Windows 10: Temporary IPv6 Address Creation and logging

I have seen wide differences in the way some hosts create their temporary IPv6 addresses. Some only have a few, while some have hundreds. This leads me to trying to find the answers to several questions, which so far have eluded me. I am aware that this feature can be disabled, and that is the only responses I seem to be able to find, but I want to understand the process behind their creation.

1. Specifically what triggers the creation of a new Temporary address.
   1. Is this something that is controlled at the OS level, or do applications have a say on when a new address is created.
   2. Why do some hosts create a new one every few seconds, and have hundreds active, while some have only one or two.
2. What triggers the deletion of an old address, with the same sub questions as 1?
3. How do I log the fact that a new address has been created, for later auditing, and what triggered it? If I have hundreds of hosts, on my network, I need to be able to retrospectively ascertain who was the source of malicious traffic.
4. How can I identify which processes is responsible for creating the hundreds of addresses?
5. How do the parameters below affect address generation and deletion
   1. C:\WINDOWS\system32>netsh interface ipv6 show privacy
      Querying active state...
      
      Temporary Address Parameters
      ---------------------------------------------
      Use Temporary Addresses : enabled
      Duplicate Address Detection Attempts: 3
      Maximum Valid Lifetime : 7d
      Maximum Preferred Lifetime : 1d
      Regenerate Time : 5s
      Maximum Random Time : 10m
      Random Time : 1m57s
6. If I enter the command netsh interface ipv6 show addresses I get a long list of addresses with the samevalid life and pref life. Why?

A lot of questions, Sorry about that, but I am hoping if anyone can answer them, it can help many people understand this strange behaviour, that seems to plague many people.


Kind Regards

:)

 

Temporary IPv6 address not used for outbound connections?

With the latest WP8 version 8.0.10211.204 IPv6 is finally working for me. According to Neighbor Advertisements sent by the phone two addresses are configured using SLAAC. A permanent one that remains the same after e.g. rebooting and using Privacy Extensions
a temporary one that changes quite frequently.



Other than e.g. Desktop-Windows WP8 is using the permanent address for outbound traffic rather than the temporary one. This contradicts the whole idea of the Privacy Extensions. Especially for a mobile device using the PE really make sense to make tracking
more difficult.



Can anyone confirm my observations? Is there any way to modify that behavior?

 

Temporary IPv6 address not used for outbound connections?

Has there been any progress on this subject?

My ISP has recently activated IPv6, and I have the same problem with my WP8.1

My Lumia 640 advertises it has multiple addresses configured, but for outbound connections it uses the address derived from the MAC address.

 

PC is logging in to temporary profile

Hi Shayna,



Thank you for writing to Microsoft Community Forums.



I understand that you are facing issues with temporary profile on your PC, and I certainly appreciate your efforts in trying to resolve the issue by performing troubleshooting steps.



I would suggest you to refer the
suggestions provided by me replied on May 24, 2019 and see if that helps.



If the issue persists, please get back to us with the details of the troubleshooting steps to assist you further.



Regards,

Prakhar Khare

Microsoft Community – Moderator