Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
29
Tunneling.
Tunneling involves creating a temporary virtual path between two endpoints for the
purpose of exchanging data. The research by Hsieh and Kao (2005), Jamhour and Storoz (2002),
and Tantayakul, et al. (2008) illustrated the use of tunneling as an IPv6 transition mechanism.
IPv6 tunnels utilize an existing IPv4 infrastructure and encapsulate or decapsulate IPv4 and IPv6
packets between two endpoints. These endpoints can be either a host or a router; however, Yange,
et al. (2009) pointed out that both endpoints must have implemented the same type of tunnel.
The typography and types of tunnels for IPv6 transition are discussed by Gilligan and
Nordmark (2000). Tunnels can be created between a router and host, host and router, host and
host, or router and host. Additionally, Gilligan and Nordmark classified tunnels as either
configured, semi-automatic, or automatic. Configured tunnels require prior setup to function and
require the tunnel creator to specify the tunnel endpoint. Semi-automatic tunnels, like Tunnel-
Brokers, require prior configuration but, operate independently after they are configured by the
user. Automatic tunnels, like 6to4, ISATAP, and Teredo operate transparently and require little
interaction from the user to configure the tunnel.
Gilligan and Nordmark (2000) outlined the encapsulation and decapsulation process.
During this process, the sending node encapsulates the IPv6 packet inside of an IPv4 header and
sends the frame to the tunnel endpoint while fragmenting and maintaining the connection state if
necessary. The tunnel endpoint decapsulates the packet by removing the IPv4 header and sending
the packet through the IPv6 network. Encapsulated packets are identified by observing the
protocol number 41 in the IP header protocol field. Gilligan and Nordmark recommended that
packets bearing invalid source IPv4 or IPv6 addresses should be discarded and that virtual
interfaces used by tunnels should be link-local addresses with the address scheme of