first, is "CRAAAAUG AAAAAAAA". The "C" bit was set to 1 if the Teredo client is located behind a cone NAT, 0 otherwise, but RFC 5991 changed it to always be 0 to avoid revealing this fact to strangers. The "R" bit is currently unassigned and should be sent as 0. The "U" and "G" bits are set to 0 to emulate the "Universal/local" and "Group/individual" bits in MAC addresses. The 12 "A" bits were 0 in the original RFC 4380 specification, but were changed to random bits chosen by the Teredo client in RFC 5991 to provide the Teredo node with additional protection against IPv6-based scanning attacks. Bits 80 to 95 contain the obfuscated UDP port number. This is the port number that the NAT maps to the Teredo client, with all bits inverted. Bits 96 to 127 contain the obfuscated IPv4 address. This is the public IPv4 address of the NAT with all bits inverted. As an example, the IPv6 address 2001:0000:4136:e378:8000:63bf:3fff:fdd2 refers to a Teredo client that: Uses Teredo server at address 65.54.227.120 (4136e378 in hexadecimal) Is behind a cone NAT and client is not fully compliant with RFC 5991 (bit 64 is set) Is probably (99.98%) not compliant with RFC 5991 (the 12 random bits are all 0, which happens less than 0.025% of the time) Uses UDP mapped port 40000 on its NAT (in hexadecimal not 63bf equals 9c40, or decimal number 40000) Has a NAT public IPv4 address of 192.0.2.45 (not 3ffffdd2 equals c000022d, which is to say, 192.0.2.45) Servers Teredo clients use Teredo servers to autodetect the kind of NAT they are behind (if any), through a simplified STUN-like qualification procedure. Teredo clients also maintain a binding on their NAT toward their Teredo server by sending a UDP packet at regular intervals. That ensures that the server can always contact any of its clients—which is required for NAT hole punching to work properly. If a Teredo relay (or another Teredo client) must send an IPv6 packet to a Teredo client, it first sends a Teredo bubble packet to the client's Teredo server, whose IP address it infers from the Teredo IPv6 address of the Teredo client. The server then forwards the bubble to the client, so the Teredo client software knows it must do hole punching toward the Teredo relay. Teredo servers can also transmit ICMPv6 packet from Teredo clients toward the IPv6