My understanding is that

tcp6 is used for connections over IPv6 & tcp is used for connections over IPv4.


::ffff: is representing IPv6 address which is mapped to IPv4 address.

But when I use netstat to find open connections on a port like netstat -anp | grep 31210

I get output as

tcp 0 0 ::ffff: ::ffff: ESTABLISHED 23755/java

Which means, IPv6 communication is done using tcp.

How is this possible?

  • 1
    TCP is the name of the protocol. tcp4 is often used as shorthand for TCP/IPv4, and tcp6 for TCP/IPv6, for TCP over IPv4 or v6, respectively. It's the underlying transport that differs. The raw binary format of the TCP header structure differs slightly between the two -- it has to, IPv4 having 32-bit and IPv6 128-bit addresses --, as does the method on how the checksum is calculated, but it's only a small implementation detail, and logically it is the same protocol. – Nominal Animal Dec 9 '16 at 5:51
  • @NominalAnimal: The TCP header itself is the same, no matter if you use TCP it with IPv4 or IPv6. The IP address is not part of the TCP header but of the IPv4/IPv6 header. But you are right in that the checksum calculation differs because the IP "pseudo" header used in calculation is different. – Steffen Ullrich Dec 9 '16 at 6:38
  • @SteffenUllrich: Quite true. I was trying to simplify things. (When using raw sockets, i.e. writing your datagrams from scratch, without the help of the OS/kernel used, there is no layer separation; the programmer must write both IPv4/IPv6 and TCP headers. With normal sockets, neither. I suspect this is also the reason why the Wikipedia article I linked to in my comment uses pseudo-header, without including the layer separation.) Would you care to sum it up as an answer? I tend to be too verbose myself. – Nominal Animal Dec 9 '16 at 6:40
  • (Also, I should have written "TCP packet header (on the wire)" instead of "TCP header structure" in my first comment, since the latter is, as rightly pointed out by Steffen Ullrich, completely incorrect. The packet is essentially a TCP packet enclosed in an IPv4 or IPv6 packet, with IP header fields being first, followed by the TCP headers. If you unwrap the IP part, and check the checksum, as the kernel does on receive, the TCP part is always the same regardless of transport. Userspace only sees the TCP payload, none of the headers.) – Nominal Animal Dec 9 '16 at 6:46
  • @NominalAnimal: These were just small details. The general idea is correct, i.e. that there is no such thing as TCP6 but only TCP with IPv4 or TCP with IPv6. That would be the answer I would expect to read here so please go on and add it as an answer. – Steffen Ullrich Dec 9 '16 at 6:52

TCP4 or TCP6 procotols don't exist. They can be used as a shorthand to indicate respectively TCP with IPv4 and TCP with IPv6, but that's an abuse of language -- the protocol used is always TCP.

Due to the separation of layers in the ISO/OSI model, the TCP segment (level 4) is always the same whether it's accompanying a IPv4 or IPv6 packet (level 3).

The only thing that changes in the TCP segment is the Checksum field, calculated according to RFC 793 for IPv4 and RFC 2460 for IPv6, since the size of an IP address differs between the two versions of the protocol. (I am not sure whether the Options field is used differently too.) However, it's still the same ol' TCP.

And yes, ::ffff: represents an IPv4 address (loopback in this case) mapped to a IPv6 address.

| improve this answer | |
  • So checksum used in case of ::ffff: will of tcp when IPv6 is used, right? – Batty Dec 9 '16 at 7:50
  • Sorry, can you clarify your question? – dr_ Dec 9 '16 at 8:11
  • 1
    Everything about ::ffff: is IPv4 except for the address representation. The packet structure is IPv4, including the checksum fields. – Johan Myréen Dec 9 '16 at 8:19
  • On a wild guess I'd say yes, but I might be wrong. Perhaps other commentators can better answer this question. – dr_ Dec 9 '16 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.