IPv4-Mapped IPv6 Converter

The IPv4-Mapped IPv6 Converter translates IPv4 addresses to and from the ::ffff: mapped IPv6 format used by dual-stack sockets. Enter 192.168.1.1 to get ::ffff:192.168.1.1 (dotted notation) and ::ffff:c0a8:0101 (hex notation), or paste a mapped IPv6 address to extract the original IPv4 address.

Understanding IPv4-Mapped IPv6 Addresses

If you have ever looked at application logs from a Node.js server, a Go service, or a Python web application and seen client addresses like ::ffff:10.0.0.5 instead of the plain 10.0.0.5 you expected, you have encountered IPv4-mapped IPv6 addresses. This format is not a bug -- it is how the operating system represents IPv4 connections to applications that are listening on IPv6 sockets.

Modern operating systems create dual-stack sockets by default. When a server binds to an IPv6 address (or to ::, which means all interfaces), it can accept both IPv6 and IPv4 connections on the same port. When an IPv4 client connects, the kernel needs a way to represent that IPv4 address within the 128-bit IPv6 address space. It does this by prepending ::ffff: to the IPv4 address, producing a 128-bit value where the first 80 bits are zero, the next 16 bits are all ones (ffff), and the last 32 bits contain the original IPv4 address. This mapped format allows the application to handle all connections using a single IPv6 address type.

For developers and system administrators, the practical challenge is that these mapped addresses show up everywhere: in access logs, database connection strings, security alerts, and rate-limiting tables. If your log analysis pipeline does not account for the ::ffff: prefix, you end up with separate entries for the same client, broken geolocation lookups, and allowlists that fail to match. This converter handles both directions -- IPv4 to mapped and mapped to IPv4 -- so you can quickly translate between formats when debugging or building address-processing logic.

How to Convert Between IPv4 and IPv4-Mapped IPv6

1. Enter an IPv4 address (e.g., 192.168.1.1) to generate its IPv4-mapped IPv6 equivalent
2. Or enter an IPv4-mapped IPv6 address (e.g., ::ffff:192.168.1.1) to extract the original IPv4 address
3. View both the dotted decimal mapped form (::ffff:192.168.1.1) and the pure hex form (::ffff:c0a8:0101)
4. The tool validates the ::ffff:0:0/96 prefix and rejects malformed inputs

IPv4-Mapped IPv6 Conversion Examples

Mapped vs. Compatible Format

When to Use the IPv4-Mapped IPv6 Converter

• Interpreting application logs -- Node.js, Go, Python, and Java applications listening on IPv6 sockets log IPv4 client connections as ::ffff:10.0.0.5, and you need to extract the real IPv4 address
• Configuring dual-stack services -- translate IPv4 allowlists into mapped IPv6 format for services that only accept IPv6 address syntax
• Debugging socket APIs -- understand why getpeername() on an IPv6 socket returns ::ffff: prefixed addresses for IPv4 connections
• Firewall rule translation -- convert IPv4 rules to their IPv6 equivalents in dual-stack firewall configurations
• Incident response -- quickly extract IPv4 addresses from mapped format entries in security logs
• Log pipeline normalization -- strip the ::ffff: prefix to unify IPv4 addresses across log sources that use different formats

How IPv4-Mapped IPv6 Addresses Work

IPv4-mapped IPv6 addresses allow IPv6-only sockets to handle IPv4 traffic transparently. The operating system kernel maps incoming IPv4 connections into the IPv6 address space using a well-defined format.

Address Structure

The 128-bit mapped address consists of three parts:

|    80 bits of zeros    | 16 bits |    32 bits     |
|  0000...0000           |  ffff   |  IPv4 address  |
                         |         |                |
::                        ffff:     192.168.1.1

Full expanded form:
0000:0000:0000:0000:0000:ffff:c0a8:0101

The first 80 bits are zero. The next 16 bits are all ones (ffff). The final 32 bits contain the IPv4 address. This falls within the ::ffff:0:0/96 prefix.

Dual-Stack Socket Behavior

When an application creates an IPv6 socket with dual-stack enabled (the default on most operating systems), IPv4 connections are automatically presented in mapped format:

IPv4 client 10.0.0.5 connects to server port 8080
  -> Server's IPv6 socket sees: ::ffff:10.0.0.5

IPv6 client 2001:db8::1 connects to server port 8080
  -> Server's IPv6 socket sees: 2001:db8::1

This means application code only needs to handle IPv6 addresses, and the mapped format distinguishes IPv4 clients from native IPv6 clients.

Common Programming Contexts

Most modern languages expose IPv4-mapped addresses in their networking APIs:

• Node.js -- socket.remoteAddress returns ::ffff:192.168.1.1 for IPv4 connections
• Python -- socket.getpeername() on a dual-stack socket returns mapped format
• Go -- net.Conn.RemoteAddr() returns the mapped form; use net.IP.To4() to extract the IPv4 portion
• Java -- InetAddress.getByName() can parse mapped format; Inet6Address.isIPv4MappedIPv6Address() detects it

Platform Differences

Not all operating systems handle dual-stack sockets identically. On Linux, dual-stack is enabled by default (the IPV6_V6ONLY socket option is 0). On Windows, it is also enabled by default starting with Vista. On OpenBSD, dual-stack sockets are disabled for security reasons, requiring separate IPv4 and IPv6 sockets. Knowing your platform's behavior is essential when debugging mapped address issues.

Practical Tips for Handling Mapped Addresses

The most important thing to get right with mapped addresses is your log processing pipeline. If you have a web server logging ::ffff:10.0.0.5 and a reverse proxy logging 10.0.0.5 for the same client, your analytics will count them as two different visitors. Normalize early: strip the ::ffff: prefix as close to the ingestion point as possible, so that downstream systems work with consistent IPv4 representations. Most log processing tools and SIEM platforms have built-in functions for this, but you need to enable them explicitly.

The second common issue is allowlists and blocklists. If your application checks incoming addresses against an IPv4 allowlist like 10.0.0.0/24, but the socket presents the address as ::ffff:10.0.0.5, the string comparison fails. Your address-matching logic needs to handle both formats. In most languages, the standard library provides a method to detect and extract the IPv4 portion from a mapped address: Go has net.IP.To4(), Python has ipaddress.IPv6Address.ipv4_mapped, and Node.js developers often check for the ::ffff: prefix and strip it.

A subtler issue arises with geolocation and reputation databases. Most IP geolocation services expect plain IPv4 input. Sending ::ffff:10.0.0.5 to a geolocation API will either return no result or an error. Always extract the IPv4 address from the mapped format before making external lookups. Similarly, threat intelligence feeds use plain IPv4 addresses, so your correlation logic needs to normalize mapped addresses before comparison.

Frequently Asked Questions

Why does my Node.js server log IPv4 addresses as ::ffff:127.0.0.1?

Node.js listens on an IPv6 dual-stack socket by default. When an IPv4 client connects, the OS kernel maps the IPv4 address into IPv6 format using the ::ffff: prefix. The address ::ffff:127.0.0.1 is simply 127.0.0.1 presented in IPv6-mapped notation. Strip the ::ffff: prefix to get the original IPv4 address.

What is the difference between IPv4-mapped and IPv4-compatible addresses?

IPv4-mapped addresses use ::ffff: as a prefix (e.g., ::ffff:192.168.1.1) and are the current standard for representing IPv4 addresses in IPv6 sockets. IPv4-compatible addresses use only :: as a prefix (e.g., ::192.168.1.1) and were an early transition mechanism that has been deprecated by RFC 4291 since 2006.

Can I ping an IPv4-mapped IPv6 address?

On most systems, ping6 ::ffff:192.168.1.1 will not work as expected because ICMP handling of mapped addresses varies by OS. The mapped format is primarily used internally by dual-stack sockets and is not intended for direct use in commands or routing tables.

How do I disable dual-stack sockets if I do not want mapped addresses?

Set the IPV6_V6ONLY socket option to 1 before binding. This forces the socket to accept only IPv6 connections. You will then need a separate IPv4 socket to handle IPv4 clients. This approach is used on OpenBSD by default and is preferred in some security-sensitive environments.

Does the mapped address preserve the private/public classification of the original IPv4 address?

Yes. The mapping is purely a representation change. ::ffff:10.0.0.1 is still a private address, and ::ffff:8.8.8.8 is still public. The private/public classification depends entirely on the embedded IPv4 address. Use the IPv4 Private/Public Detector after extracting the IPv4 portion to confirm the classification.

Related Tools

• 6to4 Address Builder/Parser - Build or parse 6to4 tunnel addresses
• Address Family Detector - Detect if an address is IPv4, IPv6, or invalid
• IPv4 Private/Public Detector - Detect if IPv4 is private, public, or special
• IPv6 Expand ↔ Compress - Convert between expanded and compressed IPv6 notation
• IPv4 ↔ Hex Converter - Convert IPv4 addresses to/from hexadecimal
• Normalize Mixed Lists - Sort and clean mixed IPv4/IPv6 address lists