464XLAT is an IPv6 transition architecture that allows applications that require IPv4 to keep working on IPv6-only and IPv6-mostly networks. Defined in RFC 6877, 464XLAT combines two translators: a customer-side translator (CLAT) on or near the client, and a provider-side translator (PLAT) in the network. The name describes the path a packet takes. IPv4 traffic is translated to IPv6 (4 to 6), carried across the IPv6 network, then translated back to IPv4 (6 to 4) before it reaches its destination.
Why 464XLAT?
Removing IPv4 from client networks conserves IPv4 addresses and simplifies operations, but IPv4-only resources on the internet and in enterprise data centers do not go away. NAT64 and DNS64 solve much of this problem. When an IPv6-capable application looks up the name of an IPv4-only destination, DNS64 synthesizes an IPv6 address, and NAT64 translates the connection to IPv4. However, NAT64 and DNS64 cannot help applications that never ask for an IPv6 address. Examples include applications that connect to literal IPv4 addresses, use IPv4-only networking APIs, or embed IPv4 addresses in their protocols. 464XLAT fills that gap.
How 464XLAT Works
464XLAT has two components, the CLAT and the PLAT. Each performs a different type of translation.
CLAT (Customer-Side Translator)
The CLAT translates IPv4 packets into IPv6 packets. It performs stateless translation, mapping each IPv4 packet one-to-one to an IPv6 packet addressed using the network’s NAT64 prefix. The CLAT can run on the client device itself, as it does on smartphones and Windows 11, or on a customer premises router that serves IPv4 devices behind it. On a client device, the CLAT presents IPv4 applications with what looks like an ordinary IPv4 interface: a local IPv4 address, typically from the IPv4 Service Continuity Prefix 192.0.0.0/29 (RFC 7335), and an IPv4 default route.
PLAT (Provider-Side Translator)
The PLAT is a stateful NAT64 gateway (RFC 6146) in the network. It receives translated IPv6 packets from the CLAT, translates them back to IPv4, and forwards them to the IPv4 destination using its own pool of IPv4 addresses. Because it is stateful, a single PLAT can share a small IPv4 address pool among many clients. The same NAT64 gateway also serves IPv6-capable applications using DNS64, so the PLAT is typically infrastructure the network already provides.
Putting It Together
The following example shows how an IPv4 packet travels across an IPv6-only network using 464XLAT.
- An application sends an IPv4 packet to an IPv4 destination, such as 203.0.113.10.
- The CLAT translates the packet to IPv6. The IPv6 destination address is simply the IPv4 destination address, converted to hexadecimal, appended to the discovered NAT64 prefix. For example, 203.0.113.10 is cb00:710a in hexadecimal, so with the well-known prefix 64:ff9b::/96 defined in RFC 6052, the destination becomes 64:ff9b::cb00:710a. This applies to /96 prefixes, such as the well-known prefix. RFC 6052 also allows shorter NAT64 prefixes (/32 through /64), which embed the IPv4 address at different positions in the IPv6 address.
- The packet crosses the IPv6-only network to the PLAT.
- The PLAT translates the packet to IPv4 and forwards it to the destination.
- Return traffic follows the reverse path.
Discovering the NAT64 Prefix
The CLAT must know the network’s NAT64 prefix to build the IPv6 destination address. Clients learn the prefix in one of two ways: from the PREF64 option in IPv6 router advertisements (RFC 8781), or by querying a DNS64 server for ipv4only.arpa (RFC 7050). PREF64 is generally preferred because the prefix arrives with the router advertisement and does not depend on DNS. For details on how Windows handles this, see How Windows CLAT Discovers the NAT64 Prefix.
464XLAT Compared to NAT64 and DNS64 Alone
| Application behavior | NAT64 and DNS64 only | 464XLAT |
|---|---|---|
| IPv6-capable application connecting by name | Works | Works (no CLAT translation needed) |
| Application connecting to a literal IPv4 address | Fails | Works |
| Application using IPv4-only networking APIs | Fails | Works |
Where 464XLAT is Used
464XLAT originated in mobile networks, where many carriers operate IPv6-only networks and smartphones include a CLAT so IPv4-only applications continue to work. It is now increasingly used in enterprise and public Wi-Fi networks as part of IPv6-only and IPv6-mostly deployments. On an IPv6-mostly network, devices that support DHCP option 108 operate without native IPv4 and rely on a CLAT for applications that still require it.
464XLAT on Windows
Windows has long included a CLAT for cellular connections. Windows CLAT (WinCLAT) extends the CLAT to Wi-Fi and Ethernet interfaces and is generally available on Windows 11 version 25H2, starting with build 26200.9550. WinCLAT is disabled by default on non-cellular interfaces and is not available on Windows Server. My WinCLAT resource page collects deployment guidance, configuration details, and troubleshooting resources, and the WinCLAT FAQ answers common questions.
Frequently Asked Questions
What does 464XLAT stand for?
The numbers describe the translation path, IPv4 to IPv6 to IPv4. XLAT is shorthand for translation.
What is the difference between CLAT and PLAT?
The CLAT runs on or near the client and performs stateless translation from IPv4 to IPv6. The PLAT runs in the network and performs stateful translation from IPv6 back to IPv4 using NAT64.
Is 464XLAT the same as NAT64?
No. NAT64 is one component of 464XLAT, serving as the PLAT. 464XLAT adds the CLAT so that applications that generate IPv4 traffic can also use the NAT64 gateway.
Do I need a CLAT if my network has DNS64?
For applications that connect by name over IPv6, DNS64 and NAT64 are sufficient. A CLAT is required for applications that use literal IPv4 addresses or IPv4-only networking APIs.
Does 464XLAT require IPv4 addresses on the client network?
No. The client network can be IPv6-only. The CLAT uses a local, non-routed IPv4 address, and only the PLAT needs a pool of IPv4 addresses.
Does Windows support 464XLAT?
Yes. Windows 11 provides the CLAT component with Windows CLAT (WinCLAT). The network must provide the NAT64 gateway that serves as the PLAT.
Summary
464XLAT combines a client-side CLAT and a network-side PLAT so that applications requiring IPv4 continue to work on IPv6-only and IPv6-mostly networks. NAT64 and DNS64 handle IPv6-capable applications, while the CLAT covers the remaining IPv4 traffic. On Windows 11, WinCLAT provides the CLAT component.
