Dual Stack: Running IPv4 and IPv6 Together Without Blind Spots

Dual stack means running IPv4 and IPv6 simultaneously on the same hosts and the same infrastructure. Each interface holds addresses in both families, and each connection uses whichever protocol suits the destination. It is the recommended IPv6 transition mechanism, and it is also the one that most often introduces a security gap nobody meant to create.

Why transition needs a mechanism at all

IPv4 and IPv6 are not interoperable. An IPv6-only host cannot speak to an IPv4-only host directly; the header formats and address lengths differ fundamentally. Since the entire internet cannot switch on a single date, something has to bridge the period where both exist.

Dual stack bridges it by simply speaking both. No translation, no encapsulation, no gateway in the middle — each protocol runs natively, end to end, with full performance and full feature support.

How a host chooses

A dual-stack client resolving a name may get both an A record and an AAAA record. Standard behavior prefers IPv6 when both are available, which is deliberate: it moves traffic onto the newer protocol as deployment grows.

Preferring IPv6 blindly caused problems in early deployments, where a broken IPv6 path meant a long timeout before the client fell back. The Happy Eyeballs algorithm fixes this by starting both connection attempts nearly in parallel, with a short head start for IPv6, and using whichever completes first. The user sees no delay even when one path is broken, which is excellent for experience and slightly awkward for troubleshooting, since a failing protocol can be invisible.

Address assignment differs too. IPv4 typically uses DHCP, while IPv6 hosts may use stateless address autoconfiguration from router advertisements, DHCPv6, or both, and a single interface commonly holds a link-local address, one or more global addresses, and temporary privacy addresses at the same time.

The alternatives, and why they lose

Tunneling encapsulates one protocol inside the other — 6in4, 6to4, Teredo, and similar. It lets isolated IPv6 islands reach each other across IPv4 infrastructure, at the cost of added overhead, reduced effective MTU, and tunnel endpoints that firewalls often cannot inspect. Automatic tunneling in particular has a poor security record.

Translation, such as NAT64 with DNS64, lets IPv6-only clients reach IPv4 services through a gateway that rewrites between families. It is genuinely useful for IPv6-only mobile networks, but it breaks protocols that embed addresses and it reintroduces exactly the middlebox complications that NAT and PAT brought to IPv4.

Dual stack avoids all of that, which is why it is preferred wherever both protocols can be carried. Its costs are operational: two address plans, two routing configurations, two firewall policies, and two sets of monitoring.

The security gap

This is the exam-relevant part and the real-world failure. Modern operating systems enable IPv6 by default and often obtain addresses automatically. If the network was designed and secured for IPv4 only, IPv6 may be live on every host with no firewall rules, no monitoring, and no access control governing it.

The result is a parallel network that the security team is not watching. Attackers use it deliberately: an unauthorized router advertisement can insert a rogue default gateway for IPv6 traffic on a segment where IPv4 is tightly controlled, redirecting traffic through the attacker. Tooling for this is mature and requires no special access beyond being on the segment.

Closing it means treating IPv6 as a first-class protocol. Write and maintain equivalent firewall rules for both families. Enable RA Guard and DHCPv6 Guard on access switches so only authorized routers may advertise. Extend logging, intrusion detection, and scanning to IPv6 addresses. And if you genuinely do not use IPv6, disable it explicitly rather than assuming it is absent — unmanaged is worse than either on or off. Also remember that IPv6 has no equivalent of the RFC 1918 private ranges in everyday use: global addresses are globally routable, so reachability is a firewall decision rather than an accident of addressing.

Exam angles

Identify dual stack as the preferred transition mechanism and native support for both protocols as its defining property. Know tunneling and translation as the alternatives and their drawbacks. Recognize that hosts prefer IPv6 when both are available and that Happy Eyeballs handles fallback. Above all, expect the scenario where IPv6 is enabled but unsecured, and know that the answer is equivalent controls on both stacks rather than ignoring the one you did not plan for.