Table of Contents. Mid-Term Report: Issues in Migration from IPv4 to IPv6 By Ayaz-ul-Hassan Khan ( )

Transcription

1 Table of Contents Abstract Introduction Transition Mechanisms IPv6 Tunneling Tunnel Types Dual-Stack Support Address Configuration Issues in Transition Selecting the configured or automatic tunneling Embedding IPv4 Addresses into IPv6 Addresses Transmitting Large IPv6 Packets Decrementing Hop Limit Handling IPv4 ICMP errors Infrastructure Specific Transition IPv6 Over Dedicated Links IPv6 Over MPLS Backbone Conclusion and Future Works References Appendix A: Internet Protocol version 6 Header Fields Appendix B: IPv4 vs IPv Appendix C: IPv4 Header Construction Appendix D: Combined IPv4 and IPv6 Packet Sending Algorithm Appendix E: IPv6/IPv4 Translation Mechanisms Glossary CS-678: Topics in Internet Research Page 1/32

2 Abstract: Migration from IPv4 to IPv6 cannot be done in one night; there are so many issues to deal with. Even of the IPv6 is fully developed and tested protocol, it cannot be implemented directly by replacing the IPv4. There will be a period of transition when both protocols are in use over the same infrastructure. I am working on a term project that deals with survey of the issues regarding this transition, building applications in the new environment and also the effects on other protocols. So far, in this mid term report, I have described the two basic transition mechanisms that is tunneling and dual-stack and have discussed some issues regarding these transitions. I have also investigated some recently proposed infrastructure specific transition mechanism such as IPv6 over a dedicated link and IPv6 over an MPLS backbone. At the end, I have concluded my current study and have mentioned the future works that will be provided in the final report. 1 - Introduction: In the late 1980s, TCP/IP engineers and designers recognized the need for an upgrade in Internet Protocol, when it became apparent that the existing IP address space would support continued Internet growth for only a relatively short time. Internet Protocol version 6 (IPv6) overcomes the following limitations [1] of IPv4: Address space limitations, Performance, Security, and Auto configuration. In January 1991, Internet Activities Board (IAB) and Internet Engineering Steering Group (IESG) found that the development should be focused on the following areas [1]: Routing and addressing concerns, Multiprotocol architecture, Security architecture, Traffic control and state, and Advances applications. So, IPv6 embodies change in five important areas [1]: expanded addressing, simplified header format, improved extension and option support, Flow labeling, and Authentication and privacy. Key differences [2] between IPv4 and IPv6 are mentioned in appendix B. IPv6 provides a fixed length (40 bytes) new header format that clearly describes the core functionality of it. Figure 1a: shows the clear differences in two headers, description of header fields can be found in appendix A. CS-678: Topics in Internet Research Page 2/32

3 Although, IPv6 is now fully developed and tested protocol but it cannot be implemented directly in the network by just replacing the IPv4. Migration from IPv4 to IPv6 would require network administrators to find and install new versions of networking software for every host and router on the internet. Due to the existence of huge number of networks and nodes already connected to the internet using IPv4, this migration should be done gradually. It is expected that IPv4 and IPv6 will have to coexist for a long time. I have investigated some transition mechanisms which are discussed in the following sections. After that, I will discuss some issues related to these transitions. Figure 1a: Header formats of IPv4 and IPv6 IPv4 V HL ToS DL IPv6 V TC FL DID F FO PL NH HL TTL P C SIP SIP DIP IPO DIP V: Version HL: Header Length ToS: Type of Service DL: Datagram Length DID: Datagram ID F: Flags FO: Flag Offset TTL: Time To Live P: Protocol C: Checksum SIP: Source IP Address DIP: Destination IP Address IPO: IP Options (with padding if necessary)... V: Version TC: Traffic Class FL: Flow Label PL: Payload Length NH: Next Header HL: Hop Limit SIP: Source IP Address DIP: Destination IP Address CS-678: Topics in Internet Research Page 3/32

4 2 - Transition Mechanisms: Almost, all of the transitions rely on the following two basic schemes: IPv6 tunneling Dual-stack support IPv6 Tunneling: IPv4 Header IPv6 Header IPv6 Header Payload Payload Figure 2a: Encapsulation of IPv6 packet Tunnel means encapsulating IPv6 packet within the IPv4 packet (requires addition of IPv4 header to the IPv6 packet, header construction is defined in appendix C) as shown in figure 2a. It requires that an IPv6 node at one end of the tunnel be capable of transmitting IPv4 packets (dual-stack node, section 2.2) and that there be another dual-stack node at the other end of the tunnel. Tunneling can be done in two ways: Configured tunneling: in this case, the tunnel end-point should have to be configured manually or by some mechanism like DHCP (Dynamic Host Configuration Protocol). Automatic tunneling: in this case, no configuration requires setting up the IPv4 address of the tunneling nodes. But it is only possible, when IPv6 addresses of the tunneling nodes are IPv4-compatible addresses that append the IPv4 address in the last 32-bits of the IPv6 address while highest 96-bits are set to zero. CS-678: Topics in Internet Research Page 4/32

5 The algorithm [4], defined in appendix D, can be used to determine when to send IPv4 packets, when to send IPv6 packets, and when to perform automatic and configured tunneling Tunnel Types: There are four different tunneling architectures possible based on the network infrastructure as also shown in figure 2b: Router-to-router tunneling: Router A tunnels the IPv6 packets through the network which is an IPv4 network. In this case, IPv6-only host connected to router A can send IPv6 packets to IPv6-only host somewhere after the router B without concerning the existence of an intervening IPv4 network. The tunnel spans one segment of the end-to-end path that the IPv6 packet takes. Router-to-host tunneling: in this case, IPv6-only host connected to the router A can send IPv6 packets to the host that belongs to an IPv4 network but runs both IPv6 and IPv4. the tunnel spans only the last segment of the end-to-end path. Host-to-host tunneling: in this case, hosts that belong to an IPv4 network but run both IPv6 and IPv4 can exchange IPv6 packets to each other. The tunnel spans the entire end-to-end path that the packet takes. Host-to-router tunneling: in this case, host that belongs to an IPv4 network but runs both IPv6 and IPv4 can send IPv6 packets to the IPv6-only host connected to the Router B. the tunnel spans the first segment of the packet s end-to-end path. CS-678: Topics in Internet Research Page 5/32

6 Figure 2b: Types of IPv6 tunnels Router-to-Router Router A (IPv6/IPv4) Router B (IPv4) IPv4 Network Router-to-Host Router A (IPv6/IPv4) Host B (IPv6/IPv4) IPv4 Network Host-to-Host Host A (IPv6/IPv4) Host B (IPv6/IPv4) IPv4 Network Host-to-Router Host A (IPv6/IPv4) Router B (IPv6/IPv4) IPv4 Network CS-678: Topics in Internet Research Page 6/32

7 2.2 - Dual-Stack Support: Host A (IPv6/IPv4) Router X (IPv4) IPv6/IPv4 Network A IPv4 Network B Router Y (IPv6/IPv4) Host B (IPv6/IPv4) Host C (IPv6) IPv6 Network C Figure 2c: Dual-Stack Scenario Traditionally, many corporate hosts that support connectivity to the internet as well as connectivity to corporate LANs using older versions of Novell s NetWare supported two disparate network stacks. TCP/IP stack provides internet connectivity and IPX stack provides NetWare connectivity. This difference identified by the headers and the packet is passed to the appropriate stack for processing. Similar concept is used in IPv6/IPv4 dual-stack nodes. Segments are unwrapped at the link layer and the headers are examined. If the version number of the IP packet is four, then the packet is processed by the IPv4 stack, otherwise, if it is six then the packet is processed by the IPv6 stack. No tunneling requires except in some cases. Lets consider figure 2c, dual-stack host A can interoperate with IPv4 or IPv6 hosts on network A and all IPv4 hosts on network B but not with any hosts on network C which is IPv6-only network. This is because there is no IPv6 routing path from network A to network C, router linking networks A and B supports IPv4 only therefore cannot forward any IPv6 packets to network C via CS-678: Topics in Internet Research Page 7/32

8 network B unless some tunneling done in between them. If dual-stack technique used in conjunction with the tunneling technique then there are three different configurations possible [4]: IPv6/IPv4 node that does not perform tunneling. IPv6/IPv4 node that performs configured tunneling only. IPv6/IPv4 node that performs configured tunneling and automatic tunneling. Figure 2d: Dual-Stack Organization Application Transport (TCP or UDP) IPv4 IPv6 MAC Physical Address Configuration: In order to support both protocols, IPv6/IPv4 nodes may be configured with both IPv4 and IPv6 addresses. These addresses may be related or unrelated to each other. IPv4- compatible IPv6 addresses that are configured to perform automatic tunneling, may be viewed as single address to serve both IPv6 as well as IPv4 addresses. The entire 128-bit IPv4-compatible IPv6 address is used as the node s IPv6 address, while the IPv4 address embedded in low-order 32-bits serves as the node s IPv4 address. IPv6/IPv4 nodes may use the stateless IPv6 address configuration mechanism [9] or DHCP for IPv6 [10] to acquire their IPv6 address. It may be either an IPv4-compatible or an IPv6- only IPv6 address. CS-678: Topics in Internet Research Page 8/32

9 Dual-stack nodes that perform automatic tunneling may acquire their IPv4-compatible IPv6 addresses from another source such as through IPv4 address configuration protocols. It requires embedding of the IPv4 address into the lower 32-bits of IPv6 address that is prepending it with the 96-bit prefix 0:0:0:0:0:0. The specific algorithm for acquiring an IPv4-compatible address using IPv4-based address configuration protocols is defined in RFC 1933 [4]. Both above transition strategies provide IPv6 end-to-end. However, some organizations or individuals might not want to implement any of these IPv6 transition strategies. And some organizations or individuals might install only IPv6 in their nodes or networks, but might not implement dual-stack. Even if some nodes or networks do install dual-stack, these nodes might not have IPv4 addresses to be used with the dual-stack nodes. Under these circumstances, intercommunication between IPv6-only hosts and IPv4-only hosts require some level of translation between the IPv6 and IPv4 protocols on the host or router, or dual-stack hosts, with an application level understanding of which protocol to use. For example, an IPv6-only network might still want to be able to access IPv4-only resources, such as IPv4-only Web servers. A variety of IPv6-to-IPv4 translation mechanisms are consideration by the IETF v6ops Working Group which are introduced in appendix E and can also find in [6]. 3 - Issues in Transition: Selecting the configured or automatic tunneling: When the endpoint of tunnel is a router (first and last scenario of figure 2b) that have to decode the IPv6 packet and forward it to its final destination. Since, there is no relationship exist between the router address and the final destination address therefore the router address that is the tunnel endpoint must be manually configured (use configured tunneling). On the other hand, when the IPv6 packet is tunneled from a host or from a router to its destination host (second and third scenario of figure 2b), the tunnel endpoint address and the destination host address are the same. If the IPv6 address used for the destination node is an IPv4-compatible address, the tunnel endpoint IPv4 address can be CS-678: Topics in Internet Research Page 9/32

10 automatically derived from the IPv6 address, and therefore no manual configurations are necessary. Furthermore, an IPv6 node connected to a purely IPv4 network can reach other IPv6 nodes only if a default configured tunnel has been defined. It is a tunnel toward an IPv6/IPv4 router that is configured in a way similar to a default route. All the IPv6 traffic will be sent to the IPv6/IPv4 router on the default configured tunnel. This type of tunnel allows testing of IPv6 even on a single host Embedding IPv4 Addresses into IPv6 Addresses: IPv4-Compatible Address Bits IPv4 Address IPv4-Mapped Address Bits FFFF IPv4 Address Figure 3a: IPv4 Embedded IPv6 Addresses IPv4 address can be appended in the IPv6 address to make two special types of IPv6 address, as also shown in figure 3a: IPv4-compatible IPv6 address: used by nodes that need to tunnel IPv6 packets through IPv4 routers. These nodes understand IPv4 as well as IPv6. IPv4-mapped IPv6 address: used by IPv6-only nodes to address nodes that support only IPv4. Domain Name Service (DNS) requires the storage of both A (holds the low-order 32-bits) and AAAA (holds full IPv4-compatible IPv6 address that is 128-bits) records when an IPv4- compatible IPv6 addresses is assigned to an IPv6/IPv4 host to support automatic tunneling. CS-678: Topics in Internet Research Page 10/32

11 The AAAA record is required to support queries by IPv6 hosts while the A record is required to support queries by IPv4-only hosts. When a query locates an AAAA record holding an IPv4-compatible IPv6 address, and an A record holding the corresponding IPv4 address, the DNS resolver library need not necessarily return both addresses. It has three options [4]: Return only the IPv6 address to the application. Return only the IPv4 address to the application. Return both addresses to the application. The type of IP traffic depends on these options such as if the IPv6 address is returned, the node will communicate with that destination using IPv6 packets (encapsulated in most cases) or if the IPv4 address is returned, the communication will use IPv4 packets. DNS resolver implementations may depend on whether that implementation supports automatic tunneling or not. For example, an implementation that does not support automatic tunneling would not return IPv4-compatible IPv6 addresses to applications because those destinations are generally only reachable via tunneling. On the other hand, it may return only the IPv4-compatible IPv6 address and not the IPv4 address Transmitting Large IPv6 Packets: The encapsulating node can also transmit large IPv6 packets (up to 65, octet packets, because the IPv4 header is 20 octets long) by delegating the fragmentation problem to the IPv4 level. This approach, even if theoretically possible, would be inefficient for the following reasons: It would result in more fragmentation than needed. In fact, the loss of an IPv4 fragment would cause the retransmission of the entire IPv6 packet and therefore also of fragments that correctly reached the destination. The fragmentation occurring at one endpoint of the tunnel should be removed at the other endpoint. For tunnels that terminate at a router, this process would require additional memory in the router to contain fragments waiting to be reassembled. CS-678: Topics in Internet Research Page 11/32

12 Therefore, the fragmentation at tunnel endpoints can be minimized by recording the tunnel s IPv4 Path MTU (Maximum Transmission Unit) using the IPv4 Path MTU discovery protocol [5]. Note that this does not completely eliminate IPv4 fragmentation in the case when the IPv4 path MTU would result in an IPv6 MTU less than 576 bytes. (Any link layer used by IPv6 has to have an MTU of at least 576 bytes [11].) In this case the IPv6 layer has to "see" a link layer with an MTU of 576 bytes and the encapsulating node has to use IPv4 fragmentation in order to forward the 576 byte IPv6 packets. Figure 3b: Process to determine whether to forward packet using IPv4 fragmentation or return ICMP error message Start Perform Path MTU Discovery MTU = 576 Yes (IPv4 path MTU 20) <= 576 Yes Packet > 567 bytes No No Encapsulate packet Packet > (IPv4 path MTU 20) Yes MTU = (IPv4 path MTU 20) Not set don t fragment flag in IPv4 header No Encapsulate packet Send IPv6 ICMP Packet too big with MTU Set don t fragment flag in IPv4 header Drop packet Stop CS-678: Topics in Internet Research Page 12/32

13 The encapsulating node can follow the process, shown by flow chart in figure 3b, to determine when to forward an IPv6 packet that is larger than the tunnel s path MTU using IPv4 fragmentation, and when to return an IPv6 ICMP packet too big message. If the encapsulating nodes have a large number of tunnels then they might not be able to store the IPv4 Path MTU for all tunnels. Such nodes can use the MTU of the link layer (under IPv4) in the above process instead of the IPv4 path MTU but it will require additional fragmentation. In this case the Don t Fragment bit must not be set in the encapsulating IPv4 header Decrementing Hop Limit: In IPv6, a tunnel is like a single point-to-point link, and each tunnel corresponds to a hop. The Hop Limit field of the IPv6 header is therefore decremented by one when an IPv6 packet traverses a tunnel, independently from the number of IPv4 links the tunnel consists of. The single-hop model serves to hide the existence of a tunnel so that it is not detectable by network diagnostic tools such as traceroute. The single-hop model is implemented by having the encapsulating and decapsulating nodes process the IPv6 hop limit field as they would if they were forwarding a packet on to any other data link. That is, they decrement the hop limit by 1 when forwarding an IPv6 packet. (The originating node and final destination do not decrement the hop limit) Handling IPv4 ICMP errors: While encapsulating packets to sent into the tunnel it is quite possible that the encapsulating node may receive IPv4 ICMP error messages from IPv4 routers inside the tunnel. These packets are addressed to the encapsulating node because it is the IPv4 source of the encapsulated packet. The ICMP "packet too big" error messages are handled according to IPv4 Path MTU Discovery [5] and the resulting path MTU is recorded in the IPv4 layer which is used by IPv6 to determine if an IPv6 ICMP "packet too big" error has to be generated, as shown in figure 3b. Other types of ICMP error messages can be handled depending on how much information is included in the "packet in error" field that holds the encapsulated packet CS-678: Topics in Internet Research Page 13/32

14 which causes error. Many new IPv4 router returns enough data beyond the IPv4 header of the packet in error to include the entire IPv6 header and even the data beyond that. If the offending packet includes enough data then encapsulating node may extract the encapsulated IPv6 packet and use it to generate an IPv6 ICMP message directed back to the originating IPv6 node. 4 - Infrastructure Specific Transition: Based on the above mentioned transition mechanisms, following infrastructure specific IPV6 deployment strategies for service providers have been proposed recently [6]: IPv6 Over Dedicated Data Links IPV6 Over MPLS Backbone IPv6 Over Dedicated Links: Routers that are attached to the internet service provider use same layer 2 infrastructure but need separate ATM or frame relay PVCs or optical lambda. As shown in figure 4a IPv6 Over MPLS Backbone: Figure 4a: IPv6 deployment over a dedicate link It enables communication between IPv6 domains over IPv4 MPLS core network. Since forwarding is based on labels instead of IP header, it requires fewer backbone infrastructure upgrades and no reconfiguration of core routers. A variety of deployment strategies are available or under development, as follows: IPv6 tunnels on customer edge (CE) routers Layer 2 circuit transport over MPLS IPv6 on provider edge (PE) routers (6PE) Adding IPv6 MPLS VPNs to 6PE (6VPE) Native IPv6 MPLS-based backbone (MPLS control plane is IPv6-based) CS-678: Topics in Internet Research Page 14/32

15 Mid-Term Report: Issues in Migration from IPv4 to IPv6 Figures 4b to 4e shows some of the scenarios of these strategies and table 4a gives the comparison between them. Figure 4b: IPv6 deployment using tunnels on the CE routers Figure 4c: IPv6 over Ethernet over MPLS CS-678: Topics in Internet Research Page 15/32

16 Mid-Term Report: Issues in Migration from IPv4 to IPv6 Figure 4d: IPv6 on provider edge router Figure 4e: IPv6 MPLS VPN architecture CS-678: Topics in Internet Research Page 16/32

17 Mechanism Primary Use Benefits Limitations Requirements IPv6 using tunnels on CE routers IPv6 over a circuit transport over MPLS IPv6 provider edge router (6PE) over MPLS IPv6 VPN provider edge router (6VPE) over MPLS Enterprise customers wanting to use IPv6 over existing MPLS services Service providers with ATM or Ethernet links to CE routers Internet and mobile service providers wanting to offer an IPv6 service Internet and mobile service providers wanting to offer IPv6 VPN services No impact on MPLS infrastructure Fully transparent IPv6 communication Low-cost and low-risk upgrade to the PE routers, and no impact on MPLS core Low-cost and low-risk upgrade to the PE routers and no impact on MPLS core Scalability issue when the number of tunnels grow between CEs No mix of IPv4 and IPv6 traffic Applicable to MPLS infrastructure only Applicable to MPLS infrastructure although the implementation could be done for other tunneling techniques. IPv6 address leakage on the global routing table must be well controlled Dual-stack CE routers Need layer 2 transport layer over MPLS Software upgrade for PE routers VPN or VRF support Table 4a: Comparison of various IPv6 over MPLS backbone transition mechanisms 5 - Conclusion and Future Works: One cannot configure the whole network to be capable of IPv6 communication at the same time. It should be done gradually, moving from the access point to the core of the network that requires some of the transition mechanisms discussed above. The issues in transition that I have investigated are related to tunneling type (configured or automatic), IPv6 address creation, IPv4 fragmentation, hop limit field of IPv6 packet, and IPv4 ICMP errors. And it can be seen that tunneling type depends on the endpoint, if it is a router then use configured tunneling and if it is a host then use automatic tunneling. DNS resolver libraries on IPv6/IPv4 nodes must be capable of handling both A and AAAA records that are used in IPv4 and IPv6 respectively. In order to deal with fragmentation, an algorithm has been defined to identify that when to forward an IPv6 packet that is larger than the CS-678: Topics in Internet Research Page 17/32

18 tunnel s path MTU using IPv4 fragmentation, and when to return an IPv6 ICMP packet too big message. For the hop limit field, it is seen that it is decremented by one through the whole traversing of tunnel independent of the number of IPv4 links it has. Similarly, in the discussion of IPv4 ICMP errors, it is seen that the handling of ICMP error messages depends on how much information is included in the "packet in error" field, which holds the encapsulated packet that caused the error. After that, I will be focusing my study to the effects of this migration on the other protocols such as routing protocols and to issues in building applications for the new environment that may include portability issues. I will also try to come with some other transition issues and infrastructure specific scenarios. References: [1] Loshin, Pete: IPv6 Clearly Explained, [2] Introduction to IP version 6, Microsoft Corporation, September [3] Gai, Silvano: Internetworking IPv6 with Cisco Routers, [4] Gilligan, R., and E. Nordmark, Transition Mechanisms for IPv6 Hosts and Routers, RFC 1933, April [5] Mogul, J., and S. Deering, Path MTU Discovery, RFC 1191, November [6] Tatipalmula, Mallik and Grossetete, Patrick and Esaki, Hiroshi, IPv6 Integration and Coexistence Strategies for Next-Generation Networks, IEEE Communications Magazine, January 2004, Vol. 42 No. 1. [7] IPv6/IPv4 Coexistence and Migration, Microsoft Corporation, August [8] Jacqueline, Emigh, IPv6: Migration issues Loom for Network Administrators, June [9] Thomson, S., and T. Nartan, IPv6 Stateless Address Autoconfiguration, RFC 2462, December [10] Bound, J., and R. Droms, Dynamic Host Configuration Protocol for IPv6 (DHCPv6), RFC 3315, July [11] Deering, S., and R. Hinden, Internet Protocol Version 6 (IPv6) Specification, RFC 1883, December [12] Narten, T., and E. Nordmark, W. Simpson, Neighbor Discovery for IP Version 6 (IPv6), RFC 2461, December CS-678: Topics in Internet Research Page 18/32

19 Appendix A: Internet Protocol version 6 Header Fields Version: (4-bits) It identifies the version of internet protocol either IPv4 (value=4) or IPv6 (value=6). Traffic Class: (8-bits) It is to use for providing differentiated services for the packet. Default value is all zeros. Flow Label: (20-bits) It identifies the same flow packets. A source can have multiple simultaneous flows that are uniquely identified by flow label and address of the source. Payload Length: (16-bits) It contains the length of the packet payload in bytes including IPv6 extensions. Next Header: (8-bits) It identifies the protocol used in the header immediately following the IPv6 packet. It may be the high-layer protocol (TCP or UDP) or may be the identification of the existence of IPv6 extension header. Hop Limit: (8-bits) It is decremented by one every time when a node forwards the packet and if it reaches zero then the packet is discarded. Source IP Address: (128-bits) It specifies the IP address of source machine that is originating the IPv6 packet. Destination IP Address: (128-bits) It is the IP address of the indented recipient of the packet. It could be a unicast, multicast or anycast address. CS-678: Topics in Internet Research Page 19/32

20 Appendix B: IPv4 vs IPv6 Differences IPv4 Source and destination addresses are 32 bits (4 bytes) in length. IPSec support is optional. No identification of packet flow for QoS handling by routers is present within the IPv4 header. Fragmentation is done by both routers and the sending host. Header includes a checksum. Header includes options. Address Resolution Protocol (ARP) uses broadcast ARP Request frames to resolve an IPv4 address to a link layer address. Internet Group Management Protocol (IGMP) is used to manage local subnet group membership. ICMP Router Discovery is used to determine the IPv4 address of the best default gateway and is optional. Broadcast addresses are used to send traffic to all nodes on a subnet. Must be configured either manually or through DHCP. Uses host address (A) resource records in the Domain Name System (DNS) to map host names to IPv4 addresses. Uses pointer (PTR) resource records in the IN-ADDR.ARPA DNS domain to map IPv4 addresses to host names. Must support a 576-byte packet size (possibly fragmented). IPv6 Source and destination addresses are 128 bits (16 bytes) in length. IPSec support is required. Packet flow identification for QoS handling by routers is included in the IPv6 header using the Flow Label field. Fragmentation is not done by routers, only by the sending host. Header does not include a checksum. All optional data is moved to IPv6 extension headers. ARP Request frames are replaced with multicast Neighbor Solicitation messages. IGMP is replaced with Multicast Listener Discovery (MLD) messages. ICMP Router Discovery is replaced with ICMPv6 Router Solicitation and Router Advertisement messages and is required. There are no IPv6 broadcast addresses. Instead, a link-local scope all-nodes multicast address is used. Does not require manual configuration or DHCP. Uses host address (AAAA) resource records in the Domain Name System (DNS) to map host names to IPv6 addresses. Uses pointer (PTR) resource records in the IP6.ARPA DNS domain to map IPv6 addresses to host names. Must support a 1280-byte packet size (without fragmentation). CS-678: Topics in Internet Research Page 20/32

21 IPv4 Address and their IPv6 Equivalents IPv4 Address IPv6 Address Internet address classes Not applicable in IPv6 Multicast addresses ( /4) IPv6 multicast addresses (FF00::/8) Broadcast addresses Not applicable in IPv6 Unspecified address is Unspecified address is :: Loopback address is Loopback address is ::1 Public IP addresses Global unicast addresses Private IP addresses ( /8, Site-local addresses (FEC0::/10) /12, and /16) Autoconfigured addresses ( /16) Text representation: Dotted decimal notation Network bits representation: Subnet mask in dotted decimal notation or prefix length DNS name resolution: IPv4 host address (A) resource record DNS reverse resolution: IN-ADDR.ARPA domain Link-local addresses (FE80::/64) Text representation: Colon hexadecimal format with suppression of leading zeros and zero compression. IPv4-compatible addresses are expressed in dotted decimal notation. Network bits representation: Prefix length notation only DNS name resolution: IPv6 host address (AAAA) resource record DNS reverse resolution: IP6.ARPA domain CS-678: Topics in Internet Research Page 21/32

22 Appendix C: IPv4 Header Construction When encapsulating an IPv6 packet in an IPv4 datagram, the IPv4 header fields are set as follows: Version: 4 IP Header Length in 32-bit words: 5 (There are no IPv4 options in the encapsulating header.) Type of Service: 0 Total Length: Payload length from IPv6 header plus length of IPv6 and IPv4 headers (i.e. a constant 60 bytes). Identification: Generated uniquely as for any IPv4 packet transmitted by the system. Flags: Set the Don t Fragment (DF) flag, if required. Set the More Fragments (MF) bit as necessary if fragmenting. Fragment offset: Set as necessary if fragmenting. Time to Live: Set in implementation-specific manner. Protocol: 41 (Assigned payload type number for IPv6) Header Checksum: Calculate the checksum of the IPv4 header. Source Address: IPv4 address of outgoing interface of the encapsulating node. Destination Address: IPv4 address of tunnel endpoint. Any IPv6 options are preserved in the packet (after the IPv6 header). CS-678: Topics in Internet Research Page 22/32

23 Appendix D: Combined IPv4 and IPv6 Packet Sending Algorithm This algorithm has the following properties: Sends IPv4 packets to all IPv4 destinations. Sends IPv6 packets to all IPv6 destinations on the same link. Using automatic tunneling sends IPv6 packets encapsulated in IPv4 to IPv6 destinations with IPv4-compatible addresses that are located off-link. Sends IPv6 packets to IPv6 destinations located off-link when IPv6 routers are present. Using the default IPv6 tunnel, sends IPv6 packets encapsulated in IPv4 to IPv6 destinations with IPv6-only addresses when no IPv6 routers are present. The algorithm is as follows: 1. If the address of the end node is an IPv4 address then: If the destination is located on an attached link, then send an IPv4 packet addressed to the end node. If the destination is located off-link, then; If there is an IPv4 router on link, then send an IPv4 format packet. The IPv4 destination address is the IPv4 address of the end node. The data link address is the data link address of the IPv4 router. Else, the destination is treated as "unreachable" because it is located off link and there are no on-link routers. 2. If the address of the end node is an IPv4-compatible IPv6 address (i.e. bears the prefix 0:0:0:0:0:0), then: If the destination is located on an attached link, then send an IPv6 format packet (not encapsulated). The IPv6 destination address is the IPv6 address of the end node. The data link address is the data link address of the end node. If the destination is located off-link, then: If there is an IPv4 router on an attached link, then send an IPv6 packet encapsulated in IPv4. The IPv6 destination address is the address of the end node. The IPv4 destination address is the CS-678: Topics in Internet Research Page 23/32

24 low-order 32-bits of the end node s address. The data link address is the data link address of the IPv4 router. Else, if there is an IPv6 router on an attached link, then send an IPv6 format packet. The IPv6 destination address is the IPv6 address of the end node. The data link address is the data link address of the IPv6 router. Else, the destination is treated as "unreachable" because it is located off-link and there are no on-link routers. 3. If the address of the end node is an IPv6-only address, then: If the destination is located on an attached link, then send an IPv6 format packet. The IPv6 destination address is the IPv6 address of the end node. The data link address is the data link address of the end node. If the destination is located off-link, then: If there is an IPv6 router on an attached link, then send an IPv6 format packet. The IPv6 destination address is the IPv6 address of the end node. The data link address is the data link address of the IPv6 router. Else, if the destination is reachable via a configured tunnel, and there is an IPv4 router on an attached link, then send an IPv6 packet encapsulated in IPv4. The IPv6 destination address is the address of the end node. The IPv4 destination address is the configured IPv4 address of the tunnel endpoint. The data link address is the data link address of the IPv4 router. Else, the destination is treated as "unreachable" because it is located off-link and there are no on-link IPv6 routers. On/Off Link Determination: Part of the process of determining what packet format to use includes determining whether a destination is located on an attached link or not. IPv4 and IPv6 employ different mechanisms. IPv4 uses an algorithm in which the destination address and the interface address are both logically ANDed with the netmask of the interface and then compared. CS-678: Topics in Internet Research Page 24/32

25 If the resulting two values match, then the destination is located on-link. IPv6 uses the neighbor discovery algorithm described in [12]. IPv6/IPv4 nodes need to use both methods: If a destination is an IPv4 address, then the on/off link determination is made by comparison with the netmask. If a destination is represented by an IPv4-compatible IPv6 address (prefix 0:0:0:0:0:0), the decision is made using the IPv4 netmask comparison algorithm using the low-order 32-bits (IPv4 address part) of the destination address. If the destination is represented by an IPv6-only address (prefix other than 0:0:0:0:0:0), the on/off link determination is made using the IPv6 neighbor discovery mechanism. CS-678: Topics in Internet Research Page 25/32

26 Appendix E: IPv6/IPv4 Translation Mechanisms NAT-Protocol Translation (NAT-PT) TCP-UDP relay Bump-in-the-stack (BlS) SOCKS-based gateway Following table shows the comparison between these mechanisms, details can be found in [6]. Mechanism Primary Use Benefits Limitations Requirements NAT-PT IPv6 only hosts to IPv4 only hosts No dual stack No end-to-end IPSec Dedicated server Dedicated server is single point of failure DNS with IPv6 support TCP-UDP relay BIS SOCKSbased IPv6/IPv4 gateway Translation between TCP/UDPv6 and TCP/UDPv4 sessions IPv4 only hosts communicating with IPv6 only hosts IPv6 only hosts to IPv4 only hosts Freeware End system implementation Freeware NAT-PT requires an ALG for application that embeds an IP address No end-to-end IPSec Dedicated server is single point of failure All stacks must be updated Requires additional software in the gateway Dedicated server DNS with IPv6 support Updated IPv4 protocol stack Client and gateway software in the host and router CS-678: Topics in Internet Research Page 26/32

27 Glossary: AAAA: Type of record used in DNS servers to store an IPv6 address. Address: An identifier of an interface or a set of interfaces. Address resolution: Process to determine the relationship between an IP address and a link layer address (for example, in the LAN s case, a MAC address). Anycast: The unicast address of a group of interfaces belonging to different nodes. A packet that is sent to an anycast address is delivered to only one interface of the group (the nearest to the source, coherently to routing metrics). ARP (Address Resolution Protocol): A protocol of the IPv4 architecture used to map an IPv4 address to a Data Link layer address (frequently MAC). ARP can be implemented only on physical networks that support the broadcast. Asymmetric reachability: A type of asymmetrical link in which it is correct to reach node B from node A, but not node A from node B. ATM (Asynchronous Transfer Mode): CCITT standard used to convey, through fixed-length cells, different kinds of information (data, voice, video, and so on). In the Internet world, this abbreviation is frequently synonymous with Another Terrible Mistake. Authentication: The verification of the identity of a person or a process. Authentication Header (AH): Header with the function of guaranteeing the authenticity and the integrity of a packet. It guarantees that the packet-fixed fields have not been modified during the transmission. Automatic tunnel: Tunnel IPv6 on IPv4 where the endpoint of the IPv4 tunnel is determined by the IPv6 address with an embedded IPv4 address. Autonomous System (AS): A set of routing domains under a common administration. Backbone: The top level in a hierarchical network. Bandwidth: The difference between the highest and the lowest frequencies available for network signals. The term is also used to describe the rated throughput capacity of a given network medium or protocol. BGP (Border Gateway Protocol): Path vector routing protocol, standardized by the IETF, used by exterior routers of an autonomous system to announce the network s addresses. BOOTP (BOOTstrap Protocol): TCP/IP network architecture protocol that allows a diskless machine to bootstrap on a local network. Border router: A synonym for exterior router. CS-678: Topics in Internet Research Page 27/32

28 Bridge: Routing device that operates at the Data Link layer (Layer 2) of the OSI reference model. MAC-bridges are frequently used to interconnect local networks. Broadband: A high-speed transmission, usually higher than 2 Mb/s. Broadcast: Data packet that will be sent to all nodes on a network. Cell: Short packet with fixed length (in ATM, 53 octets). CIDR (Classless Inter-Domain Routing): Technique that allows routers to group routes together to cut down on the quantity of routing information carried by the core routers. Circuit switching: Commutation technique to transmit digital data or analog signals that allow transmission systems to create a short delay and constant bandwidth temporary circuit. Classifier: A part in an internetworking device in which packets are classified by their belongings to flows. Configured tunnel: IPv6 over IPv4 tunnel where the endpoint of the IPv4 tunnel is determined by the information configured on the node performing the encapsulation. Core gateway: The primary router in Internet. A synonym used for core router. Datagram: packets transmitted by a connectionless protocol. Also a synonym used for IP packet. Data link: The second layer of the OSI reference model. This layer provides reliable transit of data across a physical link. Default route: Routing table entry that is used to direct frames for which a next hop is not explicitly listed in the routing table. DHCP (Dynamic Host Configuration Protocol): Server-based protocol for the automatic configuration of IP networks (for example, addresses and prefixes). DNS (Domain Name Server): Service for the translation of names into addresses and vice versa in the TCP/IP network architecture, based on a distributed and replicated database. Encapsulation: Technique used by protocols in which a lower layer adds information to the upper layer PDU by adding a header. Encryption: Manipulation of a data packet to guarantee that only the real receiver can extract its content. It is implemented by using standard algorithms. Ethernet: Local network CSMA/CD; sometimes it is used for an IEEE LAN. CS-678: Topics in Internet Research Page 28/32

29 Extension header: A header, in addition to the IPv6 header, providing additional services (for example, fragmentation and source routing). It is placed between the IPv6 header and the upper layer header. Exterior Gateway Protocol (EGP): Generic term applied to each protocol used to advertise reachability and routing information among different ASs. The term gateway is obsolete, and the term router is preferred. Exterior router: A router that connects different Asynchronous Systems. Firewall: A computer or a router designated as a buffer between any connected public network and a private network to implement security. Flow: Stream of IP packets that have some common characteristics (for example, the same source and destination addresses and the same application). Flow label: Field of the IPv6 header used to identify the flow with the source address. Fragment: A piece of a larger packet that has been subdivided into smaller units. Frame relay: Standard for the implementation of public or private packet switching networks, based on a connected Data Link layer protocol in which virtual permanent circuits are defined. Gateway: Device used to connect two different network architectures through the conversion of some application protocols of architecture into the homologous protocols of another one. In the TCP/IP protocol, the term is improperly used as a synonym for router. Global address: A worldwide unique address. Header: First part of a PDU containing control information. ICMP (Internet Control Message Protocol): In the TCP/IP network architecture, a Network layer protocol used with neighbor greetings functions, to report errors and to provide other information relevant to packet processing. ICMPv6 (ICMP version 6): Version 6 of the ICMP protocol to be used with IPv6. IEEE (Institute of Electrical and Electronics Engineers): Professional organization whose activities include the development of communications and network standards. IEEE LAN standards are the predominant LAN standards in use today. IETF (Internet Engineering Task Force): ISOC working group responsible for the standardization and the development of the TCP/IP network architecture. IGMP (Internet Group Management Protocol): Protocol used in IPv4 for multicast groups management. In IPv6, IGMP functions are included in ICMPv6. CS-678: Topics in Internet Research Page 29/32

30 IGRP (Interior Gateway Routing Protocol): IGP routing protocol developed by Cisco Systems to address the problems associated with routing in large, heterogeneous networks. Integrated IS-IS (previously called Dual IS-IS): Routing protocol based on the OSI IS-IS routing protocol but supporting IP and other protocols; integrated IS-IS propagates reachability information of all protocols through the same LSP at the same time. Interface: The device used to interconnect a node to a link. Interior Gateway Protocol (IGP): Generic term applied to each protocol used to advertise reachability and routing information within an AS. The term gateway is obsolete; it is replaced by router. Interior router: A router managing connections only within an AS. Internet: When used with lowercase i, it is short for internetwork, which is implemented by routers. Internet: The largest global internetwork, based on the TCP/IP network architecture. Internet protocol suite: The network architecture best known as TCP/IP. Intranet: A company s private network based on the Internet model. Invalid address: an address not assigned to any interface. IP (Internet Protocol): In TCP/IP network architecture, the Network layer data protocol. IPng (IP new generation): Term used for IPv6 during the standardization phase. IP spoofing: Counterfeiting of the source address in order to attack the security of an IP node. IPv4 (IP version 4): The only IP version used until IPv4 address: The 32-bit address assigned to host and router interfaces using the IPv4 network architecture; written in dotted decimal format. IPv6 (IP version 6): The new IP version. IPv6 address: The 128-bit address assigned to host and router interfaces using the IPv6 network architecture; written as eight hexadecimal digits separated by: (colon). IPv6 address compatible IPv4: An IPv6 address algorithmically derived from an IPv4 address. IPv6 over IPv4 tunneling: Encapsulation of IPv6 packets in IPv4 packets to allow the IPv6 packets to be transmitted in IPv4 routing infrastructures. Two kinds of tunnels are available: configured and automatic. CS-678: Topics in Internet Research Page 30/32

31 MTU (Maximum Transmission Unit): Maximum packet size, in bytes, that a particular interface can manage. Multicast: A single address for a set of interfaces belonging to different nodes. A packet sent to a multicast address is delivered to all interfaces belonging to the set. Neighbor discovery: Process of the ICMPv6 protocol for the automatic configuration of neighbor relations on a link. Neighbors: Nodes connected on the same link. Netmask: A 32-bit mask used in IPv4 to specify the subnetwork address. Network: Collection of computers, printers, routers, switches, and other peripherals and devices that can communicate with each other over some transmission medium. It can be made of a combination of LANs and WANs. Next hop: The next node toward which to transmit a packet. The node must be reachable at link layer (that is, must be on-link) and therefore must be a neighbor. Packet: Term normally used to indicate a PDU. In this book, packet is synonymous with PDU at the IP layer. Payload: The data field of an IP packet or of an ATM cell. Protocol: Formal description of a set of rules and conventions that govern how devices on a network exchange information. Protocol stack: A set of related communications protocols organized by layers that cooperate to provide some network functions. Protocol type: Field of the Ethernet v.2.0 frame that indicates the upper layer protocol contained in the data field. PVC (Permanent Virtual Connection): Virtual circuit that is permanently established by the network administrator. QoS (Quality of Service): In OSI and ATM architectures, the measure of performance for a transmission system that reflects its transmission quality and service availability. RARP (Reverse Address Resolution Protocol): Protocol in the TCP/IP stack that provides a method to obtain a Network layer address starting from a Data Link layer address. Reachability: Whether the one-way forward path to a node is functioning properly. Relay: A node that acts as an intermediate device in the transmission of a packet between other two nodes (for example, between client and server). CS-678: Topics in Internet Research Page 31/32

32 RFC (Request For Comments): Document series used as the primary means for communicating information about the Internet. Some RFCs are designated as standards about the TCP/IP network architecture. TCP (Transmission Control Protocol): In the TCP/IP network architecture, a connectionoriented transport layer protocol that provides reliable and full-duplex data transmission. TCP is part of the TCP/IP protocol stack. TCP/IP (Transmission Control Protocol/Internet Protocol): The network architecture developed in the 1970s to support the construction of worldwide internetworks, the best known of which is the Internet; it is a market and de facto standard. Traceroute: A program available on many computers showing the routing path followed by a packet to reach a given destination. TTL (Time To Live): A field in the IPv4 header used to limit the life of packets temporarily in case of loops in the network. Tunnel: Encapsulation of a protocol A into a protocol B. A considers the protocol B as if it were an IP link (that is, a Data Link layer protocol). Tunneling: Technique that is use for packet transmission by using tunnels. UDP (User Datagram Protocol): In the TCP/IP network architecture, a connectionless transport layer protocol used. Unicast: The address of a single interface. A packet sent to a unicast address is delivered only to the interface identified by that address. Valid address: A preferred or deprecated address. VPN (Virtual Private Network): Frequently implemented by tunneling on IP. WAN (Wide Area Network): Data communications network that serves users across a broad geographic area and often uses transmission devices provided by common carriers. CS-678: Topics in Internet Research Page 32/32