RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses

2026-06-13

RFC: RFC 3927

Published: 2005

Authors: Stuart Cheshire, Bernard Aboba, Erik Guttman

If you've ever unplugged a router and watched your laptop end up with a weird 169.254.x.x address, you've met RFC 3927. It is the protocol behind IPv4 Link-Local Addressing — the quiet fallback that lets two devices on the same wire still talk to each other when no DHCP server answers and no static config is set.

The problem. The Internet model assumes some authority — a DHCP server, a sysadmin, a router advertisement — hands you an address. But the most basic networking scenario is two devices connected with a cable: a laptop and a printer, two embedded boards on a bench, a camera plugged into a sensor. There's no DHCP server. Static configuration is hostile to non-experts. Without an address, even IP-aware peers can't bootstrap. Apple, Microsoft, and Sun all wanted plug-and-play printing and file sharing. They needed a way for hosts to self-assign a usable IPv4 address without colliding with neighbors.

The design. IANA reserved 169.254.0.0/16 for link-local use, with 169.254.0.0/24 and 169.254.255.0/24 held back for future allocation. A host picks a pseudo-random address from the remaining 65,024 candidates, seeding the PRNG with its MAC so the choice is stable across reboots. Then it does the clever part: it sends ARP Probes — ARP requests with a zero sender IP — asking "does anyone own this address?" If nothing replies after a few probes, it sends gratuitous ARP Announcements to claim it. If a reply arrives, it picks another candidate. If conflicts happen too often, exponential backoff kicks in to stop ARP storms.

Critical rules that prevent link-local from poisoning the wider Internet:

Backstory. Microsoft shipped this idea as APIPA (Automatic Private IP Addressing) in Windows 98 — years before the RFC. Apple's Rendezvous, later renamed Bonjour, built the same mechanism into Mac OS X as part of Zeroconf. The IETF Zeroconf working group spent five contentious years standardizing what vendors had already deployed; arguments over the address range, conflict resolution timing, and whether IPv4 even deserved this treatment (IPv6 has link-local baked in via fe80::/10) dragged the document out. Stuart Cheshire — also the father of mDNS and DNS-SD — pushed it through.

Why you still see it. Modern industrial Ethernet (EtherNet/IP, PROFINET), CarPlay over USB-Ethernet, point-to-point camera links, USB gadget networking on Raspberry Pis, and printer auto-discovery all lean on link-local. When Kubernetes started exposing cloud metadata at 169.254.169.254, it was borrowing the "we promise this won't be routed" guarantee that RFC 3927 codified. That single magic address is now the target of countless SSRF advisories — a reminder that "link-local means link-local" is a security property, not just a routing convention.

Why it matters: RFC 3927 turns "no DHCP, no config" from a dead end into a working network, and its non-routable guarantee is the foundation cloud metadata services quietly stand on.

All newsletters