Teredo Packet Formats

This section describes the following:

■Teredo data packet format

■Teredo bubble packets

■Teredo indicators

Teredo Data Packet Format

Figure 14-4 shows the format of Teredo data packets defined in RFC 4380.

UDP

IPv4 Header IPv6 Header IPv6 Payload

Header

20 bytes 8 bytes 40 bytes n bytes

Figure 14-4 Teredo data packet format

A Teredo packet consists of the following:

■The IPv4 header contains the source and destination IPv4 addresses corresponding to the automatic tunnel endpoints and can be translated by a NAT.

■The UDP header contains source and destination UDP ports for Teredo traffic and can be translated by a NAT.

■The IPv6 header contains the source and destination IPv6 addresses, at least one of which is a Teredo address.

■The IPv6 payload contains zero or more IPv6 extension headers and the upper-layer protocol data unit (PDU) of the encapsulated IPv6 packet.

Teredo Bubble Packets

A Teredo bubble packet is typically sent to create or maintain a NAT mapping and consists of an IPv6 header with no IPv6 payload. Figure 14-5 shows the Teredo bubble packet.

UDP

IPv4 Header IPv6 Header

Header

20 bytes 8 bytes 40 bytes

Figure 14-5 Teredo bubble packet

In the IPv6 header, the Next Header field is set to 59, indicating that there is no payload present.

330 Understanding IPv6, Second Edition

Teredo Indicators

Teredo uses two different indicators defined in RFC 4380—the Authentication and Origin indicators—which are headers that are used to contain authentication or address and port information.

Authentication Indicator

The Authentication indicator is used to protect the exchange of Router Solicitation and Router Advertisement messages between a Teredo client and a Teredo server. Both the Teredo client and the Teredo server are configured with a secret key, which is used to construct the authentication data in the Authentication indicator. The Authentication indicator is placed between the UDP header and the IPv6 packet. If both the Origin and Authentication indicators are present in the Router Advertisement message, the Authentication indicator is placed before the Origin indicator.

Figure 14-6 shows the structure of the Authentication indicator.

Figure 14-6 Structure of the Authentication indicator

The Authentication indicator contains the following fields:

■Indicator Type This two-byte field specifies the type of indicator. For the Authentication indicator, it is set to 1. The Teredo client and the Teredo server can distinguish the Authentication indicator from the first two bytes of an IPv6 packet because the four highorder bits of an IPv6 packet are set to 0110 (6), which correspond to the Version field of the IPv6 header.

■Client ID Length This one-byte field indicates the length of the Client Identification field.

■Authentication Data Length This one-byte field indicates the length of the Authentication Value field.

■Client Identification This variable-length field contains an identification string for the Teredo client.

■Authentication Value This variable-length field contains the authentication value for this packet, calculated using the shared secret key.

■Nonce This eight-byte field contains a random number, which is used to provide proof of a live exchange of packets and to prevent packet replay attacks.

■Confirmation This one-byte field contains a value that indicates whether the Teredo client is using the correct secret key. In the Router Solicitation message, the Confirmation field is set to 0. In the Router Advertisement, the Confirmation field is set to either 0 if the secret key is correct or a non-zero value if it is not.

In Windows Server 2008, Windows Vista, Windows XP SP2, Windows XP SP1 with the Advanced Networking Pack for Windows XP, and Windows Server 2003 with Service Pack 1, Teredo does not use a client identifier or an authentication value, although the Authentication indicator is still present in the Router Advertisement and Router Solicitation messages. Figure 14-7 shows the format of the Authentication indicator when there is no client identifier or authentication value.

Figure 14-7 Structure of the Authentication indicator when there is no client identifier or authentication value

Origin Indicator

The Origin indicator is used to indicate a public IPv4 address and UDP port number of a Teredo client, Teredo relay, or Teredo host-specific relay. An example of its use is when a Teredo server sends a router advertisement message in response to a Teredo client’s router solicitation message. In this case, the Origin indicator contains the external (public) IPv4 address and UDP port number corresponding to the Teredo traffic of a Teredo client. For more information, see the “Initial Configuration for Teredo Clients” section in this chapter.

Like the Authentication indicator, the Origin indicator is placed between the UDP header and the IPv6 packet. Figure 14-8 shows the structure of the Origin indicator.

Indicator Type = 0

Obscured Origin Port Number

Obscured Origin Address

Figure 14-8 Structure of the Origin indicator