Yeah, automatic host discovery puts the MAC address (almost) verbatim at the end of an interface IP, but it's an optional feature. In the vuln report, it turns

Yeah, automatic host discovery puts the MAC address (almost) verbatim at the end of an interface IP, but it's an optional feature. In the vuln report, it turns out automatic host discovery is used after all, but the IPv4 is also based on this, which confused me. The MAC address was: 42:01:0a:80:00:02 The IPv6 address was: fe80::4001:aff:fe80:2 It's not just the last four bytes, it's the whole MAC address, but 0xFFFE is crammed in the middle of the MAC address, and the first byte's second to last bit is flipped. We can see that this is exacly the scheme that was used. Now the confusing part is that the IPv4 address is apparently also the MAC address: MAC 42:01:0a: 80:00:02 IPv6 fe80::40 01:0a ff:fe 80:00 02 ^ ^^ ^^ flipped bit inserted IPv4(hex) 0a. 80. 0. 2 (dec) 10. 128. 0. 2 Now the confusing part is that the IPv4 address is apparently also based on the MAC address, which means the IPv4, and MAC addresses can both be derived from the IPv6 address, and the IPv4 address can be derived from the MAC address. (The entire host section of the IPv6 address is based on the MAC iirc, so the network section is the only part you need to guess there.)