Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
28
the version field contained in the IP header of the packet. If the version field is four, the packet
should be processed up the IPv4 stack and if the version is six, the IPv6 stack should be used to
process the packet. Figure 1 illustrates the architecture and operation of a dual-stack
environment.
IPv6
Network
IPv6
Application
IPv6 Host
IPv4
Application
Dual Stack
Host
Key
Dual Stack
Switch
IPv4/IPv6
Router
IPv4
Network
IPv4 Host
IPv4 Traffic
IPv6 Traffic
IPv4/IPv6 Traffic
Figure 1. Dual-stack Architecture and Operation
Dual-stack methods were expanded in the research by Xie, Bi, and Wu (2007), who
proposed the site multi-homing by IPv6 intermediation (SHIM6) redundancy approach. SHIM6
allows hosts with multiple network cards to benefit from redundant network connections by
inserting a new layer between the network and transport layers to mitigate connectivity
problems. Xie, Bi, and Wu’s approach is to use SHIM6 with multiple transition mechanisms like
Tunnel-Brokers and 6to4 to ensure full and reliable connectivity with IPv4 and IPv6 hosts.
Dual-stack methods alone do not affect the IPv6 forensic processes for transitional
networks. In a properly configured environment, dual-stack nodes will send both native IPv6 and
IPv4 traffic and the routers, switches, and other network devices will act on these packets as
designed. The nature of native IPv4 and IPv6 traffic is well defined in the research and not a
subject for this study.