Run environment check
12-dimension risk report · fingerprint / leaks / consistency
CLAUDE IPV6

IPv6 Dual-Stack Risk

On dual-stack networks, IPv6 traffic may take a different egress path than IPv4. This article explains how to check path consistency and when to restrict or disable IPv6.

The Core Problem

Many proxy and routing rules were originally designed around IPv4 (A records) only, but modern services often publish both A and AAAA records:

  • IPv4 request → matches proxy rule → goes through the proxy (expected)
  • IPv6 request → if the rule doesn't cover it → may go direct locally or take a different egress path
Key risk: if IPv6 doesn't enter the same proxy/enterprise gateway path, the server may see a source IP, ASN, and region that don't match the IPv4 path. This doesn't mean IPv6 itself is a problem — the issue is whether the dual-stack path is consistent, auditable, and reproducible.

The IPv6 Stable Identifier Problem

Some ISPs assign a fairly stable IPv6 prefix to home or business networks, unlike the frequently changing IPv4 egress address.

If the IPv6 prefix stays fixed long-term while IPv4 changes often, the network profile an account sees becomes more complex. This is better suited to consistency checks rather than a blanket conclusion that "IPv6 is always high risk."

6 Benefits of Restricting IPv6

  1. More controllable routing — all Claude-related requests enter the same observable path
  2. No more "fast then slow" swings — no more latency jumps from IPv6 timeouts falling back to IPv4
  3. Consistent DNS resolution — avoids geo drift caused by AAAA going through ISP DNS while A goes through proxy DNS
  4. Fewer consistency anomalies — the source IP / ASN / region Claude sees stays more consistent
  5. Higher proxy rule hit rate — avoids clients falling through to unconfigured paths via AAAA records
  6. Simpler troubleshooting — a single IPv4 path, no need to fight Happy Eyeballs / dual-stack racing

Recommended Implementation

Recommended order: first check whether IPv4/IPv6 share the same country, ASN, or proxy egress; if not, set Claude-related domains to ForceIPv4 or UseIPv4 in your proxy client (Sing-Box / Clash / V2Ray / Xray).

System-Level Disable Methods (When Needed)

Linux:sysctl -w net.ipv6.conf.all.disable_ipv6=1
macOS:networksetup -setv6off <Service> (or System Settings → Network → that interface → TCP/IP → turn off IPv6)
Windows: Adapter properties → uncheck "Internet Protocol Version 6 (TCP/IPv6)"
Router: Disable IPv6 DHCP distribution / SLAAC

The Trade-off

Disabling IPv6 may slow down some IPv6-optimized routes and could affect a small number of IPv6-only network services. It's usually better to restrict Claude-related traffic in your proxy client first, and only disable IPv6 at the system level if you can't reliably control the dual-stack path otherwise.

mimetic
mimetic
mimetic