Pin IPv6 Interface Identifiers with ip token

ip token pins the host part of a server's IPv6 address so a prefix change does not also change the machine's identity. It reads, sets or clears that fixed identifier while the network prefix keeps arriving automatically from Router Advertisements.

The route

Jump straight to the step you need, or tick off Done means at the end.

1. Identify the tool and the right interface
2. Inspect the current token
3. Choose a token deliberately
4. Set the token
5. Remove or replace it safely
Common traps

Allow about 10 minutes. You need the iproute2 package and an interface that supports IPv6.

Reading is safe. Listing or getting a token is normally unprivileged.
Writing is not. Setting or deleting a token changes kernel network state, so use an elevated shell for those and confirm the interface name before pressing Enter.

1. Identify the tool and the right interface

Check the installed iproute2 version and list the interfaces on this host:

ip -V
ip -o link show

On the machine used for these examples, the command reports iproute2-6.1.0. Your interface names will differ. Pick the one that carries IPv6 traffic, such as enp0s31f6, rather than assuming the first interface listed is the right one.

The local manpage describes the command as ip token, not a separate executable, with four operations: list, get, set and del. The bare command with no operation also lists tokens on this installed version, but spelling out list keeps scripts and notes unambiguous.

2. Inspect the current token

Read the token for one known interface without changing anything:

ip token get dev enp0s31f6

Expected output has this shape:

token :: dev enp0s31f6

Tip

The :: value is output, not a placeholder to copy into a config file: it means this interface currently holds the zero token in the running kernel. If a token is already configured, the command prints it followed by dev and the interface name.

To see every interface token at once:

ip token list

The list includes bridges and virtual Ethernet devices whenever the kernel has token entries for them, which is normal. Filter it if you only want one physical interface:

ip token list | grep -F ' dev enp0s31f6'

A missing interface produces an error, not a useful result. Copy the exact name from ip -o link show: Linux interface names are case-sensitive.

3. Choose a token deliberately

The token is the interface identifier, commonly the low 64 bits of an IPv6 address. A full token such as ::1234:5678:90ab:cdef is easy to recognise. Do not paste a complete global address containing a network prefix just because it looks familiar: this command sets the identifier while SLAAC still supplies the prefix from Router Advertisements.

Warning

Do not reuse the same token on two active interfaces on the same network. A predictable token is not an authentication mechanism and does not make an address private. Treat it as a routing and operations choice, never as a secret.

4. Set the token

Apply the chosen token to the intended interface from an elevated shell:

sudo ip token set ::1234:5678:90ab:cdef dev enp0s31f6

Successful ip commands normally print nothing, so verify the kernel value immediately:

ip token get dev enp0s31f6

Expected output:

token ::1234:5678:90ab:cdef dev enp0s31f6

Checkpoint

That output confirms the kernel has the new token. It does not confirm persistence: the manpage describes no persistent network-manager, systemd-networkd or distribution config file for this, so do not assume it survives a reboot or service restart. If persistence matters, add the same command to whatever configuration mechanism owns this interface, then test that mechanism on its own.

5. Remove or replace it safely

Remove the token only when you actually want the interface back to token-free behaviour:

sudo ip token del dev enp0s31f6
ip token get dev enp0s31f6

Warning

Deleting changes kernel state and may alter which IPv6 addresses form after the next Router Advertisement. It is not an undo button for addresses already advertised or already in use by applications. Stop or reconfigure any dependent services before deleting a production token.

Recovery

To undo a mistaken deletion, set the previous value again:

sudo ip token set ::1234:5678:90ab:cdef dev enp0s31f6
ip token get dev enp0s31f6

If you only want a different stable identifier, setting the new value directly is simpler than deleting first. Then check the interface's actual addresses with ip -6 address show dev enp0s31f6: that separate command shows addresses, while ip token get shows the token stored for the device.

Common traps

Wrong device. A valid command can still configure the wrong interface. Compare the device name with its link state and address output before using sudo.
Expecting a full address. The token does not replace the prefix learned from the network. Check Router Advertisements and IPv6 address assignment if no usable global address appears.
Expecting persistence. The command writes running kernel state. Only add it to the interface manager's configuration after confirming which service actually controls the link.
Confusing display with configuration. ip token list reports kernel state; it does not prove a distribution configuration file will recreate that state later.

Done means

Version checked. ip -V identifies the installed iproute2 version.
Token confirmed. ip token get dev INTERFACE shows the intended token.
Addresses verified. ip -6 address show dev INTERFACE shows the resulting IPv6 addresses.
Persistence known. You know whether the setting is temporary or is recreated by your network configuration service.