Dynamic Allocation of Shared IPv4 Addresses
Extracted elements (28)
IPv4 address exhaustion during the transition to native IPv6 networks drove the design. Rather than deploying CGN devices, this solution distributes the same public IPv4 address to multiple clients differentiated by non-overlapping Layer 4 port sets, following the Address plus Port (A+P) model.
The offset, PSID-len, and PSID fields of OPTION_V4_PORTPARAMS are intentionally identical in meaning and encoding to the S46 Port Parameters option (RFC 7598 Section 4.5) to ensure compatibility with existing port-set implementations.
The solution is restricted to point-to-point links, tunnels, and environments with link-layer authentication before IP assignment. It is explicitly unsuitable for shared media such as Ethernet, WLAN, or cable, because the IP address is no longer a unique host identifier.
When a shared-address-capable client receives both a shared-address offer and a full-IPv4 offer, it SHOULD prefer the full IPv4 offer unless specifically configured otherwise, acknowledging that shared addresses carry operational restrictions not present with full addresses.
A single DHCP 4o6 server MAY serve both clients that support OPTION_V4_PORTPARAMS and those that do not. It MUST implement a mechanism (e.g., separate address pools) to ensure clients not supporting the option do not receive shared addresses.
A DHCP 4o6 server serving only shared-address pools MUST discard requests that do not contain OPTION_V4_PORTPARAMS in the Parameter Request List option, ensuring non-supporting clients do not inadvertently receive shared addresses.
A DHCP 4o6 server that supports shared IPv4 addresses MUST add an OPTION_V4_PORTPARAMS option containing an available restricted port set in its DHCPOFFER response.
All connections originating from the shared IPv4 address MUST use a source port taken from the allocated restricted port set, and the client MUST use only port-aware protocols (TCP, UDP, DCCP) and be ICMP-compliant with RFC 5508.
If DHCPv4-over-DHCPv6 configuration fails for any reason, the client MUST NOT configure an IPv4 link-local address (from 169.254.0.0/16), preventing fallback to an address space incompatible with the shared-address model.
If the client's DHCP 4o6 IPv6 source address changes for any reason, the client MUST re-initiate the shared-address provisioning process by sending a DHCPDISCOVER message rather than attempting a DHCPREQUEST renewal.
On receipt of a DHCPACK with OPTION_V4_PORTPARAMS, the client MUST NOT perform an in-use probe (e.g., ARP for duplicate address detection) on the allocated shared IPv4 address, because the same address is legitimately used by other clients.
The client MUST implement a function ensuring that only the allocated Layer 4 ports of the shared IPv4 address are used for sourcing new connections or accepting inbound connections; it MUST NOT accept inbound connections on ports outside the allocated restricted port set.
The client MUST NOT use the received restricted IPv4 address to perform ARP operations, to prevent addressing conflicts arising from multiple clients sharing the same IPv4 address.
The client's DHCPDISCOVER message MUST include the client identifier option (per RFC 4361) and the Parameter Request List option with the code OPTION_V4_PORTPARAMS.
The DHCP 4o6 server MUST NOT reply with OPTION_V4_PORTPARAMS unless the client has explicitly listed the Option Code in the Parameter Request List (Option 55), preventing unsolicited shared-address allocation.
The server MUST implement a mechanism to reserve certain port ranges (e.g., system ports 0–1023) from allocation to clients; the reservation policy SHOULD be configurable by the operator.
The server MUST respond with a DHCPACK message containing OPTION_V4_PORTPARAMS for the requesting client. The port-set assignment MUST be coupled with the address assignment and MUST be conveyed in the same DHCP message.
When releasing a lease, the client MUST include both the leased network address and OPTION_V4_PORTPARAMS (with the allocated PSID) in the DHCPRELEASE message to identify which lease to release.
A shared IPv4 address is an IPv4 address paired with a restricted Layer 4 port set identified by a Port Set ID (PSID). The combined tuple of IPv4 address and PSID must be unique for each active lease, allowing one address to serve multiple clients simultaneously.
OPTION_V4_PORTPARAMS (code 159) is a new DHCPv4 option carrying PSID information — offset, PSID-len, and PSID fields — enabling clients to signal support for shared address leasing and servers to provision port sets alongside IP addresses.
The server maintains lease state keyed on the tuple (IPv4 address, PSID, client identifier) rather than IPv4 address alone. On DHCPRELEASE, the server searches for the matching lease using ciaddr plus the PSID in OPTION_V4_PORTPARAMS and marks it unallocated.
IANA assigned DHCPv4 Option Code 159 (OPTION_V4_PORTPARAMS) in the BOOTP/DHCP Parameters registry. The option has a fixed data length of 4 octets and is used to configure a set of ports bound to a shared IPv4 address.
A malicious user could exhaust available addresses and port sets by requesting a large number of shared IPv4 leases (DoS). Mitigation is to implement per-customer-site allocation policies limiting the number of simultaneously active IPv4 leases.
Port randomization (RFC 6056) is impaired because the host can only randomize within its restricted port range, reducing the entropy available against blind in-window TCP attacks. RFC 5961 techniques or IPv6 usage are recommended as compensating controls.
The client identifier option enables the server to track the client over time, creating a privacy trade-off between stable parameter allocation and anonymity. Clients can manage exposure by controlling the client identifier value; further guidance is deferred to the DHCP anonymity profile work.
Unauthorized DHCP 4o6 servers could stage amplification attacks or supply invalid configurations causing service disruption. The risk is mitigated by using unicast DHCP 4o6 message flows, enabled by supplying server unicast addresses within OPTION_DHCP4_O_DHCP6_SERVER.
When the client has a previously allocated address and port set and its DHCP 4o6 IPv6 source address is unchanged, it enters the INIT-REBOOT state (per RFC 2131 Section 3.2) and MUST include OPTION_V4_PORTPARAMS with the requested port-set in the DHCPREQUEST flow. If the IPv6 source address changes, the client transitions back to DHCPDISCOVER.
OPTION_V4_PORTPARAMS encodes as: 8-bit option-code (159), 8-bit option-len (4), 8-bit offset (PSID offset, values 0–15, default 6 for MAP), 8-bit PSID-len (k bits; 0 means PSID ignored), and 16-bit PSID (left-justified, right-padded with zeros). Total option length is 4 octets.