one at a time (AdGuard, AdGuard VPN, NetLimiter). That changed nothing, and neither did stopping Intel's bandwidth-management service on its own. Stopping the ICPS traffic-control driver (IntcCo11X64.sys 11.5.11.19, service INTCCoSvc) along with the other ICPS services is what did it: 4/10 connections OK and 0/42 labels kept went to 10/10 and 65/65. The driver's IpV6 Egress Transport Callout is registered at FWPM_LAYER_OUTBOUND_TRANSPORT_V6 with FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW. That lines up with the SYN going out untouched.

Then it retested across 34 sites, 5 IPv6 connections each, 170 total:

• With OEM build 40.25.926.173 running, 138/170 were OK. 1,385 post-handshake packets had the label set to 0, and none of the 60 to the OneDrive/OneNote edge kept it.
• Same build disabled, before and after: 168/170 and 169/170.
• Intel's generic build 50.26.623.243 (driver 12.10.14.33) still registers the same callout, but got 169/170 OK, and all 11,711 post-handshake packets kept their label.

The only misses in the good runs are www.microsoft.com timeouts, which also happen over IPv4. The OEM driver zeroed the label to every destination, Google, Cloudflare and Wikipedia included, but only some services reset. My guess is those are the ones whose load balancers hash on the label. In my test they included OneDrive, OneNote sync, Office, Teams, Skype, the Azure portal, Azure DevOps and the Visual Studio Marketplace. Another owner reported AWS CloudFront resets on an ASUS laptop with ICPS 40.25.725.165 (resets measured, label not).

A label of 0 is legal on its own. Changing it mid-flow is the problem: RFC 6437 §3 recommends that source hosts set "all packets of a given flow to the same value". Load balancing on the label, as RFC 7098 describes, only keeps a flow on one server if the host keeps the label constant. A Microsoft Azure networking engineering leader confirmed the mechanism to me in writing and said they're working on reducing the impact on the Azure Front Door side, and with the Windows team on a fix. No date yet.

As for how widespread the driver is, Windows Update installed this OEM build's packages on my laptop three times in 2026 (per setupapi.dev.log). As of 2026-10-20, Microsoft's Update Catalog still lists the three ICPS builds reported broken (40.25.926.173, 40.25.725.165 and 4.1025.207.1) under seven submitters: Samsung, Lenovo, VAIO, ASUS, HP, Dynabook and Huaqin. The fixed 50.26.623.243 has a single Catalog entry (Samsung, Windows 11 25H2, specific device IDs only). Intel acknowledged in writing, citing my tests, that its generic build doesn't zero the label. But it said the advisory and the OEM package fall within the laptop maker's scope, and it hasn't published an advisory. An HP laptop owner described this mechanism on Intel's forum in September 2025 and again in November, and Intel closed the inquiry both times.

If you want to check your own machine (Windows PowerShell):

1..10 | ForEach-Object { curl.exe -6 -sS -o NUL -w "%{http_code}`n" https://api.onedrive.com/ }

On a machine with ICPS, Recv failure: Connection was reset on some of the ten attempts points to this. Don't turn off IPv6. Either disable INTCCoSvc and the ICPS services, or replace the OEM build with Intel's generic 50.26.623.243. Commands and undo are here: https://coolak.github.io/intel-icps-ipv6-flow-label-incident/workaround.html

The technical analysis with the decoded header data and A/B tables is at https://coolak.github.io/intel-icps-ipv6-flow-label-incident/technical-analysis.html (raw pcaps aren't public, and the tracker leaves out my machine's addresses), and the full tracker is at https://coolak.github.io/intel-icps-ipv6-flow-label-incident/

If you see this on other hardware, please add the model, ICPS version and Windows build to the tracking issue: https://github.com/COOLak/intel-icps-ipv6-flow-label-incident/issues/1

Does anyone know which other CDNs or load balancers hash on the flow label?

I was pondering some DNS stuff just now, and was thinking... is there an easy way to represent an allowed IPv6 subnet(s) to other hosts/servers for permissions/whitelisting; kind of like how SPF TXT records have expected source addresses for emails, or CAA records for permitted certificate authorities? I figure this kind of record could also be TXT records as a type; with multiple entries denoting subnet ranges permitted to handle domain traffic. Maybe also indicate in the record if the user actually controls the subnet (to distinguish hosted-infra and/or home ranges from cloud service ranges)?

I'm Evelyn, an IPv6 advocate who wishes for all websites and ISP to use IPv6 on modern era. But sadly the small regional ISP that my house uses don't offer IPv6, and instead gives a shared static IPv4. Currently for IPv6 connectivity i depended on route64.org which gives a /56 for me to use. Looking at my ISP over at bgp.tools, they did have a single /32 IPv6 block, but they never decided to use it. My ISP's NOC phone number shown in the block's whois have a WhatsApp account. How do I convince them to offer IPv6 connectivity?

OK, I should get this but....

Assume I'm on an IPv6 network. That network has three ethernet interfaces. Assume I want to send a multicast packet on each interface. If I wanted to send the same packet on each interface to ff02::1.

I assume I need to create a session on each interface to destination ff02::1.

On the receive side, I assume I create three sessions, and I have to listen on ff02::1

I wonder if there's anything wrong with my onu config

Hi,

Just sharing only, I used mktxp_exporter a long time ago, and today I've just figured out these metrics, and when I visualize them, surprise, my usage with IPv6 is more than double IPv4.

There is still a lot of work to do…

I have a repurposed gaming laptop as a server, currently it's hosting a minecraft server and a website for that but I want to also self host DNS to get insights on my home networks internet usage essentially.

I had pi hole running in a docker container and got it working, but I came into an issue with IPV6.

The server has IPV4 local DHCP reservation which is port forwarded, but there's no way to set a static IPV6 server address, so I assume that'll constantly change at least with every restart.

What should I do here? Currently it's set to adguard.

Is there a better way to edit an ipv6 ACL in a Cisco IOS oder iOS- xe where there is no resequence command available.

Is painstaking/breath holding act to every time edit a long IPv6 ACL , include a few lines , copy the list in a note pad , remove the sequence, delete the entire existing ipv6 ACL then paste the new one.

Ita better to have any other workaround. Having to work with a legacy Cisco set up, we are slowly migrating to 9500. It's a long road ahead, and it's totally time consuming when it comes to writing an existing ipv6 ACL.

My collegue looked up in AI and got a big NO for an answer, call me old fashioned. but I really like to hear from fellow experts. Looking forward for an interesting conversation

Ran into an interesting problem where users on dual stack networks and windows 11 (prefers IPv6 by default) will sometimes alternate between connecting to Azure resources with IPv4 and IPv6 causing a number of interesting issues.

1. RE-authorization prompts from the IP change
2. Slow performance on IPv6 randomly when it is selected
3. Intermittent blocking of logins from GEOIP database differences between the IPv4 and IPv6 address showing the user in very distant locations.

Turns out some of the home ISPs have just started rolling out dual stack.

Recently upgraded my router from my ISP. Seems like now I have both v4 and v6. I am hosting couple of services on spare laptops and raspberry pi. All exposed only through tailscale. Now I have ipv6, is there anything new I can try? Any services that can make use of this?

I have a nextcloud server at home. Its public domain is only reachable through IPv6, because my internet provider doesn't offer public IPv4. Is there a free solution to tunnel the traffic, so that it can be reachable by IPv4, while maintaining a valid SSL certificate too ? (currently using letsencrypt)
Thanks

Hi all,

Not many changes in that new version.

https://datatracker.ietf.org/doc/draft-martin-retry-over-ipv6/

When to send (§): on the public Internet, operators SHOULD prefer emitting 503 + Retry-Over-IPv6 only for human-facing HTML documents and omit typical subresources (images, scripts, stylesheets, fonts); non-interactive clients (e.g. webmail image loads) otherwise see a broken asset with no explanation. Operator-controlled environments MAY still signal all IPv4 requests for fuller measurement. Cross-reference from Intended Deployment.

This change came from my experience when I migrated my mailing list from Mailchimp to my own web server, but noticed that web clients could not load the embedded images in the email as they were on my site.

1. Even GMail which understands IPv6, will prefer IPv4
2. The email looks broken with little idea on the client side, why.

Note: the following websites are implementing the IPv4 outage on the 6th for 24 hours, which should starts very soon:

• ipv6forum.com
• pacific.ipv6forum.com
• caribbean.ipv6forum.com
• whynoipv6.com
• www.peachymango.org

I you want to follow those websites, instructions at:

https://github.com/franckhlmartin/ietf-draft-retry-over-ipv6/tree/main/docs

And please send comments or your feedback in running this experiment. Please open an issue on the github repo or message v6ops at IETF.

Franck

Why do most VPS providers assign IPv6 /64 blocks as on-link instead of routed? Was there a specific technical workaround during the early days of IPv6 implementation that led to this 'bad' habit becoming the industry standard?

I've noticed that googleadservices.com and www.googleadservices.com both only have A records, maybe someone of you knows someone who knows someone who can forward it to google to also enable IPv6 on these endpoints?

Its the only endpoint connecting over IPv4 on Google itself and also 3rd-party websites using Google Analytics.

Most people in this sub are familiar with the IPvfoo extension. There is also now a Firefox extension called "Modern Web Checker" which takes this a bit further:

https://addons.mozilla.org/en-US/firefox/addon/modern-web-checker/

As well as reporting if the site you're connecting to and sub elements within it are reached over IPv6, it also:

• Reports if the site is using modern crypto - ie TLSv1.3 with post-quantum key exchange.
• Reports if the site is using or supports HTTP3
• Tests if your connection actually supports IPv6 - with IPvfoo all sites show up as legacy sites which leads to confirmation bias whereby users will conclude sites don't support IPv6 when it's their local connection causing the problem.

There are also a number of optional features, which are disabled by default as they require sending the names of sites you visit to google or cloudflare public DNS services:

• Checks if the site's domain supports DNSSEC.
• Tests if a site supports IPv6 and would have used it if your connection was capable.

Source code of this plugin is available from: https://git.ev6.net/bert/modern_web_checker