Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
125
Windows
Linux/BSD/UNIX
Run ipconfig
Run ifconfig
yes
Multiple address
yes
6to4 with
privacy extensions
Interface
has IPv4 Internet
connectivity
no
yes
Evaluate assigned
addreses
IPv6
address with
2002
prefix
no
IPv6
address with
FE8
prefix
yes
no
6to4
Link-local
Run whois query on
global IPv6 address
no
Other
IPv6 prefixs
yes
Dual-stack IPv6 or
another mechanism
no
IPv6 not Installed
on the interface
2001:0
prefix and
results indicate
IANA Reserved
Block
no
Result
indicates known
Tunnel-Broker
provider
yes
yes
Teredo
Tunnel-Broker
no
Evaluate Installed
programs
Tunnel-Broker
software created
interface
no
yes
Result = node
IPv4 address
no
yes
IPv6
address with
FE8
prefix
yes
ISATAP
Link-local
Convert last 4 octets
of IPv6 address to
decimal (IPv4 address)
no
Dual-stack or
another mechanism
Figure 8. IPv6 Transition Mechanism State Determination in Win, Linux, BSD, and UNIX
Network traces analysis.
Accurate network trace analysis depends on understanding if traffic has flowed through
an IPv6 transition mechanism. The proposed process flow methodology is illustrated in Figure 9.