I work for a company that develops Deep Packet Inspection tools. One of our customers, big ISP who has a large number of DS-Lite connected subscribers, was using our DPI engine to collect statistics on IPv4 and IPv6 usage in their network. It was only recently they discovered a major problem. In the past, to avoid the mix-up between IPv4 and IPv6, with all the different tunnels used, they decided to count the statistics on the transport layer instead. But, as it turned out, our DPI regards HTTP v4 traffic inside a DS-Lite tunnel to have TCPv6 as the transport layer protocol, even though in theory it sits directly inside an IPv4 packet. This screws their statistics, since they've counted a lot of DS-Lite encapsulated IPv4 traffic as pure IPv6.

Now they've come to us arguing that it's wrong, and I kind of feel them. It all does start with TCPv4 segments packed into IPv4 packets, it's only then we put them inside IPv6 before sending out on the DS-Lite link. They argue the IPv6 encapsulation should not matter for the packets inside, which really are TCPv4. (I know it's convoluted, I hope you know what I mean.)

Big surprise came when I generated some DS-Lite PCAPs in our lab and checked how they look in Wireshark. Turns out, Wireshark confirms what our engine said - that the packet inside IPv4 layer is indeed TCPv6.

My big question now is - is there a standard describing how these protocol versions should look? I've read through the DS-Lite RFCs, so did one of our developers, but we were unable to find out what the answer might be.