Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

4. Translating from IPv4 to IPv6

When an IP/ICMP translator receives an IPv4 datagram addressed to a
destination towards the IPv6 domain, it translates the IPv4 header of
that packet into an IPv6 header. The original IPv4 header on the
packet is removed and replaced by an IPv6 header, and the transport
checksum is updated as needed, if that transport is supported by the
translator. The data portion of the packet is left unchanged. The
IP/ICMP translator then forwards the packet based on the IPv6
destination address.

+-------------+ +-------------+
| IPv4 | | IPv6 |
| Header | | Header |
+-------------+ +-------------+
| Transport- | | Fragment |
| Layer | ===> | Header |
| Header | | (if needed) |
+-------------+ +-------------+
| | | Transport- |
~ Data ~ | Layer |
| | | Header |
+-------------+ +-------------+
| |
~ Data ~
| |
+-------------+

Figure 2: IPv4-to-IPv6 Translation

Path MTU discovery is mandatory in IPv6, but it is optional in IPv4.
IPv6 routers never fragment a packet -- only the sender can do
fragmentation.

When an IPv4 node performs path MTU discovery (by setting the Don't
Fragment (DF) bit in the header), path MTU discovery can operate end-
to-end, i.e., across the translator. In this case, either IPv4 or
IPv6 routers (including the translator) might send back ICMP Packet
Too Big messages to the sender. When the IPv6 routers send these
ICMPv6 errors, they will pass through a translator that will





Li, et al. Standards Track [Page 6]


RFC 6145 IPv4/IPv6 Translation April 2011


translate the ICMPv6 error to a form that the IPv4 sender can
understand. As a result, an IPv6 Fragment Header is only included if
the IPv4 packet is already fragmented.

However, when the IPv4 sender does not set the DF bit, the translator
MUST ensure that the packet does not exceed the path MTU on the IPv6
side. This is done by fragmenting the IPv4 packet (with Fragment
Headers) so that it fits in 1280-byte IPv6 packets, since that is the
minimum IPv6 MTU. The IPv6 Fragment Header has been shown to cause
operational difficulties in practice due to limited firewall
fragmentation support, etc. In an environment where the network
owned/operated by the same entity that owns/operates the translator,
the translator MAY provide a configuration function for the network
administrator to adjust the threshold of the minimum IPv6 MTU to a
value that reflects the real value of the minimum IPv6 MTU in the
network (greater than 1280 bytes). This will help reduce the chance
of including the Fragment Header in the packets.

When the IPv4 sender does not set the DF bit, the translator SHOULD
always include an IPv6 Fragment Header to indicate that the sender
allows fragmentation. The translator MAY provide a configuration
function that allows the translator not to include the Fragment
Header for the non-fragmented IPv6 packets.