IPv6 Monitoring and Troubleshooting

Troubleshooting IPv6 connectivity requires familiarity with a new set of command-line tools, understanding of how dual-stack selection works, and awareness of IPv6-specific failure modes that have no IPv4 equivalent. This guide covers the complete toolkit for diagnosing IPv6 problems.

Basic IPv6 Connectivity Testing

ping6 / ping -6

The IPv6 equivalent of ping. On modern systems, a single ping command handles both IPv4 and IPv6 depending on the target address. Use the -6 flag to force IPv6.

64:ff9b::/96

Common failures: - Network unreachable — No IPv6 default route - No route to host — No path to destination prefix - Request timeout — ICMPv6 echo replies being filtered - Destination unreachable (no route) — Router cannot forward the packet

traceroute6 / traceroute -6

Maps the path of IPv6 packets across the network, showing each hop and round-trip time.

64:ff9b::192.0.2.10
or in hex:
64:ff9b::c000:020a

Reading traceroute output:

Query:  example.com AAAA
Upstream returns: A 93.184.216.34 (no AAAA)
DNS64 synthesizes: AAAA 64:ff9b::5db8:d822
Client connects to: 64:ff9b::5db8:d822
NAT64 gateway sees IPv6 packet, translates to 93.184.216.34

* * * hops indicate routers that do not send TTL-exceeded ICMPv6 messages. This is often intentional firewall policy, not a failure.

IPv6 Address and Interface Diagnostics

Checking IPv6 Address Configuration

Client Device                  Network                  Internet
+------------------+          +----------+          +-----------+
| IPv4-only app    |          |          |          |           |
|       |          |          |          |          |  IPv4     |
|   CLAT (client)  | --IPv6--> | PLAT     | --IPv4-> |  Server   |
| 192.0.0.x/29     |          | (NAT64)  |          |           |
+------------------+          +----------+          +-----------+

Look for: - Global unicast (2000::/3) — Routable public IPv6 address - Link-local (fe80::/10) — Always present if IPv6 is enabled; not globally routable - ULA (fc00::/7) — Private routable (similar to RFC 1918) - Temporary addresses — Random IID, preferred source for outbound connections

Checking IPv6 Routing Table

# Check if your network provides NAT64 by querying ipv4only.arpa
dig AAAA ipv4only.arpa

# Should return a AAAA record with 64:ff9b:: prefix if DNS64 is active
# Example: 64:ff9b::c000:aa64

# Test actual connectivity through NAT64
ping6 64:ff9b::8.8.8.8  # Should reach Google's DNS via NAT64

# Apple's NAT64 detection endpoint
curl -6 https://nat64check.net/

A missing default route (default via ...) explains Network unreachable errors when trying to reach global IPv6 addresses.

Checking NDP Neighbor Cache

wzxhzdk:5

A neighbor stuck in INCOMPLETE state means NDP is failing — the device cannot resolve the MAC address for that IPv6 address. Check: - Physical layer (link up?) - VLAN configuration (are both devices in the same broadcast domain?) - Firewall rules blocking ICMPv6 135/136 (NS/NA)

DNS Troubleshooting for IPv6

Checking AAAA Records

wzxhzdk:6

Reverse DNS for IPv6

IPv6 reverse DNS uses ip6.arpa. The address is reversed nibble-by-nibble:

wzxhzdk:7

Missing reverse DNS is common for IPv6 addresses and can cause slow SSH logins (UseDNS yes in sshd_config attempts PTR lookup). Either add a PTR record or set UseDNS no.

Happy Eyeballs Algorithm

What Is Happy Eyeballs?

When a client resolves a hostname that has both A and AAAA records, it must decide which address to connect to. Naive implementations try IPv6 first and fall back to IPv4 only after a timeout — creating noticeable delays when IPv6 connectivity is broken.

Happy Eyeballs (RFC 6555 / RFC 8305) is an algorithm that races IPv4 and IPv6 connections simultaneously (or with a small delay) and uses whichever completes first. This eliminates the long timeout penalty when one address family is broken.

Happy Eyeballs v2 (RFC 8305)

The updated algorithm: 1. Query DNS for both A and AAAA records in parallel 2. Wait up to 50ms for AAAA response after A response arrives 3. Attempt IPv6 connection first 4. If IPv6 connection has not succeeded after 250ms, start IPv4 connection in parallel 5. Use whichever connection completes first; cancel the other

Debugging Happy Eyeballs

When connections to dual-stack hosts are slow or intermittent, Happy Eyeballs may be masking an IPv6 failure:

wzxhzdk:8

Common Happy Eyeballs debugging scenario: - Web requests to dual-stack sites occasionally take 250-300ms extra - Cause: IPv6 address is reachable at DNS level but TCP SYN packets are being dropped silently - Test: curl -6 -v https://site.com — hangs at "Trying 2001:..." - Fix: Identify where IPv6 TCP is being dropped (firewall rule? broken MTU?)

IPv6 MTU and PMTUD Issues

Path MTU Discovery (PMTUD) is more critical in IPv6 than IPv4 because IPv6 routers cannot fragment packets. If a packet exceeds the MTU of any link on the path, the router drops it and sends a Packet Too Big (ICMPv6 Type 2) message back to the source.

If ICMPv6 Type 2 messages are blocked by a firewall, PMTUD breaks. This causes the classic black hole symptom: connections establish successfully (TCP SYN/SYN-ACK are small) but data transfer hangs once large packets are sent.

wzxhzdk:9

IPv6-Aware Monitoring Tools

Network Monitoring Systems

Most modern NMS platforms support IPv6:

Prometheus Blackbox Exporter

Ideal for monitoring HTTP/TCP/ICMP over IPv6:

wzxhzdk:10

wzxhzdk:11

Flow Monitoring

NetFlow/IPFIX and sFlow all support IPv6. Ensure your collectors and analyzers are IPv6-aware:

• ntopng — Full IPv6 support in all versions
• nfdump/nfcapd — Native IPv6 flow collection
• Elastiflow — Grafana-based, full IPv6 support

wzxhzdk:12

Dual-Stack Debugging Workflow

When a dual-stack host has connectivity problems, follow this systematic approach:

Step 1: Isolate the Address Family

wzxhzdk:13

Step 2: Verify DNS Resolution

wzxhzdk:14

Step 3: Check Routing

wzxhzdk:15

Step 4: Check MTU and ICMPv6 Filtering

wzxhzdk:16

Step 5: Inspect Neighbor Discovery

wzxhzdk:17

Step 6: Check System Logs

wzxhzdk:18

IPv6 Reachability Testing Services

These public tools test your IPv6 connectivity from external vantage points:

wzxhzdk:19

Quick Reference: IPv6 Troubleshooting Commands

Effective IPv6 troubleshooting requires the same systematic methodology as IPv4 debugging — isolate the layer, test assumptions, and use the right tool for each diagnostic question. The additional complexity of dual-stack environments demands extra care: always determine which address family is actually being used before drawing conclusions.