6to4 Address Builder/Parser

The 6to4 Address Builder/Parser constructs and decodes 6to4 tunnel addresses that embed IPv4 addresses within the 2002::/16 IPv6 prefix. Enter a public IPv4 address like 192.0.2.1 to compute its 6to4 prefix 2002:c000:0201::/48, or paste a 6to4 IPv6 address like 2002:c000:0201::1 to extract the embedded IPv4 address 192.0.2.1.

Understanding 6to4 Tunnel Addressing

6to4 is one of the IPv6 transition mechanisms that was designed to give IPv4 sites automatic IPv6 connectivity without requiring an IPv6-capable ISP. The concept is elegant: take a public IPv4 address, encode it in hexadecimal, and embed it inside an IPv6 prefix. Any site with a public IPv4 address instantly gets a globally unique IPv6 prefix derived deterministically from that address. IPv6 packets are then tunneled inside IPv4 packets (using IP protocol 41) to reach 6to4 relay routers, which forward them into the native IPv6 internet.

The mechanism worked well enough in controlled environments, but it had serious operational problems in the wild. The anycast relay infrastructure was unreliable -- some relays were overloaded, misconfigured, or simply unavailable in certain regions. Forward and return paths often traversed different relays, creating asymmetric routing that made troubleshooting extremely difficult. Security was also a concern, since rogue relay operators could intercept or inject traffic. These issues led to the formal deprecation of 6to4 in RFC 7526 (2015), and most modern operating systems have disabled it by default.

Despite the deprecation, 6to4 addresses still appear in production traffic, log files, and legacy infrastructure. Being able to decode a 2002: address to identify the originating IPv4 network remains a practical skill. If you see 2002:c633:6401::1 in your server logs, this tool tells you the traffic originates from the IPv4 address 198.51.100.1. That information is valuable for incident response, log analysis, and understanding legacy network behavior.

How to Build or Parse a 6to4 Address

1. Build: Enter a public IPv4 address (e.g., 192.0.2.1) to compute its corresponding 6to4 prefix
2. The tool converts the IPv4 octets to hexadecimal and inserts them after 2002::
3. Parse: Enter a 6to4 IPv6 address (e.g., 2002:c000:0201::1) to extract the embedded IPv4 address
4. The tool validates the 2002::/16 prefix and decodes the 32 bits following it back to dotted decimal

6to4 Address Conversion Examples

Reverse Parsing Examples

When to Use the 6to4 Address Builder

• Log analysis -- identify the originating IPv4 address behind any 2002: address appearing in server logs, firewall logs, or IDS alerts
• Legacy network debugging -- troubleshoot connectivity in environments that still use 6to4 tunneling for IPv6 access
• Security investigations -- trace the source IPv4 network of traffic arriving over 6to4 tunnels
• Migration planning -- inventory 6to4 usage before deprecating the transition mechanism in your network
• Education -- understand the bit-level relationship between IPv4 and 6to4 addressing

How 6to4 Tunnel Addressing Works

6to4 (RFC 3056) is an automatic tunneling mechanism that derives an IPv6 prefix from a public IPv4 address. The resulting IPv6 traffic is encapsulated in IPv4 packets (protocol 41) and sent to 6to4 relay routers.

Address Construction

The 6to4 address format places the IPv4 address in bits 16-47 of the IPv6 address:

|  16 bits  |    32 bits     |  16 bits  |     64 bits      |
|   2002    |  IPv4 address  | Subnet ID | Interface ID     |
|           |  (hex encoded) |           |                  |

IPv4: 192.0.2.1
Hex:  C0.00.02.01

6to4: 2002:c000:0201:[subnet]:[interface ID]

Each site using 6to4 gets an effective /48 prefix (2002:xxxx:xxxx::/48), providing 65,536 subnets (the 16-bit subnet ID field) with full 64-bit interface identifiers.

The 6to4 Relay Anycast Address

6to4 traffic destined for native IPv6 hosts is sent to the anycast relay address 192.88.99.1 (IPv6: 2002:c058:6301::). The relay router decapsulates the IPv4 packet and forwards the inner IPv6 packet toward its native IPv6 destination. The return path uses the same mechanism in reverse.

Deprecation Status

RFC 7526 (2015) officially deprecated 6to4 due to several operational problems:

• Unreliable relays -- anycast relay availability was inconsistent, causing intermittent connectivity
• Asymmetric routing -- forward and return paths often traversed different relays, complicating troubleshooting
• Security concerns -- traffic could be intercepted or spoofed by rogue relay operators
• NAT incompatibility -- 6to4 requires a public IPv4 address, which is increasingly unavailable behind CGNAT

Despite deprecation, 6to4 addresses still appear in production traffic, and being able to decode them remains a practical skill.

Practical Considerations for 6to4 Addresses

If you encounter 6to4 traffic in your network today, the first step is to determine whether it is intentional or accidental. Many legacy Windows systems had 6to4 enabled by default, and hosts behind public IPv4 addresses would automatically generate 6to4 prefixes and attempt to use them. This created unpredictable connectivity because the quality of 6to4 relay infrastructure varied by geography and ISP. If you see intermittent IPv6 connectivity issues on legacy systems, check whether 6to4 is enabled and consider disabling it in favor of native IPv6 or a more reliable tunnel mechanism like WireGuard or an IPv6 tunnel broker.

From a security perspective, 6to4 traffic uses IP protocol 41, which is distinct from TCP (6) and UDP (17). If your firewall does not explicitly handle protocol 41, 6to4 traffic may be silently dropped or, worse, allowed through without inspection. Ensure your firewall rules explicitly permit or deny protocol 41 based on your network policy. If you are not using 6to4, blocking protocol 41 at the perimeter is a reasonable security measure.

When analyzing 6to4 addresses in logs, remember that the embedded IPv4 address reveals the public address of the 6to4 tunnel endpoint, not necessarily the end user. If the 6to4 host is behind a NAT, the embedded address is the NAT's public address. This limits the granularity of source identification but still provides useful information for geolocation and network attribution.

Frequently Asked Questions

Is 6to4 still used in production networks?

6to4 was officially deprecated by RFC 7526 in 2015, and most major operating systems have disabled it by default. However, some legacy systems and networks still generate 6to4 traffic. If you see 2002: addresses in your logs, it indicates a host or network using this deprecated transition mechanism.

Can I use a private IPv4 address with 6to4?

Technically the tool will compute a 6to4 prefix for any IPv4 address, but 6to4 requires a publicly routable IPv4 address to function as a tunnel endpoint. Using RFC 1918 addresses (like 10.x.x.x or 192.168.x.x) produces addresses that cannot reach 6to4 relay routers on the internet.

How do I identify 6to4 traffic in my network?

Look for IPv6 addresses beginning with 2002: in logs and flow data. On the IPv4 side, 6to4 uses IP protocol 41 (IPv6-in-IPv4 encapsulation). You can filter for protocol 41 in firewall rules or packet captures to find 6to4 tunnel traffic.

What replaced 6to4 as a transition mechanism?

Native dual-stack is the preferred approach today. For environments that cannot get native IPv6, tunnel brokers (like Hurricane Electric's tunnelbroker.net), VPN-based tunnels, and NAT64/DNS64 are more reliable alternatives. The Teredo mechanism (another automatic tunnel) has also been largely supplanted by native deployment.

Why does my 6to4 connectivity work sometimes but not other times?

This is the classic 6to4 failure mode. The anycast relay at 192.88.99.1 directs traffic to the nearest relay, but relay availability varies. Your outbound path may reach a working relay while the return path hits a different, broken one. This asymmetric routing was a primary reason for deprecation.

Related Tools

• IPv4-Mapped IPv6 Converter - Convert between IPv4 and IPv4-mapped IPv6 (::ffff:)
• Address Family Detector - Detect if an address is IPv4, IPv6, or invalid
• IPv6 Unique Local/Link-Local Detector - Detect IPv6 address scope and type
• IPv4 ↔ Hex Converter - Convert IPv4 addresses to/from hexadecimal
• IPv6 ↔ Binary Converter - Convert IPv6 addresses to/from 128-bit binary notation
• IPv4 Private/Public Detector - Detect if IPv4 is private, public, or special