Six Months, Six Providers and IPv6

  • by

Six Months, Six Providers and IPv6 | Arbor Networks
by Craig Labovitz

This winter, the Internet passed a major milestone in its twenty-year-old wunderkind evolution from a small, experimental research network to one of the technical foundations of modern society. In a brief Miami hotel conference room ceremony, ICANN allocated the last five IPv4 address blocks on February 3 — the long anticipated endgame towards eventual Internet address space exhaustion was officially underway [1].

The increasing scarcity of IPv4 address space has motivated renewed interest in IPv6. With billions and billions of possible addresses, IPv6 provides a long-term evolutionary path for the Internet, including the anticipated “Internet of Things” [2,3]. Unfortunately, the IPv6 migration effort has largely been unsuccessful to date [4,5].

Despite fifteen years of IPv6 standards development, vendor releases and advocacy, only a small fraction of the Internet has adopted IPv6. The slow rate of IPv6 adoption stems from equal parts of technical / design hurdles, lack of economic incentives and general dearth of IPv6 content. In response to these IPv6 challenges, an Internet wide consortium of major carriers, vendors and content provider has planned a “World IPv6 Day” [6]. On June 8, 2011 the consortium will conduct the “first global-scale trial” of IPv6 with major content players including Google, Akamai and Limelight enabling native v6 on their servers. A major goal of World IPv6 day is the collection of Internet-wide IPv6 measurements and identifying major v6 connectivity and performance problems. This report continues our efforts to develop a baseline of global IPv6 adoption ahead of World IPv6 Day.

Accurate metrics around IPv6 adoption remain a significant challenge for the industry. Given the relative lack of v6 monitoring capabilities deployed in most backbones, studies to date have generally focused on secondary indicators of IPv6 traffic, including DNS queries, IPv6 registry allocations and BGP announcements [5]. Similarly, we explored estimates of global IPv6 adoption using NetFlow analysis of tunneled IPv6 traffic in a 2007 technical report [4].

Our 2007 findings of only trace levels of IPv6 traffic in the Internet generated some level of controversy. Most notably, reviewers argued that our study ignored native IPv6 traffic, only included a subset of Teredo traffic, and thus, significantly underestimated Internet v6 traffic.

This report revisits our 2007 work with one of the first studies of native IPv6 traffic volumes across multiple large carriers. Beginning in late summer of 2010, a small subset of ATLAS deployments both upgraded their backbone infrastructure (routers and monitoring appliances) and enabled V9 Flow export across the majority of their network. The report analyzes native v6 traffic across six of these large providers in North America and Europe over the last six months. In all, we analyzed aggregate inter-domain traffic volumes of more than 8 terabits per second and a total of more than 10 exabytes over the life of the study. More information our measurement methodology is available in our recent Internet traffic academic research paper [7].


During the six month study period, IPv4 inter-domain traffic grew by an average of 40-60%. In marked contrast, IPv6 (both native and tunneled) decreased by an average 12%, though the small volumes of native IPv6 more than doubled.

Before examining native IPv6 growth trends, we first revisit tunneled IPv6 traffic observations from the 110 diverse ATLAS participating providers around the world. The graph shows tunneled IPv6 as a weighted average percent of all inter-domain traffic between July 2007 and February 2011. Given the global media attention and growing availability of IPv6 content, the decline of tunneled IPv6 traffic percentages is unexpected. After peaking at 0.04% of all Internet traffic in August 2010, tunneled v6 declined significantly through February 2011. Possible explanations for this percentage decline in migration of tunneled IPv6 to native traffic and more efficient deployment of tunnels and encapsulation technology.

Figure 1 IPv6 tunneled traffic as a weighted average percentage of all Internet inter-domain traffic across 110 participating ATLAS providers. Includes both Teredo and 6to4.

The next two graphs focus on IPv6 traffic in the six providers which enjoy native IPv6 traffic telemetry capabilities. The first graph shows IPv6 as an average percentage of all inter-domain traffic in these six providers. Given the small sample size and time period, the dataset is fairly noisy. Overall, aggregate v6 volumes remained mostly constant over the study period between 0.1 and 0.2 percent of Internet traffic. This range corresponds with Google and AMS-IX The second graph shows native IPv6 traffic as a percentage of all inter-domain IPv6 traffic in the six providers. On average, native IPv6 grew by ten percentage points suggesting provider infrastructure and end users continue converting tunneled traffic to native v6 infrastructure.

Figure 2 IPv6 native and tunneled traffic as a percentage of all inter-domain traffic in six participating ATLAS providers.

Figure 3 Native IPv6 traffic as a percentage of all IPv6 inter-domain traffic in six participating ATLAS providers.

We look at the top IPv6 applications the six participating ATLAS deployments with native IPv6 telemetry. Figure 4 shows the top applications as an average percentage of all IPv6 traffic (both native and tunneled) in each deployment. Not surprisingly, P2P continues to dominate at more than 60% of all IPv6 traffic [8]. Note that our analysis primarily used well-known port numbers. Unlike IPv4 P2P, the data suggests most IPv6 P2P application makes little effort to encrypt or use randomized ports. This IPv6 P2P behavior may correspond to the relative lack of IPv6 capable firewall and traffic management solutions. At a distant second and third, Web and SSH both average 4.6% of IPv6 traffic.

As a point of comparison, our ongoing analysis of IPv4 application traffic finds video (Netflix, YouTube, Flash) at a combined 40% and P2P representing only 8% of IPv4. We show data from payload analysis of traffic in a small number of collaborating networks in Figure 5.

We validated both IPv4 and IPv6 application these port based application distributions with a payload based classification of traffic in a two large consumer providers which exhibited similar distributions.

Figure 4 Top IPv6 applications based on TCP / UDP port groups in six cooperating ATLAS providers. Limited data validation based on a payload based classification of applications in one provider.

Figure 5 Top IPv4 applications based on payload analysis in a small number of North American consumer providers.

Finally, we analyzed the number and distribution of traffic across IPv6 tunnel end-points. Over a 24 hour period in February, we observed more than 250,000 distinct tunnel end points in the 110 ATLAS participants, including thousands of unique tunnels in the six providers with native IPv6 offerings. The dataset included the maximum five minute traffic rate observed for every tunnel end-point pair for each day. We note that the commercial data collection appliances used in this study only monitor a limited number of tunnels so the actual number of active tunnels was likely significantly higher.

The 250,000 IPv6 tunnel end points exhibit an extremely heavy tailed traffic distribution. The top five tunnel end points contribute more than 90% of all tunneled IPv6 traffic. These top end points include the Anycast address ( followed by Hurricane Electric tunnel broker ranges and Microsoft’s Teredo (


The upcoming “World IPv6 Day” marks a major milestone in the Internet’s evolution. With IPv4 free IANA blocks now exhausted, the next twenty years of the Internet requires new technologies to accommodate the upcoming billions of new devices and Internet services.

In a remarkable, first of a kind global experiment, providers around the world will enable IPv6 by default on most of the major popular Internet web sites this June 8th. Previously, large content providers generally proved reluctant to enable v6 by default over concerns of poor performance and disruptions to customer traffic. In short, content providers feared that unilaterally enabling v6 put their web sites at a competitive disadvantage.

World v6 Day represents the first global experiment in new Internet technologies. What will happen on v6 day? Will the flood of IPv6 traffic result in network failures? Will operators and vendors discover critical bugs in network infrastructure? As an industry, we’re not sure -– that is why this V6 day experiment is so crucial.

Vendors and providers have spent years updating technology and testing IPv6 to ensure June 8th will go seamlessly. If all goes well, the vast majority of users will spend the day unaware of this global Internet infrastructure experiment. Arbor is proud to play a role in supporting the measurement and analysis of the World V6 Day experiment.

End Notes

[1] Stephen Lawson, “ICANN assigns its last IPv4 addresses”. Network World. February 3, 2011.

[2] Wikipedia, “Internet of Things”. Retrieved March 1, 2011.

[3] Also see XKCD for a more cautionary analysis of IPv6 address possibilities at

[4] Craig Labovitz, “The End is Near, but is IPv6?”. Arbor Networks Blog Post. August 18, 2008.

[5] Elliott Karpilovsky, Alexandre Gerber, Dan Pei, Jennifer Rexford, and Aman Shaikh, “Quantifying the extent of IPv6 deployment,” in Proc. Passive and Active Measurement Conference, April 2009.

[6] ISOC Press Release, “Major Websites Commit to 24-Hour Test Flight for IPv6″. January 12, 2011.

[7] Craig Labovitz, Scott Iekel-Johnson, Danny McPherson, Jon Oberheide, and Farnam Jahanian, “Internet Inter-Domain Traffic”. Proceedings of ACM SIGCOMM 2010, New Delhi. August, 2010.

[8] Craig Labovitz, “Who Put the IPv6 in My Internet”. Arbor Networks Blog Post, September 8, 2009.

[9] Lorenzo Colitti, Steinar H. Gunderson, Erik Kline, Tiziana Refice, “IPv6 Adoption in the Internet”, PAM 2010.

[10] Amsterdam Internet Exchange web site. Retrieved March 4, 2010.