TL;DR: Many networks speak both IPv4 and IPv6. A site may see one family today and the other tomorrow depending on DNS, Happy Eyeballs, or which stack the path prefers. Read the badge on your public IP lookup instead of assuming the dotted quad is the only address you own.
Two answers to “what’s my IP?”
A developer enabled IPv6 on a home lab and suddenly a monitoring agent started alerting on “IP change” every few hours. Nothing was flapping. The agent sometimes recorded the IPv4 WAN address and sometimes the IPv6 global address, then compared them as if they were the same field. The connection was healthy; the comparison was not.
Dual-stack life means your laptop can hold a private IPv4 lease, a global IPv6 prefix, and still reach legacy services that only publish A records. Each family is a valid identity toward different destinations. Collapsing them into one string in a spreadsheet is how false incidents get opened on quiet weekends.
How the families differ in shape
IPv4 is four decimal octets, like 203.0.113.45. IPv6 is eight hexadecimal groups that can compress long zero runs, so the same address can be written in more than one textual form. Tools that store “the IP” as a single string without a family flag will confuse those forms forever.
- IPv4-only path: common on older office Wi‑Fi and some travel routers.
- IPv6-only or IPv6-preferred: increasingly common on mobile and modern ISPs.
- Dual stack: both available; clients choose per destination.
Documentation examples often show IPv4 because it fits on a slide. Production traffic may prefer IPv6 when both exist. A firewall rule that whitelists only the dotted quad leaves IPv6 traffic either blocked or unexpectedly allowed, depending on default deny settings.
Why the same laptop shows different families
Browsers race connections. A CDN endpoint with A and AAAA records may win on IPv6 one minute and IPv4 the next. VPN apps often force one family. Captive portals may interrupt IPv6 until you accept terms. None of that means your ISP “gave you a new identity” in the human sense—it means the packet that reached a particular server used a particular source address.
Some home routers delegate a /64 or larger prefix on IPv6 while still NATing IPv4. Your phone might show a stable-looking IPv6 that changes when you roam cell towers, while IPv4 stays behind CGNAT. Monitoring both separately clarifies which path a given app used when logs look inconsistent.
Logging tips that save false alerts
Store address and family together. Prefer canonical IPv6 form if you compare strings. When a vendor allowlists only IPv4, say so in the ticket and capture an IPv4-looking result from the lookup while you are on the path you will use for that vendor. Do not paste an IPv6 string into a form that only accepts dotted decimal.
If your SIEM deduplicates “users” by IP alone, merge keys like 203.0.113.45|v4 and 2001:db8::1|v6 instead of treating a dual-stack session as two people switching identities every hour.
Allowlists and APIs in a mixed world
Partner APIs that rate-limit by source address may see IPv6 on a Tuesday and IPv4 on a Wednesday for the same employee. Rate limits then feel “random.” Ask vendors whether they honor both families, whether they normalize IPv6, and whether corporate NAT64 alters the source you think you are presenting.
Internal runbooks should say “capture whichever family the failing service logs.” If the service log shows IPv6, whitelisting IPv4 fixes nothing. Reload the lookup after toggling VPN or Wi‑Fi and note both lines if both appear—some pages show IPv4 prominently with IPv6 below, or the reverse.
Practical habit for mixed networks
After you change VPN, Wi‑Fi, or USB tethering, reload the lookup once and note which family appears. If you also care about city-level hints, open What Is My Location on the same network—geolocation databases sometimes have richer data for one family than the other. Teach teammates that “my IP changed” might mean “the stack I used changed,” not that DHCP reassigned the world overnight.
IPv4 exhaustion pushed the industry toward larger namespaces; dual stack is the transition, not a bug. Treat each family as a first-class field in tickets, dashboards, and access policies until your stack proves it can safely collapse them.
Home users rarely need to configure either family manually. The payoff for understanding both is fewer mystifying lockouts: when a game server bans “your IP,” ask whether its logs show v4 or v6, then match that family on the lookup before you power-cycle hardware that was never the problem.
Enterprise change windows sometimes disable IPv6 temporarily during upgrades. If your monitoring only tracked IPv6, everything looks down while IPv4 still carries production. Dual awareness keeps those maintenance stories short.
When in doubt, screenshot both lines from the lookup and attach them to the ticket. Future maintainers will know whether the service ever saw v6 at all, instead of guessing from a single dotted quad copied months ago.
