A link local address works only on the segment a device is plugged into, and no router forwards one. In IPv4 it is 169.254.x.x and appears only when DHCP failed, so it is a symptom. In IPv6 it is fe80 and every interface has one, so it is normal.
- 169.254.x.x means DHCP did not answer. It is a fault report
- fe80::/10 is mandatory on every IPv6 interface
- IPv6 neighbor discovery and router advertisements run over it
- An IPv6 default gateway starting fe80 is correct
- Neither version is routable, in any circumstances
On this page
The IPv4 oneIPv4 link local addresses are a fault report
Windows, macOS and Linux devices that boot, ask for network configuration by DHCP and receive no reply do not simply give up. The device picks an APIPA address from 169.254.0.0/16 at random, checks with ARP that no other device on the segment is using it, and configures itself with that.
What the device gets is very limited. It can talk to other devices on the same segment that did the same thing, and that is the whole list. The configuration has no default gateway, so nothing outside the local network is reachable, and no DNS server, so nothing resolves.
RFC 3927 narrows the choice a little. The device selects from 169.254.1.0 to 169.254.254.255, because the first 256 and last 256 addresses of the 169.254.0.0/16 prefix are reserved. The subnet mask is always 255.255.0.0, and the address is normally dropped once a DHCP server assigns a real one.
Which makes an address in that range a diagnosis rather than a network configuration. Something between the device and the DHCP server did not work, and the candidates are short.
The cable or the port. The link is up enough to try and something is wrong further along. A switch port in the wrong VLAN produces exactly this, because the request goes out into a network with no DHCP server on it.
The DHCP server. Off, out of addresses, or with a scope that does not cover this segment.
The relay. A device on a different segment from the DHCP server needs the router to forward its request, and the configuration that does that is per interface. A new VLAN that nobody configured a relay on gives every device in it an APIPA address.
Wireless authentication. The device associated but never fully joined, so the request was never carried.
The order to check them in is short: is the port in the right VLAN, does the DHCP server have addresses left, and does this segment have a relay configured.
| What you see | What it means |
|---|---|
| One device with an APIPA address | That device, its cable, or its port |
| Every device on one VLAN | The relay, or the scope for that VLAN |
| Every device on the network | The DHCP server itself |
| Wireless devices only | The wireless authentication, not the DHCP server |
That table is most of the diagnosis. How many devices hold a link local address names the layer at fault.
The IPv6 oneIPv6 link local addresses are load bearing
IPv6 uses the same idea for something entirely different, and this is the part people coming from IPv4 addressing misread.
Every IPv6 interface configures a link local address the moment it comes up, before any router has been heard from and regardless of whether DHCPv6 exists anywhere on the network. It is not a fallback. It is the address the interface uses to do the work that gets it a real one.
How an IPv6 link local address is formed
RFC 4291 gives the format: the 10 bit prefix 1111111010, which is fe80::/10, then 54 zero bits, then a 64 bit interface ID. In practice every link local address sits inside fe80::/64, and only the interface ID differs between interfaces on the link.
The interface ID is assigned by the device itself, in one of two ways.
- Modified EUI-64. The 48 bit MAC address is split in half, ff:fe is inserted in the middle, and the seventh bit is flipped. A MAC of 00:1a:2b:3c:4d:5e becomes fe80::21a:2bff:fe3c:4d5e. Routers and older systems do this, which is why ff:fe in the middle of an fe80 address is so common.
- A random or stable opaque value. Current Windows and macOS, and many Linux systems, generate the interface ID instead, so the MAC address is not exposed in every packet.
Before using the address, the interface runs duplicate address detection, which RFC 4862 requires on all unicast addresses. It also stays assigned for as long as the interface is up. On a router the link local address can be set by hand, and fe80::1 is a common choice because it is easy to type as a gateway.
What IPv6 uses link local addresses for
Three things depend on those link local addresses, and all of them are communication between neighbors on the same link.
Neighbor discovery. The IPv6 replacement for ARP runs between link local addresses. Finding the MAC address behind an IPv6 address happens here.
Router advertisements. Routers announce themselves from their link local addresses, and devices learn their prefix and their default gateway from those announcements. So the default gateway in an IPv6 configuration is normally a link local address, which surprises people the first time they see it.
Routing protocols. OSPFv3 and BGP for IPv6 form neighbor relationships using link local addresses, which means the adjacency survives renumbering the global addresses on the network.
The practical consequence: a device holding only an fe80 address and nothing else is in the same position as an IPv4 device holding only an APIPA address, but a device holding fe80 and a global address is completely normal. Seeing fe80 in a list of addresses is not a finding.
CheckingSeeing them, on each platform
Every operating system shows both kinds in its ordinary address listing, and the commands are worth having to hand because this is usually diagnosed on somebody else's machine.
ipconfig /all Windows, and read the Autoconfiguration lines
ip addr show Linux, both versions in one listing
ifconfig macOS, or ipconfig getifaddr en0 for one answerWhat to read in the output is different for each version.
On Windows, look for the word Autoconfiguration. An address labeled Autoconfiguration IPv4 Address in the 169.254 range is the fault report. Windows also shows a Link-local IPv6 Address starting fe80, and that line is present on a healthy machine, so the two lines mean opposite things in the same block of output.
On Linux, ip addr lists every address on the interface. A healthy dual stack interface shows a global IPv4 address, an fe80 address with scope link, and usually a global IPv6 address. An interface showing only inet 169.254.x.x and inet6 fe80::... has the IPv4 fault and normal IPv6 link local at the same time.
Renewing is the fastest confirmation. ipconfig /release then ipconfig /renew on Windows, or dhclient -r then dhclient on Linux, and watch what comes back. A device that immediately returns to 169.254 has confirmed that no DHCP server answered, which turns a guess into a finding in about ten seconds.
A whole VLANWhat to do when a whole VLAN has them
One device with an APIPA address is a device problem. Every device on a segment holding one is a network problem, and it has a short list of causes worth walking in order.
Check the DHCP scope for that subnet exists and has addresses free. A scope that exhausted its pool produces exactly this, and it looks like a failure rather than a full pool from the client side.
Check the relay on the router interface for that VLAN. The setting is per interface, usually called an IP helper address, and a VLAN created without one has no path to a DHCP server on another segment. This is the single most common cause on a network where somebody recently added a VLAN.
Check that the switch ports are in the VLAN you think they are. A port left in the default VLAN sends its request into a segment with no DHCP server on it.
Check whether the DHCP server is answering other segments. If it is, the problem is between this VLAN and the server rather than with the server itself, which narrows it to the relay or the scope.
The pattern behind all four: an APIPA address means the request went out and nothing came back, so every candidate is somewhere on the path the request took.
Scope identifiersThe percent sign nobody explains
One detail about IPv6 link local addresses trips people up the first time and then never again.
An IPv6 link local address is only meaningful on one link, and a device with several interfaces can have the same link local address reachable through more than one of them. So the address alone is ambiguous, and tools require a scope identifier to say which interface you mean.
ping fe80::1%eth0 Linux, naming the interface
ping fe80::1%12 Windows, naming the interface index
ping6 fe80::1%en0 macOSLeaving the scope off produces an error about an invalid argument or an unreachable host, which reads like the address is wrong when the address is fine.
PitfallsWhere people go wrong
Treating an APIPA address as something to fix. It is not the problem, it is the report. Static network configuration makes the symptom disappear and leaves DHCP broken for every other device on that segment.
Assuming an APIPA address means no link. The link is up. Something between the device and the DHCP server is the issue, and a completely dead port produces no addresses at all rather than this one.
Reading fe80 as a failure. IPv6 link local addresses are normal and required. The finding is an interface with fe80 and no global address, not the presence of fe80.
Being surprised by a link local default gateway. On IPv6 that is the usual arrangement, because the router advertises itself from its link local address. A gateway of fe80 something is correct.
Forgetting the scope identifier. An IPv6 link local address without %interface is ambiguous on a device with more than one, and the error message does not say so.
Trying to route either of them. Neither kind is forwarded by any router on the network or across the internet. Link local addresses reach the segment they are on and nothing beyond it.
Configuring a static APIPA address deliberately. It works for two devices on a bench and it is not an addressing scheme. Use a private range for any network configuration that is meant to last.
ComparisonIdentical mechanism, opposite meaning
| Criterion | IPv4 link local | IPv6 link local |
|---|---|---|
| Range | 169.254.0.0/16 | fe80::/10 |
| When it appears | Only when DHCP fails | On every interface, always |
| Coexists with a real address | No | Yes, normally |
| Routable | No | No |
| Used by the protocol itself | No | Yes, extensively |
| Seeing one is | A fault | Normal |
| Needs a scope identifier | No | Yes, on a multi interface host |
The second and sixth rows are the whole page. Identical mechanism, opposite meaning, and reading one kind of link local address as the other is how an IPv6 network gets declared broken when it is working.
FAQFrequently asked questions
What is a link local address?
An address valid only on the network segment a device is attached to. No router forwards one, so it reaches devices on the same link and nothing else.
What does a 169.254 address mean?
That the device asked for network configuration by DHCP and got no answer, so it assigned itself an APIPA address. It is a fault report, and the fault is between the device and the DHCP server.
What is APIPA?
Automatic private IP addressing, the name for the IPv4 behavior of self assigning a 169.254 address when DHCP does not answer.
How do I fix an APIPA address?
By fixing DHCP rather than the address. Check the switch port VLAN, whether the scope has addresses left, and whether that network segment has a DHCP relay configured.
Can a 169.254 address reach the internet?
No. There is no default gateway and no DNS, so it reaches other machines on the same segment that are in the same state, and nothing else.
What is an fe80 address?
An IPv6 link local address. Every IPv6 interface has one automatically, and the protocol uses them for neighbor discovery, router advertisements and routing protocol adjacencies.
Is an fe80 address a problem?
No. It is mandatory and normal. An interface with fe80 and no global address is a problem; the presence of fe80 alongside a global address is how IPv6 is meant to look.
Why is my IPv6 default gateway an fe80 address?
Because the router advertises itself from its link local address, which is the standard arrangement. A gateway starting fe80 is correct rather than misconfigured.
What is the percent sign in an IPv6 address?
The scope identifier, naming which interface the link local address applies to. The same address can exist on several interfaces, so tools require it.
Are link local addresses routable?
No, in either version. Routers do not forward packets with a link local source or destination address, which is what makes them local to the link.
Do all devices get both kinds?
Every IPv6 interface gets an fe80 address. An IPv4 interface gets an APIPA address only when DHCP fails to answer.
Can I use 169.254 addresses deliberately?
For two machines on a bench with a cable between them, yes. As an addressing scheme for anything that has to keep working, no. Use one of the private ranges.
Why do two devices with APIPA addresses see each other?
Because they are on the same network segment and both picked addresses from the same range. That is the one thing the mechanism is designed to allow.
Does a 169.254 address mean a DHCP failure?
On IPv4, yes. A computer assigns itself a 169.254.x.x link-local address when it asks for a lease and no DHCP server answers. The DHCP failure may be a stopped service, an exhausted address pool, a wrong VLAN, or a bad cable. The device can then reach only neighbors on the same segment.
Keep readingRelated concepts
Read next · Addressing What Is DHCP? A 169.254 address is what a device does when this did not answer, so the diagnosis starts here. Open this next9 min- Addressing · 10 min Default Gateway On IPv6 the default gateway is normally a link local address, which is correct rather than a misconfiguration.
- Fundamentals · 13 min ARP Explained, and the One Thing Everyone Gets Wrong About It IPv6 replaces ARP with neighbor discovery, which runs entirely between link local addresses.
- Diagnostics · 13 min ipconfig and ip, and What the Output Is Telling You The commands that show this address, and the part of them worth writing down rather than looking up.
- Wireless · 9 min A WLAN Is a LAN With a Radio in Front of It A wireless network is where this shows up most, and the four steps there say which one failed.