DNSfinder.net
Embedded Address Decoder

IPv6 to IPv4 Converter

Some IPv6 addresses carry an IPv4 address inside them: the ::ffff: form in server logs, NAT64 addresses on IPv6-only networks, 6to4 and Teredo tunnel addresses and ISATAP interface identifiers. Paste an IPv6 address and this decoder recognises the mechanism, pulls out the embedded IPv4 address and, for Teredo, the client's UDP port. If the address is native IPv6 it says so plainly, because there is nothing to extract. Everything runs in your browser.

Loading IPv6 to IPv4 Converter...

Querying live edge resolvers and network infrastructure...

How to use the IPv6 to IPv4 Converter

  1. Paste the IPv6 address, for example ::ffff:198.51.100.7 from a web server log or 2002:c000:204::1 from a routing table. Brackets and a %zone suffix are fine.
  2. Read the Result card: each embedded address appears in large type with the mechanism that produced it and a copy button.
  3. Check the pill in the card's corner for the address class, such as Global unicast, Link-local or IPv4-mapped.
  4. If the card says no IPv4 address is embedded, look up the host's A record instead. A native IPv6 address has no IPv4 inside it.

What to look for

Six mechanisms recognised

The decoder checks for IPv4-mapped (::ffff:0:0/96), the deprecated IPv4-compatible form (::/96), the NAT64 well-known prefix (64:ff9b::/96), 6to4 (2002::/16), Teredo (2001::/32) and ISATAP interface identifiers ending in 5efe:a.b.c.d. An address can match more than one pattern, and every match is listed.

Teredo gives two addresses

A Teredo address encodes the Teredo server's IPv4 address in its second 32 bits and the client's public IPv4 address and UDP port in the last 48 bits with every bit inverted. The decoder lists the server address and the client address separately and prints the recovered port beneath the client entry.

Compressed and expanded forms

Beneath the result the card shows the canonical compressed spelling and the full eight-group expansion of the address you entered, both with copy buttons. That makes the page useful for normalising an address even when it embeds nothing, such as a link-local fe80:: address copied from a device.

Guide

Finding the IPv4 address hidden inside an IPv6 address

What an embedded address is

IPv6 has 128 bits of address, so a mechanism that needs to remember an IPv4 address can store its 32 bits inside the IPv6 address at a fixed position. Dual-stack sockets do it so an application sees one address type, NAT64 does it so a translator knows the real destination, and the tunnelling protocols do it so a packet can find its IPv4 endpoint. The prefix identifies which mechanism is in play.

The decoder works from those positions. For the mapped, compatible, NAT64 and ISATAP forms the IPv4 address is the last 32 bits. For 6to4 it is the 32 bits immediately after 2002. For Teredo the server address sits in the second 32 bits and the client address in the final 32 bits, inverted, with the inverted port in the 16 bits before it.

Reading each result

Every match shows the IPv4 address in large type, the mechanism name with its prefix in brackets, and a one-line note: for the mapped form, that dual-stack sockets use it to represent IPv4 peers; for NAT64, that it names the IPv4 server an IPv6-only client is talking to; for 6to4, that it is the public address of the 6to4 gateway rather than the end host.

The classification pill comes from the address's leading bits and is independent of the extraction: Global unicast for 2000::/3, Unique local address for fc00::/7, Link-local for fe80::/10, Multicast for ff00::/8, Documentation for 2001:db8::/32, plus Loopback, Unspecified and IPv4-mapped. A 6to4 address classifies as Global unicast, which is correct, while the result beneath tells you it is a tunnel.

The ::ffff: addresses in your logs

The most common reason to use this page is a log line such as ::ffff:198.51.100.7. A server that listens on an IPv6 socket without the IPV6_V6ONLY option accepts IPv4 clients too and records them as IPv4-mapped addresses. The client is an ordinary IPv4 host. 198.51.100.7 is the address to block, allow-list or investigate, and IP lookup will tell you who owns it.

NAT64 addresses are the mirror image. On an IPv6-only network a connection to 64:ff9b::c633:6407 is really a connection to 198.51.100.7 through the carrier's translator. If your network uses a network-specific prefix rather than the well-known one, the decoder cannot recognise it, because any global prefix could be in use. The last 32 bits are still the IPv4 address, though.

When there is no IPv4 address to find

Most IPv6 addresses on the internet today are native: a global address beginning with 2 or 3 was assigned by a provider and has no relationship to any IPv4 address. The info box in that case is the correct answer, not a failure. To find the IPv4 address of the same host, resolve its name with domain to IP or query its A record. The A and AAAA records are independent.

The same applies to unique local and link-local addresses, which are internal and never carry an IPv4 address. If a result looks wrong, remember that 6to4 and Teredo addresses encode gateway and relay addresses, not the end host, and that Teredo's client address is only meaningful if the address really came from a Teredo client. To convert in the other direction, IPv4 to IPv6 produces all the forms from one IPv4 address.

Knowledge Base & FAQ

IPv6 to IPv4 Converter FAQs

Common questions about the ipv6 to ipv4 converter.

No. Only addresses produced by a transition mechanism contain an IPv4 address: IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo and ISATAP. A native IPv6 address is an independent 128-bit value with no IPv4 inside it, and IPv6 has far more addresses than IPv4, so no general mapping between the two can exist.