Home › Docs › What is DS-Lite (Dual-Stack Lite)?

What is DS-Lite (Dual-Stack Lite)?

Table of Contents

Introduction: Solving IPv4 Exhaustion with IPv6 Infrastructure

Dual-Stack Lite (DS-Lite) is an IPv6 transition technology designed to solve a critical problem facing Internet Service Providers: how to provide IPv4 connectivity to customers when IPv4 addresses have been exhausted, while simultaneously deploying IPv6 infrastructure.

Standardized in RFC 6333 (August 2011), DS-Lite enables ISPs to operate an IPv6-only core network while still delivering IPv4 services to subscribers. This hybrid approach allows providers to:

The technology has been widely deployed by ISPs worldwide, particularly in regions where IPv4 address exhaustion hit hardest and where greenfield fiber deployments made IPv6-only infrastructure attractive.

DS-Lite Architecture Overview

DS-Lite consists of two fundamental components working together to bridge IPv4 applications over an IPv6 network:

┌─────────────────────────────────────────────────────────────────────┐
│                        DS-Lite Architecture                         │
└─────────────────────────────────────────────────────────────────────┘

   Customer Network              ISP Network                Internet

┌──────────────┐           ┌──────────────────┐        ┌──────────┐
│   End User   │           │   IPv6-Only      │        │  IPv4    │
│   Devices    │           │   Core Network   │        │ Internet │
│              │           │                  │        │          │
│  ┌────────┐  │           │                  │        │          │
│  │ IPv4   │  │           │                  │        │          │
│  │ App    │  │  IPv4     │    IPv4-in-IPv6  │  IPv4  │          │
│  └───┬────┘  │ Packet    │      Tunnel      │ Packet │          │
│      │       │   │        │        │         │   │    │          │
│  ┌───▼────┐  │   │        │    ┌───▼─────┐  │   │    │          │
│  │   B4   │──┼───┴────────┼───▶│  AFTR   │──┼───┴───▶│          │
│  │Element │  │            │    │ (CGN +  │  │        │          │
│  │  (CPE) │  │◀───────────┼────│Tunnel   │◀─┼────────│          │
│  └────────┘  │            │    │Endpoint)│  │        │          │
│              │            │    └─────────┘  │        │          │
└──────────────┘           └──────────────────┘        └──────────┘
   Private IPv4              Native IPv6              Public IPv4
   RFC 1918                 2001:db8::/32           Shared via NAT

Component Overview

  1. B4 (Basic Bridging BroadBand) Element

    • Located at the customer premises (CPE/router)
    • Encapsulates IPv4 packets into IPv6
    • Creates the client side of the IPv4-in-IPv6 tunnel
    • Receives IPv6 connectivity from the ISP

  2. AFTR (Address Family Transition Router)

    • Located in the ISP's network core
    • Terminates IPv4-in-IPv6 tunnels from multiple B4 elements
    • Performs carrier-grade NAT44 (CGNAT)
    • Routes IPv4 traffic to/from the public Internet
    • Shared by hundreds or thousands of subscribers

  3. IPv6-Only Access Network

    • No IPv4 addressing required between customer and AFTR
    • Simplified infrastructure (single protocol stack)
    • All transport uses native IPv6

How DS-Lite Works: IPv4-in-IPv6 Tunneling

DS-Lite's core mechanism is IPv4-in-IPv6 encapsulation, allowing IPv4 packets to traverse an IPv6-only network without modification.

Packet Flow: Outbound (Customer to Internet)

Step 1: IPv4 Application to B4

Original IPv4 Packet:
┌────────────────────────────────────────┐
│ IPv4 Header                            │
│ Source: 192.168.1.100 (private)        │
│ Dest:   93.184.216.34 (example.com)    │
├────────────────────────────────────────┤
│ TCP/UDP Data (HTTP request, etc.)      │
└────────────────────────────────────────┘

Step 2: B4 Encapsulates in IPv6

Encapsulated Packet:
┌────────────────────────────────────────┐
│ IPv6 Header                            │
│ Source: 2001:db8:1234::1 (B4 address)  │
│ Dest:   2001:db8:aftr::1 (AFTR addr)   │
│ Next Header: 4 (IPv4)                  │
├────────────────────────────────────────┤
│ ┌────────────────────────────────────┐ │
│ │ IPv4 Header (original)             │ │
│ │ Source: 192.168.1.100              │ │
│ │ Dest:   93.184.216.34              │ │
│ ├────────────────────────────────────┤ │
│ │ TCP/UDP Data                       │ │
│ └────────────────────────────────────┘ │
└────────────────────────────────────────┘

Step 3: IPv6 Network Transport

The packet travels through the ISP's IPv6-only network using standard IPv6 routing. No IPv4 infrastructure is required in the access or core network.

Step 4: AFTR Decapsulates and NATs

AFTR Processing:
1. Receives IPv6 packet
2. Extracts inner IPv4 packet
3. Performs NAT44 translation:
   - Source: 192.168.1.100 → 203.0.113.5:12345 (public IP:port)
   - Dest:   93.184.216.34 (unchanged)
4. Forwards to IPv4 Internet

Step 5: Internet Response

Return traffic follows the reverse path:

  1. Internet responds to 203.0.113.5:12345
  2. AFTR translates back to tunnel endpoint
  3. AFTR encapsulates in IPv6 to B4's IPv6 address
  4. B4 decapsulates and delivers to 192.168.1.100

Tunneling Protocol Details

DS-Lite uses IPv4-in-IPv6 encapsulation as specified in RFC 2473 and RFC 4213:

The AFTR: Address Family Transition Router

The AFTR is the cornerstone of DS-Lite architecture, combining two critical functions in a single device.

AFTR Functions

1. IPv4-in-IPv6 Tunnel Endpoint

2. Carrier-Grade NAT44 (CGNAT)

For more information on CGNAT limitations and challenges, see IPv6 Behind CGNAT.

AFTR Deployment Considerations

Capacity Planning:

Redundancy:

Address Assignment:

IPv4 Address Pool:

The B4 Element: Basic Bridging BroadBand

The B4 element resides in the customer premises equipment (CPE) and handles the customer-side tunnel operations.

B4 Functions

1. Tunnel Client

2. IPv6 Addressing

3. Customer Network Gateway

B4 Discovery Process

When a CPE with B4 capability connects to the network:

1. CPE connects to ISP network
2. Performs IPv6 autoconfiguration (SLAAC or DHCPv6)
3. Requests DHCPv6 Option 64 (AFTR-Name)
4. Resolves AFTR name to IPv6 address via DNS (AAAA record)
5. Establishes IPv4-in-IPv6 tunnel to AFTR
6. Begins forwarding customer IPv4 traffic through tunnel

B4 Implementation

B4 functionality can be implemented in:

ISP Use Cases: IPv4 Address Conservation

DS-Lite solves several critical problems for ISPs facing IPv4 address exhaustion.

Problem: IPv4 Address Scarcity

By 2025, IPv4 addresses have become a scarce commodity:

DS-Lite Solution: Massive Address Sharing

Instead of allocating one public IPv4 address per subscriber, DS-Lite enables:

Traditional ISP Model (Dual-Stack):

10,000 subscribers = 10,000 public IPv4 addresses needed
Cost at $50/IP = $500,000 in IPv4 address acquisition

DS-Lite Model:

10,000 subscribers sharing 50-200 IPv4 addresses at AFTR
Address sharing ratio: 50-200 subscribers per IP
Cost at $50/IP = $2,500 - $10,000
Savings: $490,000 - $497,500 (98-99% reduction)

Additional ISP Benefits

1. IPv6-Native Infrastructure

2. Centralized IPv4 Management

3. Greenfield Deployment Advantage

4. Gradual IPv4 Phase-Out

Real-World Deployment Examples

DS-Lite has been deployed by major ISPs worldwide, particularly in Europe and Asia where IPv4 exhaustion hit earliest.

Europe

France:

Germany:

Netherlands:

Asia

Japan:

China:

North America

Key Success Factors

Deployments succeeded when ISPs:

  1. Provided compatible CPE: Updated firmware or supplied DS-Lite-capable routers
  2. Communicated clearly: Explained limitations to customers (port forwarding, etc.)
  3. Offered alternatives: Native dual-stack for users requiring full IPv4
  4. Provided fallback: IPv4-only service for incompatible equipment

Advantages of DS-Lite

DS-Lite offers several compelling advantages over alternative transition technologies.

1. IPv6-Native Core Network

Benefit: Eliminates dual-stack complexity in ISP infrastructure

2. Massive IPv4 Address Conservation

Benefit: 50-200 subscribers share a single public IPv4 address

3. Avoids NAT444 Problems

Benefit: Single NAT layer instead of double NAT

Unlike NAT444 (CGNAT with customer CPE NAT), DS-Lite:

4. Cleaner Than Dual-Stack with CGNAT

Comparison with Dual-Stack + CGNAT:

Aspect DS-Lite Dual-Stack + CGNAT
Core Network IPv6-only Dual-stack required
Access Network IPv6-only Dual-stack required
IPv4 to Customer Via tunnel Native
NAT Layers 1 (AFTR only) 1-2 (CGNAT + optional CPE)
Infrastructure Cost Lower (single stack) Higher (dual stack)
Future-Proof Yes (IPv6 native) No (IPv4 dependencies)

5. Works with Existing Applications

Benefit: Transparent to end-user applications

6. Simple Tunnel Protocol

Benefit: Stateless encapsulation without complex signaling

Limitations and Trade-offs

While DS-Lite solves critical problems, it introduces limitations that users and ISPs must understand.

1. CPE Replacement or Upgrade Required

Impact: Customer equipment must support DS-Lite

This is often cited as the biggest barrier to DS-Lite deployment.

2. Port Forwarding Broken

Impact: Inbound connections from Internet impossible for most users

3. Application Compatibility Issues

Impact: Some applications break with CGNAT

4. Carrier-Grade NAT Logging Requirements

Impact: Privacy and regulatory compliance complexity

5. Increased Latency

Impact: Additional processing delay from tunneling and NAT

6. MTU Fragmentation Issues

Impact: IPv6 encapsulation reduces effective MTU

7. AFTR as Single Point of Failure

Impact: AFTR outage breaks IPv4 for all subscribers

End-User Implications

Understanding DS-Lite helps users diagnose connectivity issues and make informed decisions.

What Users Experience

Normal Functionality:

Limited or Broken Functionality:

How to Detect DS-Lite

Indicators you're on DS-Lite:

  1. Router shows IPv6 WAN address only (no IPv4 WAN address)
  2. Router admin panel shows "DS-Lite" or "IPv4-over-IPv6"
  3. Multiple devices show same public IPv4 when checking WhatIsMyIP.com
  4. Port forwarding fails to make services accessible from Internet
  5. traceroute shows IPv6 hops even when accessing IPv4 destinations

Testing DS-Lite:

# Check if your router's WAN interface has IPv4
# If only IPv6 present, likely DS-Lite

# From customer device:
curl -4 ifconfig.me     # Shows shared public IPv4
curl -6 ifconfig.me     # Shows your unique IPv6

# Compare with another user on same ISP
# If IPv4 address identical, you're sharing via CGNAT/DS-Lite

When DS-Lite is Problematic

Use cases where DS-Lite causes issues:

  1. Home servers/labs: Cannot accept inbound connections
  2. Remote workers: VPN and remote desktop may struggle
  3. Gamers: Strict NAT limits multiplayer, can't host games
  4. Smart home: IoT devices requiring cloud access may fail
  5. Surveillance cameras: Remote viewing requires relay services

Solutions:

  1. Request native dual-stack: Ask ISP if available (may cost extra)
  2. Use IPv6: Configure services for IPv6 if applications support it
  3. Tunnel broker: Obtain dedicated IPv4 via tunnel (HE TunnelBroker, etc.)
  4. Cloud relay: Use Cloudflare Tunnel, ngrok, or similar services
  5. VPS as jump host: Rent VPS with public IPv4 for reverse proxy/tunnel

When DS-Lite is Acceptable

Use cases where DS-Lite works fine:

DS-Lite vs Other Transition Technologies

DS-Lite is one of several approaches to managing IPv4 exhaustion. Understanding the alternatives helps evaluate trade-offs.

DS-Lite vs NAT444

NAT444: CGNAT at ISP plus customer CPE NAT (double NAT)

Aspect DS-Lite NAT444
Core Network IPv6-only Dual-stack
NAT Layers 1 (AFTR) 2 (CGNAT + CPE)
CPE Requirement DS-Lite support Standard NAT router
Infrastructure Cost Lower Higher
Application Compatibility Better Worse (double NAT issues)
Port Forwarding Broken Broken
Deployment Barrier CPE upgrade None (uses existing CPE)

Winner: DS-Lite for greenfield deployments; NAT444 for legacy networks

DS-Lite vs 464XLAT

464XLAT: IPv6-only network with customer-side IPv4 synthesis

Aspect DS-Lite 464XLAT
IPv4 Packets Tunneled (IPv4-in-IPv6) Translated (NAT46/NAT64)
Stateful Component AFTR (central) PLAT (central) + CLAT (customer)
IPv6 Preference IPv4 tunneled, IPv6 native IPv6 preferred, IPv4 synthesized
Application View Sees IPv4 addresses Sees IPv4 addresses (synthesized)
Performance Tunnel overhead Translation overhead
Complexity Moderate Higher

Winner: 464XLAT for mobile networks; DS-Lite for fixed broadband

DS-Lite vs Native Dual-Stack

Native Dual-Stack: Every subscriber gets both IPv4 and IPv6

Aspect DS-Lite Native Dual-Stack
IPv4 Addresses Needed 50-200 subscribers per IP 1 subscriber per IP
Cost Low (IPv4 sharing) High (IPv4 per user)
Application Compatibility Limited (no port forwarding) Full (native IPv4)
Infrastructure IPv6-only core Dual-stack everywhere
Future-Proof Yes No (IPv4 dependencies)
User Experience Some limitations Best

Winner: Dual-stack for user experience; DS-Lite for cost and future-proofing

DS-Lite vs Lightweight 4over6 (lw4o6)

lw4o6: Extension of DS-Lite with port-set allocation

Aspect DS-Lite Lightweight 4over6
Port Allocation Dynamic (CGNAT) Static (pre-assigned)
AFTR State Stateful (millions of flows) Stateless (mapping only)
Port Forwarding Broken Works (within assigned ports)
Scalability Good Excellent
Complexity Moderate Higher

Winner: lw4o6 for advanced deployments needing port forwarding

Testing Your DS-Lite Connection

Verifying whether you're on DS-Lite and how well it performs is critical for troubleshooting.

Check Your Connectivity Type

Use test-ipv6.run for comprehensive testing:

The tool performs:

What test-ipv6.run reveals about DS-Lite:

  1. IPv4 connectivity: Should succeed (via DS-Lite tunnel)
  2. IPv6 connectivity: Should succeed (native)
  3. IPv4 latency: May be slightly higher than IPv6 (tunnel overhead)
  4. Dual-stack preference: Should prefer IPv6 when available
  5. Broken IPv6: Should NOT show (if broken, indicates misconfiguration)

Manual Testing

Test IPv4 connectivity:

# Check your public IPv4 (will be shared with other users)
curl -4 ifconfig.me
curl -4 icanhazip.com

# Traceroute to see IPv6 hops even for IPv4 destination
traceroute -4 8.8.8.8
# If you see IPv6 addresses in trace, likely DS-Lite

Test IPv6 connectivity:

# Check your public IPv6 (unique to you)
curl -6 ifconfig.me
curl -6 icanhazip.com

# Ping IPv6-only site
ping6 ipv6.google.com

Check for CGNAT:

# If your router's WAN IP is in these ranges, you're behind CGNAT:
# 100.64.0.0/10 (RFC 6598 - Shared Address Space)
# Or your WAN shows only IPv6 (DS-Lite indicator)

Interpreting Results

Normal DS-Lite:

Broken DS-Lite:

Not DS-Lite (Native Dual-Stack):

Conclusion

DS-Lite represents a pragmatic solution to one of the Internet's most pressing challenges: providing IPv4 services in an IPv6 world while conserving increasingly scarce IPv4 addresses.

Key Takeaways

For ISPs:

For End Users:

Technical Reality:

The Path Forward

As IPv6 adoption accelerates globally, DS-Lite serves as a transitional technology enabling ISPs to move to IPv6-native infrastructure without abandoning IPv4 service. The ultimate goal remains an IPv6-only Internet where technologies like DS-Lite become obsolete—but until that day arrives, DS-Lite provides a cost-effective, scalable bridge.

Want to verify your network's IPv6 readiness and check if you're on DS-Lite? Visit test-ipv6.run for comprehensive, browser-based testing of your IPv4 and IPv6 connectivity. The tool runs all tests directly in your browser, provides real-time results, and scores your IPv6 readiness—helping you understand exactly how your connection works.

Additional Resources