6to4 is an automatic tunneling mechanism that embeds a public IPv4 address within an IPv6 address using the 2002::/16 prefix. Each IPv4 address gets a corresponding /48 IPv6 prefix.
Address Format:
- Prefix: 2002 (16 bits)
- IPv4 in hex: Next 32 bits (8 hex digits)
- Subnet ID: 16 bits (typically :0000: or customizable)
- Interface ID: Last 64 bits
Translation Example:
- IPv4: 192.0.2.1
- Hex: C0 00 02 01 → c000:0201
- 6to4 Prefix: 2002:c000:0201::/48
- Example Address: 2002:c000:0201::1
How 6to4 Worked:
- Site with public IPv4 gets automatic /48 IPv6 prefix (2002:xxxx:xxxx::/48)
- 6to4 router encapsulates IPv6 packets in IPv4 for transit over IPv4 Internet
- 6to4 relay routers (anycast 192.88.99.1) forward to native IPv6 Internet
- No explicit tunnel configuration or broker registration needed
Why 6to4 is Deprecated (RFC 7526):
- Unreliable relays: Anycast relay approach led to poor performance and reachability
- No security: Anyone could announce 6to4 relay, enabling man-in-the-middle attacks
- Asymmetric routing: Outbound and inbound paths often used different relays
- NAT incompatible: Required public IPv4 address, broke behind NAT
- Difficult troubleshooting: Users couldn't control which relay was used
Modern Alternatives:
- Native IPv6: Direct IPv6 connectivity without tunneling
- NAT64/DNS64: For IPv6-only networks accessing IPv4 resources
- 464XLAT: Mobile network IPv6 transition
- Tunnel Brokers: Managed tunnels with reliable endpoints (Hurricane Electric, etc.)
Historical Significance:
6to4 was one of the first widely deployed IPv6 transition mechanisms and helped early IPv6 adoption. However, its automatic nature led to connectivity issues that harmed IPv6 deployment, leading to its deprecation. Operating systems now disable 6to4 by default or have removed it entirely.
6to4 Prefix Recognition:
Any IPv6 address starting with 2002: is a 6to4 address. If you see these in logs or packet captures, it indicates legacy transition infrastructure that should ideally be migrated to modern IPv6 connectivity.