Express.js req.ip is returning ::ffff:127.0.0.1

Question

I am currently trying to get the IP of the requested user. The problem is the IP is returning ::ffff:127.0.0.1 instead of 127.0.0.1. I tried using trusted proxy option (though not using a proxy) and the req.ips is blank. Using 4.x Express.js.

router.get('/', function(req, res, next) {
    console.log('ip', req.ip)
    res.send({})
});

`req.ip`, just tried `req.ips` as a test. I am just not sure what is causing the prefix `::ffff:`. — rockerBOO, Apr 02 '15 at 11:33
http://stackoverflow.com/q/5861107/1700321, http://en.wikipedia.org/wiki/IPv6_address#Presentation `Dotted-quad notation`. — Aleksandr M, Apr 02 '15 at 11:35
Yes this was it. Windows 7 has a transition layer in for IPv4 requests, and adds this prefix to the IP. — rockerBOO, Apr 02 '15 at 15:21

score 225 · Accepted Answer · edited Aug 31 '20 at 22:25

::ffff: is a subnet prefix for IPv4 (32 bit) addresses that are placed inside an IPv6 (128 bit) space. IPv6 is broken into two parts, the subnet prefix, and the interface suffix. Each one is 64 bits long, or, 4 groups of 4 hexadecimal characters.

In IPv6, you are allowed to remove leading zeros, and then remove consecutive zeros, meaning ::ffff: actually translates to 0000:0000:ffff:0000, this address has been designated as the IPv4 to IPv6 subnet prefix, so any IPv6 processor will understand it's working with an IPv4 address and handle it accordingly.

In the near future, IP addresses will all be IPv6, this is because we are nearly out of numbers (4.2 billion, minus some space for misc. purposes) in the IPv4 address space.

IPv6 allows for a much larger space. "340 undecillion ought to be enough for anyone" - Bill Gates speaking on IPv6.

It is important to start addressing IP addresses using the IPv6 namespace and therefore include the ::ffff: in your code because in the future there will be real hexadecimal data between those colons. If you strip it off for aesthetic reasons, your code will break when it switches to an IPv6 network or it's confronted with an IPv6 address.

Some networks are currently running IPv6 and you will soon be confronted with IPv6 IP addresses; make the leap now or risk breaking your code in the future.

The TL;DR (short) version of the matter is: Everything is working fine. Don't change it, it's the IPv6 version of an IPv4 address.

If you want to make your code compatible with IPv6, all you have to do is check for the ::ffff: prefix... if it exists, remove it and process the remainder as IPv4... if ::ffff: doesn't exist, it's an IPv6 address and needs to be processed as such. You can double-check by seeing if periods are in the string, if so, it's IPv4.

Keep in mind for everything but adjustments you need to make to IP addresses, you're just recording the IP, right? It's going to be important to the parser and log aggregates to expect ::ffff:127.0.0.1 and such in the future. Unless you need to alter an IP, just leave it as what you receive.

It sounds fairly dangerous to _check for the `::ffff:` prefix_, though. You know, an IPv6 has many notations. — Константин Ван, Sep 09 '19 at 10:34
No it's safe :) There is the proposal, and then there is the implementation. https://en.wikipedia.org/wiki/IPv6_address#Recommended_representation_as_text The IETF has recognized that routers cannot burn that many cycles looking for IP addresses, and also in the wild, nobody keeps the zeros because it's wasted space. The idea to allow the zeros was just an idea. In 2019 if you sent ::ffff: in a network packet as 0000:0000:ffff:0000, although technically valid for the original proposal, it's invalid for the current IETF recommendation as well as wont be seen in most IPv6 compatible routers. — Nick Steele, Sep 09 '19 at 20:02
So I can be sure about them always being in the _canonical_ forms. Didn’t know how things were going in the wild. Thanks. — Константин Ван, Sep 10 '19 at 01:33
This is common unfortunately. Humans pay attention only when necessary. Someone drafts something, the original design supports a lot of features, they make an RFC, nobody really pays attention to many parts of the design, it becomes a standard, then when implemented people notice big changes are needed :) IPv6 is a little odd because calling it "cannonical" is a little weird. They should probably call it "1.1" or something so people can quickly understand what's going on, but because the original draft's optional zeros makes you spend 10x more compute in routers, it was simply ignored. — Nick Steele, Sep 10 '19 at 16:38

score 45 · Answer 2 · answered Sep 13 '16 at 14:54

45

This seems to be a quirk of ipv6: for ipv4 addresses, ipv6 seems to mix ipv6 notation with ipv4 notation.

In order to get both ipv4 and ipv6 addresses in the simple, unmixed notation, I am using:

var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
if (ip.substr(0, 7) == "::ffff:") {
  ip = ip.substr(7)
}

answered Sep 13 '16 at 14:54

anneb

5,510
2
26
26

I have modify it little bit because `substr` is deprecated `if (ip.startsWith('::ffff:')) { return ip.substring(7) }` – Syed Qasim Ahmed Mar 07 '23 at 08:11

score 35 · Answer 3 · answered Oct 09 '18 at 15:04

If you just need IPv4, you could force the node server to listen using IPv4.

For an express app edit /bin/www:

change

server.listen(port);

to

server.listen(port, '0.0.0.0');

This worked for me at least.

https://nodejs.org/api/net.html#net_server_listen_port_host_backlog_callback

score 11 · Answer 4 · answered Apr 02 '15 at 15:20

11

Windows 7 has IPv6 enabled by default. Even though my server listens on IPv4 only, Windows 7 sends the ::ffff: prefix to the IPv4 as part of the transition to IPv6

::ffff:0:0:0/96 — A prefix used for IPv4-translated addresses which are used by the Stateless IP/ICMP Translation (SIIT) protocol.

Transition from IPv4

answered Apr 02 '15 at 15:20

rockerBOO

2,920
2
16
22

The question mentions `::ffff:0:0/96`, not `::ffff:0:0:0/96` – Finesse Sep 07 '21 at 04:42

score 10 · Answer 5 · answered Jun 17 '15 at 23:57

10

I was having issues with the trying to compare ipv4 mapped addresses, and found the ipaddr.js library helpful :-)

eg

_.isEqual(ipaddr.process('::ffff:127.0.0.1'), ipaddr.process('127.0.0.1')) === true

answered Jun 17 '15 at 23:57

Bryce

391
3
8

score 10 · Answer 6 · edited Aug 19 '20 at 19:42

10

Try this to get exact ip address by removing subnetting,

    let ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
    ip = ip.toString().replace('::ffff:', '');

edited Aug 19 '20 at 19:42

Michael Nelles

5,426
8
41
57

answered Jan 19 '19 at 01:39

MAREESKANNNAN RAJENDRAN

517
5
17

score -2 · Answer 7 · answered Nov 17 '17 at 12:42

-2

You can Get your Ip address alone or with The specified family using sockets

     var app = require('express')();

 app.get("/ip", (req, res) => {
        console.log(req.ip) 
       let ip = req.ip.split(':');
        let ip_details = req.socket.address();
          console.log(ip_details);                     
   // { address: '::ffff:127.0.0.1', family: 'IPv6', port: 3001 

           console.log(ip[3]);//127.0.0.1
                            res.json(ip[3]);  
      }

answered Nov 17 '17 at 12:42

muthukumar selvaraj

995
10
22

4

In case anyone is wondering why this has been down-voted, it's because this answer involves the host/server IP address and not the incoming IP address of the request. – tfrancois Nov 20 '21 at 19:44

score -2 · Answer 8 · answered Nov 01 '18 at 17:12

-2

var ip = req.ip.split(':').pop();

answered Nov 01 '18 at 17:12

Mateo Marin

265
3
8

As other answers explain, this is an IPv6 address. See @Nick Steele's answer above. You really don't want to do this. – Misha Nasledov Mar 08 '19 at 00:44
@Misha Nasledov, true, this will not work in IPv6 addresses – Tiago Rangel Jul 15 '22 at 08:37

Express.js req.ip is returning ::ffff:127.0.0.1

8 Answers8

Linked