0
# Special Address Analysis
1

2
Advanced analysis of specialized address formats including Teredo tunneling and 6to4 transition mechanisms for IPv6 addresses.
3

4
## Capabilities
5

6
### Teredo Address Analysis
7

8
Teredo is an IPv6 transition mechanism that encapsulates IPv6 packets within IPv4 UDP datagrams. Teredo addresses contain embedded information about the Teredo server and client.
9

10
```typescript { .api }
11
/**
12
 * Analyze Teredo address properties and extract embedded information
13
 * Available on Address6 instances
14
 * @returns TeredoProperties object with detailed Teredo information
15
 */
16
inspectTeredo(): TeredoProperties;
17

18
interface TeredoProperties {
19
  prefix: string;           // Teredo prefix (normally "2001:0000")
20
  server4: string;          // IPv4 address of Teredo server
21
  client4: string;          // IPv4 address of Teredo client (obfuscated)
22
  flags: string;            // 16-bit flags in binary
23
  coneNat: boolean;         // True if behind cone NAT
24
  microsoft: {              // Microsoft-specific flags
25
    reserved: boolean;      // Reserved bit
26
    universalLocal: boolean; // Universal/Local flag
27
    groupIndividual: boolean; // Individual/Group flag
28
    nonce: string;          // 12-bit random nonce
29
  };
30
  udpPort: string;          // UDP port (obfuscated)
31
}
32
```
33

34
**Teredo Analysis Examples:**
35

36
```typescript
37
import { Address6 } from "ip-address";
38

39
// Example Teredo address
40
const teredoAddr = new Address6("2001:0:ce49:7601:e866:efff:62c3:fffe");
41

42
if (teredoAddr.isTeredo()) {
43
  const teredo = teredoAddr.inspectTeredo();
44
  
45
  console.log("Teredo Analysis:");
46
  console.log(`Prefix: ${teredo.prefix}`);           // "2001:0000"
47
  console.log(`Server IPv4: ${teredo.server4}`);     // "206.73.118.1"
48
  console.log(`Client IPv4: ${teredo.client4}`);     // "157.60.0.1"
49
  console.log(`UDP Port: ${teredo.udpPort}`);        // "40000"
50
  console.log(`Cone NAT: ${teredo.coneNat}`);        // true/false
51
  console.log(`Flags (binary): ${teredo.flags}`);    // 16-bit binary string
52
  
53
  // Microsoft-specific information
54
  console.log("Microsoft flags:");
55
  console.log(`  Reserved: ${teredo.microsoft.reserved}`);
56
  console.log(`  Universal/Local: ${teredo.microsoft.universalLocal}`);
57
  console.log(`  Group/Individual: ${teredo.microsoft.groupIndividual}`);
58
  console.log(`  Nonce: ${teredo.microsoft.nonce}`);
59
}
60

61
// Another Teredo example
62
const teredo2 = new Address6("2001:0:4137:9e76:8000:63bf:3fff:fdd2");
63
const info2 = teredo2.inspectTeredo();
64

65
console.log(`\nTeredo Server: ${info2.server4}`);    
66
console.log(`Teredo Client: ${info2.client4}`);      
67
console.log(`Behind Cone NAT: ${info2.coneNat}`);    
68
console.log(`Port: ${info2.udpPort}`);               
69
```
70

71
**Understanding Teredo Address Structure:**
72

73
```typescript
74
function explainTeredoStructure(teredoStr: string) {
75
  const addr = new Address6(teredoStr);
76
  
77
  if (!addr.isTeredo()) {
78
    console.log("Not a Teredo address");
79
    return;
80
  }
81
  
82
  const teredo = addr.inspectTeredo();
83
  
84
  console.log(`\nTeredo Address: ${addr.canonicalForm()}`);
85
  console.log("Structure breakdown:");
86
  console.log(`  Bits 0-31:   ${teredo.prefix} (Teredo prefix)`);
87
  console.log(`  Bits 32-63:  ${teredo.server4} (Server IPv4, embedded)`);
88
  console.log(`  Bits 64-79:  ${teredo.flags} (Flags)`);
89
  console.log(`  Bits 80-95:  Port ${teredo.udpPort} (obfuscated: inverted bits)`);
90
  console.log(`  Bits 96-127: ${teredo.client4} (Client IPv4, obfuscated: inverted bits)`);
91
  
92
  console.log("\nNAT and Microsoft Details:");
93
  console.log(`  Cone NAT detected: ${teredo.coneNat}`);
94
  if (teredo.microsoft.nonce !== "0") {
95
    console.log(`  Microsoft implementation detected`);
96
    console.log(`  Random nonce: ${teredo.microsoft.nonce}`);
97
  }
98
}
99

100
// Example usage
101
explainTeredoStructure("2001:0:ce49:7601:e866:efff:62c3:fffe");
102
```
103

104
### 6to4 Address Analysis
105

106
6to4 is an IPv6 transition mechanism that embeds IPv4 addresses within IPv6 addresses to enable communication between IPv6 islands over IPv4 infrastructure.
107

108
```typescript { .api }
109
/**
110
 * Analyze 6to4 address properties and extract embedded IPv4 information
111
 * Available on Address6 instances
112
 * @returns SixToFourProperties object with 6to4 information
113
 */
114
inspect6to4(): SixToFourProperties;
115

116
interface SixToFourProperties {
117
  prefix: string;     // 6to4 prefix (normally "2002")
118
  gateway: string;    // IPv4 address of 6to4 gateway
119
}
120
```
121

122
**6to4 Analysis Examples:**
123

124
```typescript
125
// Example 6to4 addresses
126
const sixToFour1 = new Address6("2002:c000:0204::"); // 192.0.2.4 embedded
127
const sixToFour2 = new Address6("2002:cb00:7101::"); // 203.0.113.1 embedded
128

129
if (sixToFour1.is6to4()) {
130
  const info1 = sixToFour1.inspect6to4();
131
  console.log("6to4 Analysis:");
132
  console.log(`Prefix: ${info1.prefix}`);          // "2002"
133
  console.log(`Gateway IPv4: ${info1.gateway}`);   // "192.0.2.4"
134
}
135

136
if (sixToFour2.is6to4()) {
137
  const info2 = sixToFour2.inspect6to4();
138
  console.log(`\n6to4 Gateway: ${info2.gateway}`);  // "203.0.113.1"
139
}
140

141
// Convert IPv4 to 6to4 format
142
function ipv4To6to4(ipv4Str: string): string {
143
  const ipv4 = new Address4(ipv4Str);
144
  const hex = ipv4.toHex().replace(/:/g, '');
145
  return `2002:${hex.substring(0,4)}:${hex.substring(4,8)}::`;
146
}
147

148
console.log(ipv4To6to4("192.0.2.4"));    // "2002:c000:0204::"
149
console.log(ipv4To6to4("203.0.113.1"));  // "2002:cb00:7101::"
150
```
151

152
**Understanding 6to4 Address Structure:**
153

154
```typescript
155
function explain6to4Structure(addr6to4Str: string) {
156
  const addr = new Address6(addr6to4Str);
157
  
158
  if (!addr.is6to4()) {
159
    console.log("Not a 6to4 address");
160
    return;
161
  }
162
  
163
  const info = addr.inspect6to4();
164
  
165
  console.log(`\n6to4 Address: ${addr.canonicalForm()}`);
166
  console.log("Structure breakdown:");
167
  console.log(`  Bits 0-15:   ${info.prefix} (6to4 prefix)`);
168
  console.log(`  Bits 16-47:  ${info.gateway} (Gateway IPv4, embedded in hex)`);
169
  console.log(`  Bits 48-127: Site-specific addressing`);
170
  
171
  // Show hex representation of embedded IPv4
172
  const ipv4 = new Address4(info.gateway);
173
  console.log(`  IPv4 as hex:  ${ipv4.toHex().replace(/:/g, '')}`);
174
}
175

176
// Example usage
177
explain6to4Structure("2002:c000:0204:1234::5678");
178
```
179

180
### URL Parsing with IPv6
181

182
Extract IPv6 addresses and ports from URLs, handling the bracket notation required for IPv6 in URLs.
183

184
```typescript { .api }
185
/**
186
 * Parse IPv6 address and port from URL string
187
 * Available as static method on Address6
188
 * @param url - URL containing IPv6 address in brackets
189
 * @returns Object with address and port properties, or error information
190
 */
191
static fromURL(url: string): {
192
  address: Address6;
193
  port: number | null;
194
} | {
195
  error: string;
196
  address: null;
197
  port: null;
198
};
199
```
200

201
**URL Parsing Examples:**
202

203
```typescript
204
// URLs with IPv6 addresses
205
const urls = [
206
  "http://[2001:db8::1]/",
207
  "https://[2001:db8::1]:8080/path",
208
  "http://[::ffff:192.168.1.1]:3000/api",
209
  "ftp://[2001:db8:1234::abcd]:21/files",
210
  "[2001:db8::1]:8080",  // Just address and port
211
  "2001:db8::1",         // Just address
212
];
213

214
urls.forEach(url => {
215
  console.log(`\nParsing: ${url}`);
216
  const result = Address6.fromURL(url);
217
  
218
  if ('error' in result) {
219
    console.log(`Error: ${result.error}`);
220
  } else {
221
    console.log(`Address: ${result.address.correctForm()}`);
222
    console.log(`Port: ${result.port || 'none'}`);
223
    
224
    // Additional analysis
225
    if (result.address.isTeredo()) {
226
      console.log("  -> Teredo address detected");
227
    }
228
    if (result.address.is6to4()) {
229
      console.log("  -> 6to4 address detected");
230
    }
231
    if (result.address.is4()) {
232
      console.log(`  -> Contains IPv4: ${result.address.address4?.correctForm()}`);
233
    }
234
  }
235
});
236
```
237

238
### Comprehensive Special Address Analysis
239

240
Combine multiple analysis techniques for complete specialized address evaluation.
241

242
```typescript
243
function analyzeSpecialAddress(addrStr: string) {
244
  try {
245
    const addr = new Address6(addrStr);
246
    
247
    console.log(`\n=== Analysis of ${addrStr} ===`);
248
    console.log(`Canonical form: ${addr.canonicalForm()}`);
249
    console.log(`Correct form: ${addr.correctForm()}`);
250
    console.log(`Type: ${addr.getType()}`);
251
    console.log(`Scope: ${addr.getScope()}`);
252
    
253
    // Check for special address types
254
    if (addr.isTeredo()) {
255
      console.log("\n🔍 TEREDO ANALYSIS:");
256
      const teredo = addr.inspectTeredo();
257
      console.log(`  Server: ${teredo.server4}`);
258
      console.log(`  Client: ${teredo.client4}`);
259
      console.log(`  Port: ${teredo.udpPort}`);
260
      console.log(`  Cone NAT: ${teredo.coneNat}`);
261
      console.log(`  Flags: ${teredo.flags}`);
262
      
263
      if (teredo.microsoft.nonce !== "0") {
264
        console.log(`  Microsoft nonce: ${teredo.microsoft.nonce}`);
265
      }
266
    }
267
    
268
    if (addr.is6to4()) {
269
      console.log("\n🔍 6TO4 ANALYSIS:");
270
      const sixToFour = addr.inspect6to4();
271
      console.log(`  Gateway: ${sixToFour.gateway}`);
272
      console.log(`  Prefix: ${sixToFour.prefix}`);
273
    }
274
    
275
    if (addr.is4()) {
276
      console.log("\n🔍 IPv4-IN-IPv6 ANALYSIS:");
277
      console.log(`  Embedded IPv4: ${addr.address4?.correctForm()}`);
278
      console.log(`  v4-in-v6 form: ${addr.to4in6()}`);
279
      
280
      // Check if we can create 6to4 from this
281
      const sixToFour = addr.to6to4();
282
      if (sixToFour) {
283
        console.log(`  Equivalent 6to4: ${sixToFour.correctForm()}`);
284
      }
285
    }
286
    
287
    // Microsoft transcription for all addresses
288
    console.log(`\nMicrosoft UNC: ${addr.microsoftTranscription()}`);
289
    
290
    // Reverse DNS
291
    console.log(`Reverse DNS: ${addr.reverseForm()}`);
292
    
293
  } catch (error) {
294
    console.log(`Error analyzing ${addrStr}: ${error.message}`);
295
  }
296
}
297

298
// Test various special addresses
299
const testAddresses = [
300
  "2001:0:ce49:7601:e866:efff:62c3:fffe",    // Teredo
301
  "2001:0:4137:9e76:8000:63bf:3fff:fdd2",    // Teredo with cone NAT
302
  "2002:c000:0204::",                        // 6to4
303
  "2002:cb00:7101:1234::5678",              // 6to4 with site addressing
304
  "::ffff:192.168.1.1",                     // IPv4-mapped
305
  "::192.168.1.1",                          // IPv4-compatible (deprecated)
306
  "2001:db8::1",                            // Regular global unicast
307
];
308

309
testAddresses.forEach(analyzeSpecialAddress);
310
```
311

312
### Practical Applications
313

314
Common use cases for special address analysis in networking applications.
315

316
**Network Monitoring:**
317

318
```typescript
319
function categorizeTraffic(addresses: string[]) {
320
  const categories = {
321
    teredo: [],
322
    sixToFour: [],
323
    ipv4Mapped: [],
324
    linkLocal: [],
325
    regular: []
326
  };
327
  
328
  addresses.forEach(addrStr => {
329
    try {
330
      const addr = new Address6(addrStr);
331
      
332
      if (addr.isTeredo()) {
333
        const teredo = addr.inspectTeredo();
334
        categories.teredo.push({
335
          address: addrStr,
336
          server: teredo.server4,
337
          client: teredo.client4
338
        });
339
      } else if (addr.is6to4()) {
340
        const info = addr.inspect6to4();
341
        categories.sixToFour.push({
342
          address: addrStr,
343
          gateway: info.gateway
344
        });
345
      } else if (addr.is4()) {
346
        categories.ipv4Mapped.push({
347
          address: addrStr,
348
          ipv4: addr.address4?.correctForm()
349
        });
350
      } else if (addr.isLinkLocal()) {
351
        categories.linkLocal.push(addrStr);
352
      } else {
353
        categories.regular.push(addrStr);
354
      }
355
    } catch (e) {
356
      // Skip invalid addresses
357
    }
358
  });
359
  
360
  return categories;
361
}
362
```
363

364
**Transition Mechanism Detection:**
365

366
```typescript
367
function detectTransitionMechanisms(logEntries: string[]) {
368
  const mechanisms = new Set();
369
  
370
  logEntries.forEach(entry => {
371
    // Extract IPv6 addresses from log entry (simplified)
372
    const ipv6Match = entry.match(/[0-9a-f:]+::[0-9a-f:]*/gi);
373
    
374
    if (ipv6Match) {
375
      ipv6Match.forEach(addrStr => {
376
        try {
377
          const addr = new Address6(addrStr);
378
          
379
          if (addr.isTeredo()) {
380
            mechanisms.add('Teredo');
381
          } else if (addr.is6to4()) {
382
            mechanisms.add('6to4');
383
          } else if (addr.is4()) {
384
            mechanisms.add('IPv4-in-IPv6');
385
          }
386
        } catch (e) {
387
          // Ignore parsing errors
388
        }
389
      });
390
    }
391
  });
392
  
393
  return Array.from(mechanisms);
394
}
395
```