6

I work for a company that develops Deep Packet Inspection tools. One of our customers, big ISP who has a large number of DS-Lite connected subscribers, was using our DPI engine to collect statistics on IPv4 and IPv6 usage in their network. It was only recently they discovered a major problem. In the past, to avoid the mix-up between IPv4 and IPv6, with all the different tunnels used, they decided to count the statistics on the transport layer instead. But, as it turned out, our DPI regards HTTP v4 traffic inside a DS-Lite tunnel to have TCPv6 as the transport layer protocol, even though in theory it sits directly inside an IPv4 packet. This screws their statistics, since they've counted a lot of DS-Lite encapsulated IPv4 traffic as pure IPv6.

Now they've come to us arguing that it's wrong, and I kind of feel them. It all does start with TCPv4 segments packed into IPv4 packets, it's only then we put them inside IPv6 before sending out on the DS-Lite link. They argue the IPv6 encapsulation should not matter for the packets inside, which really are TCPv4. (I know it's convoluted, I hope you know what I mean.)

Big surprise came when I generated some DS-Lite PCAPs in our lab and checked how they look in Wireshark. Turns out, Wireshark confirms what our engine said - that the packet inside IPv4 layer is indeed TCPv6. DS-Lite packet in Wireshark

My big question now is - is there a standard describing how these protocol versions should look? I've read through the DS-Lite RFCs, so did one of our developers, but we were unable to find out what the answer might be.

Improve this question
4
  • I agree with the client: these are TCP segments inside IPv4, inside a tunnel which happens to be DS-Lite. I confess I had to read it twice just because TCP's protocol number is 6.
    – jonathanjo
    Commented Feb 28, 2018 at 12:46
  • 4
    The 6 you quote is not related to IPv6 but just the fact that TCP has number 6 as protocol over IP (see /etc/protocols or iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) , UDP is 17, etc... DS-Lite (RFC6333) specifically says: "Note: At this point, DS-Lite only defines IPv4-in-IPv6 tunnels;"
    – Patrick Mevzek
    Commented Feb 28, 2018 at 18:41
  • The IPv6 outer layer doesn't care what the IPv4 inner layer transports. The TCP layer uses v4 headers as it's transported over IPv4 and doesn't know/care for the outer layer. As Patrick has pointed out, the protocol number for TCP is 6 by coincidence. In your place, I'd count DS-Lite and such separately or have the user selected where it should go (as it's both IPv6 and IPv4).
    – Zac67 ♦
    Commented Feb 28, 2018 at 19:09
  • Oh no... I can not believe this :) Thank you, guys, I was so focused on IP versions that TCP protocol number completely slipped my mind! Also, how do I mark this question resolved?
    – Piotr S.
    Commented Mar 1, 2018 at 10:12

2 Answers 2

Reset to default
5

The consensus of the comments is

  • The segments are inside IPv4
  • The protocol of TCP happens to be 6 and it's not its IP version number

As you say, if you're looking for 4s vs 6s for protocol versions, you will find them!

Improve this answer
3

Turns out, Wireshark confirms what our engine said - that the packet inside IPv4 layer is indeed TCPv6.

As jonathanjo already wrote: The (6) is the IPv4 (!) protocol number which is 6 for TCP and 17 for UDP.

is there a standard describing how these protocol versions should look?

I even doubt that the terms "TCPv6" or "TCPv4" exist in official documents.

I have always read terms like "TCP/IPv4" or "TCP/IPv6".

There is one notable difference between the two packet types:

"TCP/IPv4" uses some formula calculating the packet checksum using the IPv4 source and destination addresses. "TCP/IPv6" uses a modified formula for the checksum because IPv6 addresses are used for the checksum calculation.

In the case of DS-Lite ...

  • ... the IPv4 formula is used for the checksum calculation
  • ... the TCP packet was originally sent as pure IPv4 packet and will be received by the final destination as pure IPv4 packet

Therefore I would definitely say your screenshot shows a "TCPv4" packet, not a "TCPv6" packet.

Improve this answer
1
  • TCP (and UDP) are the same inside IPv6 and v4, with the exception of the "pseudo-header", used as part of the checksum calculation. It's specified in Section 8, Upper Layer Protocol Issues, of IPv6 RFC 2460.
    – jonathanjo
    Commented Mar 9, 2018 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.