- IPv6 Tutorial
- System Test
Tutorial: About IPv6
The way that your computer connects to the Internet impacts your options for performing forensic analysis. FotoForensics supports both IPv4 and IPv6 network connections.What is IPv6?
When you connect to a web site, such as "www.hackerfactor.com" or "http://fotoforensics.com", your computer resolves the hostname (www.hackerfactor.com or fotoforensics.com) into a machine-readable network address. This network address permits routing network traffic between computers on the Internet.Your network address has a similar function as your postal mailing address or phone number. It is enough information for someone to contact you, and for you to contact someone else. On the Internet, the network address permits you to connect to a web service and it allows the online service to return results to your web browser.
There are two types of network addresses. The first is called "IPv4" (or sometimes just "IP"). It is the 4th version of the Internet protocol (IP v4). These network addresses consist of four byte sequences, typically written as four dotted values. For example, "192.168.1.3" or "172.20.45.107". These numbers may not mean much to a human, but they tell machines how to route the network traffic.
IPv6 network addresses use 16 byte sequences, typically written as sets of hexadecimal values separated by colons (e.g., 2607:fa88:1000:5::f21a:5441). In general, IPv6 addresses serve the same purpose as IPv4 addresses, but they permit a larger number of network addresses.
IPv4 Exhaustion
With IPv4, there are about 420 million network addresses. This may sound like a lot, but it really is not compared to the number of machines online. Back in 1992, the Internet architects realized that we would one day run out of network addresses. They finally settled on a new protocol: IPv6 (version 6). With IPv6, there are about 3×1038 network addresses -- enough to assign multiple addresses to every atom on planet Earth.
Network addresses are handed out upon request by the Internet Assigned Numbers Authority (IANA). IANA distributes ranges of network addresses to regional providers, and those regional providers issue subsets of network addresses to companies that want to be online. In January 2011, IANA ran out of IPv4 network addresses. The first regional provider, APNIC for the Asia-Pacific region, ran out of IPv4 addresses a few months later. The final regional provider, ARIN (for North America) ran out in July 2015.
Without any additional IPv4 addresses available, everyone is migrating to IPv6.
With IPv4, there are about 420 million network addresses. This may sound like a lot, but it really is not compared to the number of machines online. Back in 1992, the Internet architects realized that we would one day run out of network addresses. They finally settled on a new protocol: IPv6 (version 6). With IPv6, there are about 3×1038 network addresses -- enough to assign multiple addresses to every atom on planet Earth.
Network addresses are handed out upon request by the Internet Assigned Numbers Authority (IANA). IANA distributes ranges of network addresses to regional providers, and those regional providers issue subsets of network addresses to companies that want to be online. In January 2011, IANA ran out of IPv4 network addresses. The first regional provider, APNIC for the Asia-Pacific region, ran out of IPv4 addresses a few months later. The final regional provider, ARIN (for North America) ran out in July 2015.
Without any additional IPv4 addresses available, everyone is migrating to IPv6.
Dual Stacks
IPv4 and IPv6 are incompatible addressing protocols. Many computers only support IPv4. Currently, few systems only support IPv6. Systems that support both IPv4 and IPv6 are called "dual stack". Having dual stacks means that your computer can easily migrate from IPv4 to IPv6, and it can communicate using both network protocols. (A dual stacked computer is bilingual in both internet protocols.)Even if your personal computer is dual stacked, your ISP may only support IPv4. In addition, many online services only support IPv4; they have not yet migrated to IPv6. So even if your computer can support IPv6, it may not be configured to use IPv6 and may not be able to communicate over IPv6.
Fortunately, there are a variety of cross-over protocols, such as 6to4, 4to6, 6in4, 4in6, 6over4, 4over6, and Teredo. (Yes, each of these cross-over protocols really exists.) You need to be fairly technical in order to configure these, but there are plenty of tutorials available online.
IPv6 Benefits
Beyond more network addresses, IPv6 has additional benefits over IPv4. Regular users will notice that it is a faster protocol. (For a technical explanation: the IPv6 header is much simpler than IPv4, resulting in faster processing at each router.) IPv6 also provides better peer-to-peer and multicast connectivity for online video conferencing, and more quality-of-service options for better network performance.However, IPv6 is different than IPv4. This difference makes configuration for online services more complicated. Because it can be difficult to convert an online service to IPv6, many online service providers have either not migrated or not fully deployed IPv6 support.
Alternatives to IPv6
Although there are many different network routing schemes, most are not widely supported. Currently, IPv4 is universally supported, while IPv6 is growing in popularity. However, with supply of IPv4 network addresses exhausted, there are only a few options remaining.
Although there are many different network routing schemes, most are not widely supported. Currently, IPv4 is universally supported, while IPv6 is growing in popularity. However, with supply of IPv4 network addresses exhausted, there are only a few options remaining.
- NAT. Network Address Translation (NAT) permits multiple computers to share a single IPv4 network address. If you have a home router that supports multiple internet-enabled devices (computers, tablets, smartphones, etc.), then you are likely using NAT. NAT is great for permitting a small number of devices to share the same external network address. However, it does not work well with bidirectional network connectivity, and it does not scale well beyond a few hundred systems.
- CGN. Carrier Grade NAT is used by some service providers to route thousands of systems through a small number of IPv4 network addresses. (CGN is like NAT, only larger.) Some ISPs have switched to CGN as a way to prolong IPv4 address availability.
- DS-Lite, 4rd, 4in6, etc. Some ISPs are only allocating IPv6 network addresses to consumer devices. For IPv4 connectivity, they provide a tunneling solution. This limited tunneling permits systems to directly access the internet over IPv6, but uses NAT/CGN for IPv4-only traffic. Unlike NAT and CGN, which delay IPv6 adoption, protocols like DS-Lite, 4rd, and 4in6 provide direct migration options as more systems move to IPv6.
Impact on Forensics
FotoForensics provides tools for evaluating digital pictures. However, during a forensic examination, an analyst may require the use of additional tools that are not provided by FotoForensics. For example, an investigation may require a search engine to find facts related to a picture, a reverse image search to find other instances of the image online, and access to various social forums and file sharing sites. | IPv4-only. If your computer only supports IPv4, then you should be good for now. However, more and more sites are converting to IPv6. An IPv4-only computer is unable to access any IPv6-only services. (Fortunately, there are very few IPv6-only services right now.) |
 | IPv6-only. If your computer only supports IPv6, then you will be unable to use any IPv4-only web services. For example, the DuckDuckGo multi-search engine, Internet Archive, Imgur, USA Today, and thousands of other sites are only available on IPv4. |
By not supporting both IPv4 and IPv6, a forensic examiner limits the number of online tools and services that are accessible.
System Test
FotoForensics fully supports both IPv4 and IPv6. This dual stack support permits analysts all over the world to evaluate pictures online, without going through the hassle of using any kind of IPv4-to-IPv6 translation.In order to better understand our users' needs, FotoForensics is currently collecting metrics regarding IPv6 connectivity. At the bottom of every web page is a little icon. The icon's color is determined by your network connectivity.
This icon represents your current network connectivity:  | |
 | A gray icon that appears after 20-30 seconds indicates that you have IPv4-only connectivity with a misconfigured IPv6 network connection. This is a common problem with Microsoft Windows. |
| A red icon indicates that you have IPv4-only connectivity. If your icon looks like this, then you should talk to your ISP about enabling IPv6 support. |
| A blue icon indicates that you have IPv6-only connectivity. While you can access FotoForensics and other IPv6 services, you cannot access IPv4-only web sites that may be useful for forensic analysis. |
 | A purple icon indicates that you have both IPv4 and IPv6 connectivity, but your system prefers IPv4 addresses. You can access every online web site. However, because your system prefers to use IPv4, you will not experience any of IPv6's benefits when you access dual stacked online services (i.e., most of the Internet). |
 | A green icon indicates that you have both IPv4 and IPv6 connectivity. You can access every online web site. When accessing a dual stacked online service, your system will use IPv6, giving you the maximum benefits. |
Network Timeouts
When both the web client and web server support IPv4 and IPv6, the preference is typically to try IPv6 first, and then fall-back to IPv4 if the site is unavailable. Unfortunately, not every system has IPv6 configured properly. For example, the computer may have IPv6 enabled, but the IPv6 network may not have connectivity.
- If your computer only has IPv4, then you will immediately see a red icon at the bottom of the page.
- If your computer has both IPv4 and IPv6 configured properly, then you will immediately see a purple or green icon, depending on whether your computer prefers to use IPv4 or IPv6.
- If your computer is configured for both IPv4 and IPv6, but the IPv6 is misconfigured, then your system will timeout. This is represented as a gray icon.
Windows Network Timeouts
On Windows (Vista, 7, 8, 8.1, and 10), Microsoft automatically enables a virtual IPv6 tunnel if the computer is only configured for IPv4. This tunnel is intended to give IPv4-only computers access to IPv6 network addresses. However, Microsoft never checks to see if the tunnel works. Moreover, Microsoft disabled this service in 2014, so the virtual IPv6 tunnel is guaranteed to no longer work.At FotoForensics, the IPv6 test forces the use of an IPv6 network connection and then falls back to IPv4 if the IPv6 network is unavailable. If your computer only has IPv4, then the fall-back happens immediately. However, on Windows systems with Microsoft's default virtual IPv6 tunnel, the timeout can take 20 seconds or longer.
For a technical explanation: The Windows IPv6 tunnel uses a protocol called Teredo, which routes IPv6 packets over IPv4 and through a remote proxy server. In 2014, Microsoft decided to deactivate their Teredo proxy server. (Reference: IETF88 Proceedings, slide 8) This causes every browser on Windows to timeout on the IPv6 request before falling back to an IPv4 request. This problem impacts every web site you visit that uses both IPv4 and IPv6; this problem is not specific to FotoForensics.
NOTE: In 2016, Microsoft re-enabled their IPv6 tunnel for Windows 10 systems, but not for other versions of Windows. However, many OEM installations (e.g., Dell's pre-installed Windows 10) still use the obsolete Teredo tunnel configuration. By 2019, Teredo was effectively turned off for good.
If your Windows computer displays a gray icon
at the bottom of the page after 20-30 seconds, then you have a misconfigured IPv6 network courtesy of Microsoft. There are a few options:
- Live with it. Without any changes, your network connections may be slower and the boot time for your Windows system may take a few seconds longer, but all dual-stack web sites will eventually fall-back to IPv4 and load properly.
- Fix the IPv6 tunnel. Correcting the misconfiguration will likely require modifying your home or office network configuration and firewall. This is not trivial and will require assistance from a network administator.
- Disable the IPv6 tunnel. If the tunnel is disabled, then Windows will strictly use IPv4 (as opposed to failing with IPv6 and then using IPv4). In order to disable IPv6, you will need to run C:\Windows\System32\cmd.exe as the Administrator, and then run the command:
netsh interface teredo set state disabled
The command should respond with "Ok." At that point, all web sites should appear faster since IPv6 timeouts are no longer an issue. (You'll notice this speed improvement when accessing common sites like Google and Facebook.)
At any time you can re-enable the IPv6 network tunnel by running the command:
netsh interface teredo set state type=default
Keep in mind: if you have not fixed your network configuration, then re-enabling the default IPv6 tunnel will still cause pages to hang while the IPv6 tunnel times out. - Reinstall. Upgrading your older Windows system (7, 8, 8.1, etc.) to a modern version of Windows (10 or later) will not fix the problem. However, reinstalling a modern version of Windows from scratch will resolve the issue.
Copyright 2012-2024 Hacker Factor, All Rights Reserved.System Status • Blog • FAQ • Contact