Subject: some real life data

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 5 Oct 2008 07:14:31 +0200 (CEST)

Hi.

I conducted an experiment to collect some ipv4/v6 data with the help of a 
certain large p2p bittorrent tracker website. I had them include 
javascript code that would load three 42 byte gifs upon webpage load 
completion (to not impact user experience). The site itself wasn't v6 
enabled. The site itself is biased towards the scandinavian geographical 
region, but has a worldwide user base.

The first gif was loaded from an address with a single A record (v4only).
Second had both A and AAAA (v4v6).
Third had just AAAA (v6only).

I haven't put all the data into a neat presentation or anything yet 
(though I have given it to others who will), but I thought I'd share some 
key numbers ("user" here is an IP number in the log, where each IP number 
is only counted once, I only used unix tools like cut/awk/sort/uniq etc, 
nothing fancy). This data is only from around 24 hours or collecting, but 
still hundreds of thousands of unique IPs.

0.5% of the users pulled the v4v6 gif using IPv6.

6% of the users were able to get the v6only gif.

Of the v6only accesses, 91% were from 6to4 addresses, 7% were teredo and 
2% were from other ipv6 space. The "other ipv6 space" was from 58 
different /32s.

Of the users getting v6 only gif from non-tunnel-space, 58% were from 
Proxad (free.fr I believe), and then on the list came UNINET, SUNET, FUNET 
(university networks in .no, .se and .fi) and Hurricane electric.

98% of Teredo users run Windows XP.
88% of 6to4 users run Windows Vista.

The difference in page loads between v4only and v4v6 was 0.4%, indicating 
that some users might have problems loading something that has both A and 
AAAA DNS. This might be that it's slower, doesn't work, or simply that 
some users clicked on a link before that gif was loaded. The gifs were 
loaded in the order indicated above, with the javascript function 
"window.onload".

Feedback appreciated.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: "Olivier MJ Crepin-Leblond" <[email-masked]>
Date: Sun, 5 Oct 2008 10:26:12 +0100

Hello Mikael,

very interesting. You might wish to extend your sample size to beyond 24h to 
gain better usage patterns.
Short samples of 24h might favour specific heavy users on this occasion.
Kind regards,

Olivier

-- 
Olivier MJ Crepin-Leblond, Ph.D.
E-mail:<[email-masked]> | http://www.gih.com/ocl.html

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Sun, 5 Oct 2008 14:43:43 +0200

Very very interesting because it tends to confirm my own experiment based on http://www.ietf.org/internet-drafts/draft-vyncke-http-server-64aware-00.txt

Also playing tricks with loading an IPv6 only 1x1 pixel images on some web pages. As the web pages are on French speaking web sites until now, there is a clear bias towards France/Canada/Belgium/Switzerland where Free.net has an clear advantage of course.

Stats compiled for more than 1 month:
http://sigma.hec.be/~evyncke/family/countv6/stats.php (see the several graphs at the end)

It is about 10% of IPv6 able clients... (mainly Vista). Teredo is the most used connectivity followed by Free

NB: feel free to look at the http://www.vyncke.org/countv6/ to see how is is done and add the 'tracker' to any page of yours of course.

Empirical experiment with uTorrent also shows between 5% and 10% of IPv6 peers.

Hope this helps to show that IPv6 could be more than the 'advertised' 0.01% of the Internet traffic.

-éric

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Mikael Abrahamsson
> Sent: dimanche 5 octobre 2008 7:15
> To: [email-masked]
> I conducted an experiment to collect some ipv4/v6 data with 
> the help of a certain large p2p bittorrent tracker website. I 
> had them include javascript code that would load three 42 
> byte gifs upon webpage load completion (to not impact user 
> experience). The site itself wasn't v6 enabled. The site 
> itself is biased towards the scandinavian geographical 
> I haven't put all the data into a neat presentation or 
> anything yet (though I have given it to others who will), but 
> I thought I'd share some key numbers ("user" here is an IP 
> number in the log, where each IP number is only counted once, 
> I only used unix tools like cut/awk/sort/uniq etc, nothing 
> fancy). This data is only from around 24 hours or collecting, 
> but still hundreds of thousands of unique IPs.
> 
> Of the v6only accesses, 91% were from 6to4 addresses, 7% were 
> teredo and 2% were from other ipv6 space. The "other ipv6 
> space" was from 58 different /32s.
> 
> Of the users getting v6 only gif from non-tunnel-space, 58% 
> were from Proxad (free.fr I believe), and then on the list 
> came UNINET, SUNET, FUNET (university networks in .no, .se 
> and .fi) and Hurricane electric.
> 
> The difference in page loads between v4only and v4v6 was 
> 0.4%, indicating that some users might have problems loading 
> something that has both A and AAAA DNS. This might be that 
> it's slower, doesn't work, or simply that some users clicked 
> on a link before that gif was loaded. The gifs were loaded in 
> the order indicated above, with the javascript function 
> "window.onload".
> 
> Feedback appreciated.
> 
> --

---

From: Nathan Ward <[email-masked]>
Date: Mon, 6 Oct 2008 03:22:04 +1300

On 5/10/2008, at 6:14 PM, Mikael Abrahamsson wrote:

> Hi.
>
> I conducted an experiment to collect some ipv4/v6 data with the help  
> of a certain large p2p bittorrent tracker website. I had them  
> include javascript code that would load three 42 byte gifs upon  
> webpage load completion (to not impact user experience). The site  
> itself wasn't v6 enabled. The site itself is biased towards the  
> scandinavian geographical region, but has a worldwide user base.
>
> (though I have given it to others who will), but I thought I'd share  
> some key numbers ("user" here is an IP number in the log, where each  
> IP number is only counted once, I only used unix tools like cut/awk/ 
> sort/uniq etc, nothing fancy). This data is only from around 24  
> hours or collecting, but still hundreds of thousands of unique IPs.
>
> Of the v6only accesses, 91% were from 6to4 addresses, 7% were teredo  
> and 2% were from other ipv6 space. The "other ipv6 space" was from  
> 58 different /32s.
>
> Of the users getting v6 only gif from non-tunnel-space, 58% were  
> from Proxad (free.fr I believe), and then on the list came UNINET,  
> SUNET, FUNET (university networks in .no, .se and .fi) and Hurricane  
> electric.
>
> The difference in page loads between v4only and v4v6 was 0.4%,  
> indicating that some users might have problems loading something  
> that has both A and AAAA DNS. This might be that it's slower,  
> doesn't work, or simply that some users clicked on a link before  
> that gif was loaded. The gifs were loaded in the order indicated  
> above, with the javascript function "window.onload".

I have some javascript code that can be dropped on to a web page with  
little effort to do exactly this.

In addition, it times how long images take to load, and provides  
feedback on status periodically by updating another IMG tag's address  
to a url with several parameters in it.

http://www.braintrust.co.nz/ipv6wwwtest/

It's not amazing code as I'm not a javascript coder, but it seems to  
work OK.

The Teredo count on the IPv6 only address seems very low, considering  
that Teredo is used by hosts behind NAT, while 6to4 is used by hosts  
not behind NAT. Given that most hosts are behind NAT, it would be my  
suspicion that most hosts are on Teredo - and that is indeed what my  
research shows.

That 98% of Teredo users run XP suggests to me that perhaps the v6only  
gif had an A record on it accidentally.. Vista will prefer A over AAAA  
if it only has Teredo connectivity. XP will prefer AAAA over A all the  
time. Considering that Teredo is disabled by default in XP, the  
numbers you've got here seem more like what I'd expect from an A+AAAA  
DNS name (though many XP Bittorrent users now have Teredo turned on  
thanks to uTorrent).

I'd also recommend trying various combinations with 6to4 and Teredo  
IPv6 addresses in AAAA records as well. My code there only does Teredo  
and 6to4 addresses, no native addresses as at the time I was using it  
I did not have native connectivity.

Also, looking at packet captures, keeping an eye out for ICMPv6 ping  
for the Teredo relay discovery could be interesting. You might find  
that the Teredo relay closest to you was unreliable, in which case  
you'd see ICMPv6 echo requests coming to you and responses going out,  
but no initial SYN packet. Were you running your own relay?

Also of interest would be bits 33-64 of the Teredo address, see what  
hosts are using what Teredo servers (ie. who is using the Microsoft  
ones? Who is using ones provided by $linux_vendor?).

6to4 addresses are also interesting, you can detect Windows style host- 
based 6to4 by checking to see if the address is of the format:
2002:AABB:CCDD::AABB:CCDD, ie the IPv4 address appears in the last 32  
bits, as well as bits 17-48.
It would be interesting to see what Windows vs. non-Windows hosts are  
on which type of addresses, etc. Also looking for EUI-64 vs static  
addressing (ie 2002:AABB:CCDD::1 or something).

I've been crunching numbers with this sort of data for a while so if  
anyone doing this sort of research, I'd be more than happy to help out  
any way I can, drop me a line offlist - [email-masked].
I've got a bunch of custom tools and things for processing packets  
(ie. decoding Teredo/6to4/etc.) and such and putting info in to  
databases so that it can be queried etc. etc.

--
Nathan Ward

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 5 Oct 2008 16:59:32 +0200 (CEST)

On Mon, 6 Oct 2008, Nathan Ward wrote:

> The Teredo count on the IPv6 only address seems very low, considering that 
> Teredo is used by hosts behind NAT, while 6to4 is used by hosts not behind 
> NAT. Given that most hosts are behind NAT, it would be my suspicion that most 
> hosts are on Teredo - and that is indeed what my research shows.

Well, I thought so too. I have been trying to get teredo working on my XP 
box behind a NAT, but I couldn't get it working, I don't know why yet. It 
works well without NAT though.

> That 98% of Teredo users run XP suggests to me that perhaps the v6only gif 
> had an A record on it accidentally.. Vista will prefer A over AAAA if it only 
> has Teredo connectivity. XP will prefer AAAA over A all the time. Considering 
> that Teredo is disabled by default in XP, the numbers you've got here seem 
> more like what I'd expect from an A+AAAA DNS name (though many XP Bittorrent 
> users now have Teredo turned on thanks to uTorrent).

For some strange reason I have approx 1% of v4 addresses in my v6only log. 
v6only has no A record, it never has had, and currently I have no idea how 
the v4 addresses come to fetch it.

> Were you running your own relay?

Yes, we have a local relay. It might have some kind of problem, I'll look 
into that as well.

> Also of interest would be bits 33-64 of the Teredo address, see what hosts 
> are using what Teredo servers (ie. who is using the Microsoft ones? Who is 
> using ones provided by $linux_vendor?).

I'll look into that.

> I've been crunching numbers with this sort of data for a while so if anyone 
> doing this sort of research, I'd be more than happy to help out any way I 
> can, drop me a line offlist - [email-masked].

I'll definitely do that. I'm going to do some more work on the data during 
the coming week when more has been collected.

---

From: Pekka Savola <[email-masked]>
Date: Sun, 5 Oct 2008 18:47:28 +0300 (EEST)

On Sun, 5 Oct 2008, Mikael Abrahamsson wrote:
> Of the users getting v6 only gif from non-tunnel-space, 58% were from Proxad 
> (free.fr I believe), and then on the list came UNINET, SUNET, FUNET 

Total OS breakdown (including also v4only) would be interesting to 
show the popularity of the OSes in your user base.

What would be interestesting to know the percentage of Vista, XP, 
Linux, .. (and other identifiable OSs) that were IPv6-capable?

In particular I'd be interested in Vista and Apple (various versions) 
percentages, as those enable some v6 transition mechanisms out of the 
box AFAIR.

I'm puzzled at why Vista users are not more prominent in Teredo count, 
but Nathan already wondered about the same thign as well, and also 
that the teredo counts for v6only were so low compared to 6to4.  It 
smells as if something is not quite right somewhere.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 5 Oct 2008 18:02:21 +0200 (CEST)

On Sun, 5 Oct 2008, Pekka Savola wrote:

> but Nathan already wondered about the same thign as well, and also that 
> the teredo counts for v6only were so low compared to 6to4.  It smells as 
> if something is not quite right somewhere.

I just verified that my test server is reachable within Sweden via Teredo 
from my XP laptop anyway (I am behind another ISP and a NAT right now).

<http://ipv6.swm.pp.se> is located on the same machine as I use for 
hosting the gif:s, if you're out in the world and have IPv6 access via 
Teredo, please check and see if you can reach that page.

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 9 Oct 2008 17:21:00 +0200 (CEST)

I now have ~1 week of data, and I'll post updated figures.

> 0.5% of the users pulled the v4v6 gif using IPv6.

This still stands.

> 6% of the users were able to get the v6only gif.

Still the same.

> Of the v6only accesses, 91% were from 6to4 addresses, 7% were teredo and 2% 
> were from other ipv6 space. The "other ipv6 space" was from 58 different 
> /32s.

This changed to 89% 6to4, 9% teredo and still 2% native. 134 different 
/32s.

> 88% of 6to4 users run Windows Vista.

Changed to 86% of 6to4 being Vista, 10% XP, 4% OSX.

> AAAA DNS. This might be that it's slower, doesn't work, or simply that some 
> users clicked on a link before that gif was loaded. The gifs were loaded in 
> the order indicated above, with the javascript function "window.onload".

The page load difference shrunk to 0.06%, so I believe something was wrong 
before.

So, I see quite a few page accesses to http://ipv6.swm.pp.se via Teredo, 
did anyone encounter a problem to reach it? I still don't have an 
explanation to lack of Vista users using Teredo.

Could it be that XP by default runs Teredo when one does "ipv6 
install", and Vista has 6to4 enabled by default, but not Teredo?

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 09 Oct 2008 17:35:28 +0200

Mikael Abrahamsson wrote:
[..]
> Could it be that XP by default runs Teredo when one does "ipv6 install",
> and Vista has 6to4 enabled by default, but not Teredo?

One very very very big note here: NEVER USE ipv6 install.
Note that ipv6.exe is deprecated and will be totally removed in the future.

"ipv6 install" was indeed the method to use for the BETA versions of the
IPv6 stack, but it is different from what the final "netsh interface
ipv6 install" does, which is the one that one has to use.

Thus, if people want to install IPv6 on XP/Vista, either:
 - use the Control Panel -> Network Connections -> Interface
   and add the protocol like anything else,
or:
 - netsh interface ipv6 install

From what I understood (I am sure the Microsoft folks can enlighten us
here a lot ;) there are some nasty differences between the two, and I
have heard about people having broken setups with ipv6.exe while it
would work after doing a reinstall and then using netsh.

Greets,
 Jeroen

---

From: "Erik Kline" <[email-masked]>
Date: Thu, 9 Oct 2008 10:39:07 -0700

> So, I see quite a few page accesses to http://ipv6.swm.pp.se via Teredo, did
> anyone encounter a problem to reach it? I still don't have an explanation to
> lack of Vista users using Teredo.

One thing I've been wondering about is whether or not the client
actually tried and was, in fact, in the process of setting up a Teredo
connection but it just took *so* long that the state of the page
changed (the user navigated away, and thus the javascript was
stopped).  I remember hearing that some Teredo setup times can be in
the multiple 1000s of milliseconds depending on how close the nearest
server is.  Maybe this is not a factor in your region or for your
experiment.

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 9 Oct 2008 22:25:49 +0200 (CEST)

> server is.  Maybe this is not a factor in your region or for your

I've been thinking about this as well, but it doesn't really explain why 
98% of my teredo hits are from Windows XP, unless there is a fundamental 
different in the implementation between these platforms.

---

From: Truman Boyes <[email-masked]>
Date: Thu, 9 Oct 2008 17:23:58 -0400

On 9/10/2008, at 4:25 PM, Mikael Abrahamsson wrote:

>
> I've been thinking about this as well, but it doesn't really explain  
> why 98% of my teredo hits are from Windows XP, unless there is a  
> fundamental different in the implementation between these platforms.
>
> -- 

What are the other 2 percent of the teredo hits?

Truman

---

From: Mikael Abrahamsson <[email-masked]>
Date: Fri, 10 Oct 2008 06:13:32 +0200 (CEST)

> What are the other 2 percent of the teredo hits?

0.7% is Vista, 0.05% is OSX, 0.9% is "everything else".

---

From: Mikael Abrahamsson <[email-masked]>
Date: Fri, 10 Oct 2008 13:04:53 +0200 (CEST)

> 6% of the users were able to get the v6only gif.

Here, the OS distribution was as follows:

79% Vista
18% XP
5% OS X
0.3% Ubuntu
0.2% unspecified Linux
0.1% Windows 2003
0.02% Windows CE

The discrepancy in these numbers (> 100% total) are due to version strings 
such as this:

"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Mozilla/4.0 
(compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; 
Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 1.1.4322)"

This line will be counted both as NT 5.1 (XP) and NT 6.0 (Vista) in my 
figures above.

---

From: Matthew Ford <[email-masked]>
Date: Fri, 10 Oct 2008 12:52:32 +0100

On 9/10/08 16:21, Mikael Abrahamsson wrote:

<snip>

> explanation to lack of Vista users using Teredo.

I can see that page via Teredo from both XP and OSX systems. What are 
the chances of a correlation between non-NATed connectivity and Vista use?

Mat

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Fri, 10 Oct 2008 14:38:33 +0200

Quite similar to my own web measurements (http://www.vyncke.org/countv6/stats.php) 

IPv6-able (so both when IPv6 is preferred and when it is not)

OS                % of IPv6-able
Windows Vista     57.2
Windows XP        36.4
Linux (unknown)   2.6
Linux (Ubuntu)    1.4
Mac OS X          1.2
Unknown           0.5
Windows CE        0.4
Linux (Debian)    0.2
Windows Server 2  0.2

For Windows Vista: 15% pour Teredo, 9% 6to4 (% relative to the whole Vista population)
For Windows XP: 2% native, 2% Freebox, 0.5% Teredo

This means that more than 1/4 of Windows Vista has IPv6 connectivity which is both a good news and a bad news (meaning that Teredo does not work immediately -- perhaps because they are part of a AD domain or because the firewall has been disabled).

-éric

> Sent: vendredi 10 octobre 2008 13:05
> To: [email-masked]
> Subject: Re: some real life data
> 
> The discrepancy in these numbers (> 100% total) are due to 
> version strings such as this:
> 
> "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; 
> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 
> SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 
> 3.0.04506; .NET CLR 1.1.4322)"
> 
> This line will be counted both as NT 5.1 (XP) and NT 6.0 
> (Vista) in my figures above.
> 
> --

---

From: Nathan Ward <[email-masked]>
Date: Mon, 13 Oct 2008 20:42:39 +1300

Mikael, Eric,

Are you running Teredo relays close to your content you are using to  
test?

Mikael, are you able to share (privately if need be) the actual test?  
I'd like to look at how it works to try and see if I can see what's  
causing Vista/Teredo to not pick it up as much as I expect.

--
Nathan Ward

---

From: Nathan Ward <[email-masked]>
Date: Mon, 13 Oct 2008 20:49:40 +1300

> server is.  Maybe this is not a factor in your region or for your

I test for this by periodically (maybe every 5 seconds I think?)  
providing feedback with a javascript timer, until all the images on  
the different hostnames are loaded.

--
Nathan Ward

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 13 Oct 2008 14:36:20 +0200 (CEST)

On Mon, 13 Oct 2008, Nathan Ward wrote:

> Mikael, Eric,
>
> Are you running Teredo relays close to your content you are using to test?

Our teredo relay is sitting within 1ms from the "content" (ie, the machine 
serving up the gif:s).

> causing Vista/Teredo to not pick it up as much as I expect.

The code inserted looks like this:

<script language="javascript" type="text/javascript">window.onload=function(){
document.getElementById("IPV6TESTIMG1").src="http://ipv4.gofast.se/1x1blank-v4only.gif"
document.getElementById("IPV6TESTIMG2").src="http://both.gofast.se/1x1blank-v4v6.gif"
document.getElementById("IPV6TESTIMG3").src="http://ipv6.gofast.se/1x1blank-v6only.gif" 
};
</script>
<img src="1x1blank.gif" alt="blank 1" id="IPV6TESTIMG1"><br />
<img src="1x1blank.gif" alt="blank 1" id="IPV6TESTIMG2"><br />
<img src="1x1blank.gif" alt="blank 1" id="IPV6TESTIMG3"><br />

---

From: "Deepak Bansal (NETWORKING)" <[email-masked]>
Date: Mon, 13 Oct 2008 10:51:45 -0700

Can you pls replace one of the URLs below with actual IPv6 address and that should drive Teredo usage on Vista up. Windows Vista does not issue AAAA queries if the only IPv6 address it has is a Teredo address. Windows Vista will issue AAAA query if it has a 6to4 or native IPv6 address though. This will explain the relative usage of 6to4 and Teredo that you are seeing. Thanks.

---

From: Nathan Ward <[email-masked]>
Date: Tue, 14 Oct 2008 19:07:14 +1300

On 14/10/2008, at 6:51 AM, Deepak Bansal (NETWORKING) wrote:

> Can you pls replace one of the URLs below with actual IPv6 address  
> and that should drive Teredo usage on Vista up. Windows Vista does  
> not issue AAAA queries if the only IPv6 address it has is a Teredo  
> address. Windows Vista will issue AAAA query if it has a 6to4 or  
> native IPv6 address though. This will explain the relative usage of  
> 6to4 and Teredo that you are seeing. Thanks.

That would most definitely explain it.

Is this documented anywhere? I haven't seen any info RE this  
previously..

I guess the problem now is people with browsers that can't do IPv6  
literal addresses, do they throw an error if there are images in a  
page with those in the URL?
I guess it's possible to test what browser it is in javascript though.

> !DSPAM:22,48f39513202918524414327!
>
>

--
Nathan Ward

--
Nathan Ward

---

From: Mikael Abrahamsson <[email-masked]>
Date: Tue, 14 Oct 2008 09:17:25 +0200 (CEST)

On Mon, 13 Oct 2008, Deepak Bansal (NETWORKING) wrote:

> Can you pls replace one of the URLs below with actual IPv6 address and 
> that should drive Teredo usage on Vista up. Windows Vista does not issue

What do you mean by "actual IPv6 address"? I should put in the URL as 
http://[2a00:801::f]... etc? That breaks my vhost config on the webserver 
I'm using for this experiment.

> AAAA queries if the only IPv6 address it has is a Teredo address. 
> Windows Vista will issue AAAA query if it has a 6to4 or native IPv6 
> address though. This will explain the relative usage of 6to4 and Teredo 
> that you are seeing. Thanks.

What is the rationale behind this, and why was it changed from the XP 
behaviour which I find quite reasonable?

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 20 Oct 2008 07:11:27 +0200 (CEST)

On Mon, 20 Oct 2008, Nathan Ward wrote:

> I think a better approach would be to prefer A over AAAA if the client 
> only has teredo, instead of not querying AAAA at all. This way teredo is 
> still used for names with AAAA only.

This is the way XP works afaik. If your IP indicates that you're over a 
tunneled IPv6 connection, IPv4 will be preferred over IPv6, but if there 
is no IPv4 (A), IPv6 (AAAA) will be used.

I find this quite reasonable and thus my question why this was changed in 
Vista.

---

From: Pekka Savola <[email-masked]>
Date: Mon, 20 Oct 2008 13:38:50 +0300 (EEST)

On Mon, 20 Oct 2008, Mikael Abrahamsson wrote:
> tunneled IPv6 connection, IPv4 will be preferred over IPv6, but if there is 
> no IPv4 (A), IPv6 (AAAA) will be used.
>

My guess would be 1) broken DNS servers, load balancers, etc. causing 
timeouts (as documented in RFC4074), and 2) MS more clearly targeting 
Teredo as an overlay network rather than a transition tool, and 
overlay networks such as p2p systems have their own node discovery 
mechanisms.