IPv4 to IPv6 Transition

IPv4 and IPv6 Coexistence

IANA's pool of unallocated IPv4 addresses has been exhausted, but assigned IPv4 addresses remain in use. IPv6 offers a 128-bit address space, yet it cannot replace IPv4 through a single switch. The main obstacle is that IPv4 and IPv6 are not directly compatible.

A device that supports only IPv4 cannot process an IPv6 packet, and an IPv6-only device cannot process an IPv4 packet. The headers, addressing schemes, and some protocol functions differ. A simultaneous change would require replacing protocol stacks, addressing, routing, and IPv4-dependent services across the Internet. Transition mechanisms keep those dependencies operational while individual segments change.

The Internet is therefore in a long, gradual transition in which IPv4 and IPv6 coexist. Network engineers must provide communication between IPv6-ready devices, networks, and services and components that remain IPv4-only. Three primary categories of transition mechanisms address this coexistence: parallel stacks at endpoints, tunnels between routers, and translation at a boundary between versions.

1. Dual Stack

One coexistence method is Dual Stack, in which a host or router supports IPv4 and IPv6 at the same time. Each stack has its own addressing and routing, while the application selects an address family according to system configuration.

A dual-stack device (such as a modern computer, smartphone, or router) implements both protocol stacks. It has an IPv4 address and one or more IPv6 addresses on its network interface, allowing native communication with both types of network. The IPv4 address may be private behind NAT, while IPv6 may include link-local and global addresses. The two stacks maintain separate routing tables and firewall rules.

How Dual Stack Works

1. Application Request: Your web browser wants to connect to www.example.com.
2. DNS Query: The operating system sends a query to a DNS server to resolve this name to an IP address. A dual-stack device asks for both types of records:
   • An A record for the IPv4 address.
   • A AAAA record for the IPv6 address.
3. Address Selection: The DNS server responds with both addresses if the destination server is also dual-stack. An A record supplies IPv4, while an AAAA record supplies IPv6. The default policy can give IPv6 higher precedence, but the result depends on available addresses and configuration. Happy Eyeballs can race IPv6 and IPv4 and use the connection that succeeds first. If only an A record is returned, the device uses IPv4.
4. Native Communication: The source and destination use the same IP version, so the connection uses the selected protocol without translation or encapsulation.

2. Tunneling through IPv4

If an IPv6-capable device reaches an IPv4-only part of its provider's network, an IPv6 packet can cross that section through a tunnel. The router at the tunnel entrance encapsulates the IPv6 packet in IPv4, and the router at the exit removes the carrier header. Both tunnel endpoints must know their termination addresses, and the extra header reduces the effective MTU for the IPv6 packet.

Tunneling places the entire IPv6 packet as the payload of an IPv4 packet. The carrier packet crosses the IPv4 network; at the tunnel exit, a router removes the IPv4 header, retrieves the IPv6 packet, and forwards it. The tunnel endpoints must agree on encapsulation and reachability, and the additional header can require smaller transport segments.

Tunnel Types

Tunneling mechanisms can be grouped into two categories:

• Manual Tunnels (Static): An administrator manually configures a persistent point-to-point link between two specific routers over an IPv4 network. The behavior is predictable, but each link requires configuration.
• Automatic Tunnels: These mechanisms can be created dynamically as needed. Examples include:
  • 6to4: A historical tunneling technique that embeds IPv4 address information in an IPv6 address and automatically creates tunnels between sites. Its anycast relay prefix has been deprecated, and deployment requires an assessment of its operational limitations.
  • Teredo: A historical technique for tunneling IPv6 through IPv4 NAT devices when other tunneling methods could not pass the NAT. It is not a general recommendation for new deployments.

3. IPv4 and IPv6 Translation

When a client supports only IPv6 and a server only IPv4, Dual Stack cannot provide a common stack at both endpoints. The server does not process an encapsulated IPv6 packet, so this case requires translation at the network boundary.

Translation is implemented by a gateway, commonly using stateful NAT64, at the boundary between an IPv6 network and the IPv4 Internet. The gateway rewrites headers, creating an IPv4 packet toward the server and an IPv6 packet on the return path. DNS64 complements this design when a client uses a domain name and the server publishes only an A record. The translator must also handle transport ports and ICMP control messages.

How NAT64 Translation Works

1. Client's View: An IPv6-only client on an internal network wants to connect to ipv4-service.com.
2. DNS64: The client sends a DNS query for an AAAA (IPv6) record. The DNS64 server checks whether ipv4-service.com has only an A (IPv4) record, such as the documentation-only address $198.51.100.50$. It then synthesizes an AAAA record by embedding the IPv4 address in an IPv6 prefix, for example 64:ff9b::c633:6432, where c633:6432 is the hexadecimal representation of 198.51.100.50. The well-known prefix 64:ff9b::/96 is the standard NAT64 prefix.
3. Outgoing Packet: The IPv6 client sends its packet to the synthesized IPv6 address. The packet reaches the network edge, where the NAT64 gateway is located.
4. The Translation: Stateful NAT64 recognizes the prefix and extracts the IPv4 address. It creates a new IPv4 packet, translates the IPv6 source address to its public IPv4 address, and adds a port mapping such as PAT. It sets the destination to the documentation example $198.51.100.50$ and sends the packet to the server. The state table maps the IPv6 flow and transport ports to the translated IPv4 flow until the session expires. The mechanism supports TCP, UDP, and ICMP translation.
5. The Return Trip:The IPv4 server responds to the NAT64 gateway's public address. The gateway looks up the active session in its state table and performs the reverse translation, creating an IPv6 packet for the original client.

Choosing a Transition Mechanism

No single mechanism fits every stage of the IPv4 to IPv6 transition. A large network can combine all three mechanisms according to service requirements and available infrastructure:

• Dual Stack on selected servers and user devices to provide native access to both protocol versions and address-policy-based path selection.
• Tunneling to connect its different office branches over an older, IPv4-only internet backbone when both tunnel endpoints support IPv6.
• Translation (NAT64) at its edge to allow its new, IPv6-only internal devices to access legacy IPv4-only websites and services, with DNS64 for domain-name lookups.

A gradual deployment keeps IPv4 services available while IPv6 support expands. The choice depends on topology, device capabilities, application requirements, and address availability. Each option also requires monitoring of paths and security policies across both protocol versions and forwarding domains during operation. Failure handling must be included in the production design for resilient service. The mechanisms can coexist in one topology.