Research described by Maynard Koch on the APNIC Blog on 11 June 2026 explores the discovery of IPv6 router addresses using Subnet-Router Anycast behaviour. The work demonstrates why the size of the IPv6 address space should not be treated as assurance that network devices will remain undiscovered.
For operators, the useful response is a review of exposure and responsibility. An interface should be reachable because the design requires it, with appropriate controls, rather than because nobody expected its address to be found.
Review both sides of a dual-stack service
Our suggested starting point is a service inventory that includes both IPv4 and IPv6. For each externally reachable service, record its owner, its intended audience and the controls that apply. Then establish whether those controls are equivalent in purpose across both protocols.
Equivalent purpose does not mean copying every rule mechanically. IPv6 has its own operating requirements. The review should be performed by people who understand the protocol and can distinguish traffic necessary for correct operation from access that the service does not require.
Give the management plane its own boundary
A customer-facing service and an administrative interface have different audiences. Treating them as one exposure decision can leave management access broader than intended.
We would ask teams to document how operators reach routers and hosts, how that access is authenticated and which network paths are permitted. Changes to addressing, routing or deployment automation should trigger a check that the intended boundary still holds. Authorised validation of the actual environment is more useful than relying on a diagram that has not been updated.
Make visibility an operating requirement
Inventory and policy need to be supported by observations. Monitoring should identify which protocol carried the connection, where the traffic arrived and which service or device was involved. Incident responders need that information without first reconstructing the addressing plan.
The practical lesson is to design controls for discoverable systems: know what is reachable, justify that reachability and make the responsible team visible.