Two address families
IPv4 uses shorter addresses and widespread address sharing. IPv6 provides a much larger address space and often direct addressing for interfaces.
Neither protocol is automatically private or unsafe.
IPv6 is not inherently a leak
The relevant question is whether traffic bypasses the route or policy you intended, not whether IPv6 exists.
A working IPv6 connection should not be penalized merely for being available.
Temporary addresses help
Many systems use privacy extensions that rotate interface identifiers and reduce long-term address stability.
Provider prefixes and other signals can still provide network context.
Dual-stack choices vary
Browsers and operating systems choose between available paths based on reachability and performance.
A normal dual-stack hostname does not guarantee which family a request will use.
Forced probes provide clearer evidence
Separate IPv4-only and IPv6-only hosts can show whether each family reaches the internet through the expected route.
Those probes require independent infrastructure and remain inconclusive until the service is deployed and verified.
Absent IPv6 is not protected IPv6
| Known condition (illustrative) | What can be said | Still missing |
|---|---|---|
| This request arrived over IPv4 | IPv4 observed for one request | IPv6 reachability and route |
| An IPv6-only probe is not configured | Not measured | Separate infrastructure acceptance |
| A known IPv6 endpoint times out | Probe failed or path blocked | Cause; a timeout is not protection |
| A known IPv6 probe succeeds in an authorized environment | IPv6 observed for that probe | Whether its visible route matches the intended policy |
The last two rows describe test-design expectations, not probes run by this release. The current tool reports the family of its one request; it does not issue family-forced probes.