LAN Turns 30, May Not See 40?

dratcw writes "The first commercial LAN was based on ARCnet technology and was installed some 30 years ago, according to a ComputerWorld article. Bob Metcalfe, one of the co-inventors of Ethernet, recalls the early battles between the different flavors of LAN and says some claims from the Token Ring backers such as IBM were lies. 'I know that sounds nasty, but for 10 years I had to put up with that crap from the IBM Token Ring people — you bet I'm bitter.' Besides dipping into networking nostalgia, the article also quotes an analyst who says the LAN may be nearing its demise and predicts that all machines will be individually connected to one huge WAN at gigabit speeds. Could the LAN actually be nearing the end of its lifecycle?"

Re:As long as the need for a secure network exists

[jayhawk88]

My thought exactly. When I first started working for the company I do now, every one of the workstations on campus had a public IP address. And then all of the sudden people started getting Net Send messages for Viagra.

I don't want every computer in the world to be able to see my computer, at least not directly. Perhaps I'm missing a point here but seems to me that as long as there is a need for firewalls, there is going to be a need for LAN's.

Re:Well, could it?

[russotto]

You should have been using RG-58 and 50 ohm terminators... things work much better with the right equipment.

NAT != Firewall.

[SanityInAnarchy]

There's nothing more to say to you until you get that one, crucial point: Firewalls do not have to be NATs, and NATs don't have to firewall. And you need a firewall whether or not you have a NAT.

Once you do, understand that NAT is a brutally ugly hack. It's much easier and more powerful to simply be able to open a firewall port than to have to forward ports.

And you do need a firewall on your computer -- that, or just turn services off. If you don't do one of the two, wireless will bite you someday.

Re:WAN, SCHMAN

[Anonymous Coward]

Who the fuck said anything about wireless?

http://en.wikipedia.org/wiki/Wide_area_network [wikipedia.org]

Re:As long as the need for a secure network exists

[m50d]

You think their LANs are secure?

Seriously, in a corp that big, your machines need to be as secure as if they were on the internet anyway. You can't and won't secure that much cable, building and personnel.

I think LANs will continue to exist out of sheer practicality though. What's easier, wiring up every computer in the building to the internet, or wiring the building computers together and then getting internet to one of them?

Now the old guys come out of hiding.....

[lugannerd]

ArcNet - Proprietary(DataPoint) 1Mbps - token passing protocol via bus topology on coax
Token Ring - IEEE 802.5 - 4/16 Mbps - token passing protocol on star wired ring topology on SPT/UTP
Ethernet - IEEE 802.3 - CSMA/CD - 10Base5 Thicknet(500 meters) - 10Base2 thinnet (185meters) 4 repeater rule - 10Bt, 100Bt, 1000Bt (100m)
FDDI - ANSI X3T9.5 - Token passing protocol - ring topology on fiber - Supported UTP
ATM - ATM Forum - SONET physical layer - Ring/Star topology - uses OC-X speeds and feeds - 25mbps copper spec

And the LAN winner is Ethernet because of simplicity, scalability, installed base and cost. Other technologies such as ATM were so much more superior and elegant but too complex and costly for most IT shops.

Re:Lies, Damn Lies, and Token Ring

[Intron]

You still send 8 bytes of preamble, which is the part of the packet needed for collision detect, and have an interpacket gap, even on a switch. All that the switch does is prevent you from sending all packets to all branches, it doesn't eliminate the collision detect timing. On fibre channel, packets can be closely spaced because idle characters keep synchronization.

The usual Nonsense...

[gweihir]

...from people that do not unserstand how tese things work. The LAN is not about technology. It is about hierachical organization, proplem encapsulation and cost. These factors will not go away, wery likely not ever.

Re:WAN, SCHMAN

[ThinkingInBinary]

That being said, I completely disagree with the author. There is no way that companies want to put all thier servers (not to mention clients) directly on the Internet. Firewalls will always exist for security reasons, and thus so will LANs.

Well, there is a middle ground. Most of the "security" from firewalls today comes from the fact that a public IP will have just a handful of ports forwarded to an internal box, and the services on the box will be listening on the LAN IP. Basically, NAT of various sorts protected everything by default, and you forwarded what you want. Once IPv6 becomes widespread, firewalls will simply restrict the data going in and out, rather than redirecting it to different IPs and/or ports. There will still be home routers/firewalls, but (hopefully) all the boxen behind them won't hide behind their (the routers') addresses.

Re:WAN, SCHMAN

[Drencrom]

Firewalls will always exist for security reasons, and thus so will LANs

A firewall does not require NAT to be secure.
You can have a firewall in the router with public IP addresses on both sides and it will still work just fine.

Re:WAN, SCHMAN

[sumdumass]

What are the advantages to having them on one of the IPv4 non-WAN-routed addresses that are currently used for LANs? If you're setting up a new LAN, would you prefer to have two address groups, have to set up port forwarding etc, or just allow unrestricted inbound access between your two offices? Would you prefer to plan out all of the separate addressing and how they relate to the computers, maintain a MAC-to-IP table, or go off of IPv6's stateless-IP address allocation scheme that merely suffixes the local device's physical address (i.e. MAC address) to the site's preffix?

How much is it going to cost per month or year to have a public ipv6 address. You can't say nothing because they will have to be allocated by someone in some way that not only tells routers where to direct stuff but to ensure that your traffic in LA isn't being routed to the same IP in Bermuda or Russia. Second, with a traditional lan, and even an IPv6 lan, you can add security by not only restricting incoming packets but by ensuring private packets don't get exported to the Internet and when they do, they get dropped by the first router that picks them up as not rout-able. And added set of security features, however weak they might be but would be done away with.

What's the difference between it having a non-WAN routed IP address that's reserved in IPv4, and it having a globally route-able but not routed IPv6 address? Doesn't this potentially enhance your cable provider's ability to provide service/support (and of course their ability to limit you, which they'd find a way to do anyways?)

The big problem with appliances like the Tivo or your refrigerator having a public IP is the possibility for attack. Imagine your Tivo spending all it's resources filtering and dropping packets instead of showing the anti women movie playing or the presidential election debates or CNN news's coverage of some event. Imagine your fridge crashing or being hacked and adding Snazzle juices to your shopping list instead of snapple. I know the fridge example is stretching it a bit because no one is using them right now.

If aa:bb:cc is your home's site prefix and your computers/devices are aa:bb:cc:01 aa:bb:cc:02 aa:bb:cc:03, then how is it a problem to have inbound routing enabled between aa:bb:cc:* but not from your neighbour, aa:bb:dd:*? or !aa:bb:cc||aa:!bb:cc||aa:bb:!cc

It doesn't exactly work that way. The vast majority of people won't know how to effectively limit the traffic. This is illustrated by the vast amount of people who don't properly do it now with a less confusing architecture.

Not only that, you will lose all the addressing space that makes IPv6 so attractive by doing it that way. As of 2000, there were more then 105 million households in the US alone. Now attempting to give every household a home address so they could route all their other equipment without using subneting or private ip addresses like the "FE80:" prefix would result in a vast majority of IP being none usable after the home block. This isn't even starting to consider the large companies or even small businesses which presumably would have a "home" address as well as larger blocks for the 5 hundred or more terminals inside a single building and all the network printers, copy/scanner machines, postal scales, X11 lighting fixtures and so on. The demand is huge but the waist in assigning minor blocks to every home or Internet connection system like that is worse. Then when you consider the unicast, multicast, loopback and other IP reservations within the IPv6 spec, multiply the number of people/house holds and businesses in other countries and you will soon see how this seemingly unlimited addressing will become as obsolete as IPv4 with all the waist involved. The spec for IPv6 has a private IP space built into it for a reason. And this spec uses a prefix instead of site level aggregation for a reason too. That reason is that it was never meant to connect everything publicly, it was only meant to fix problems with the IPv4 schema and make it last well into the future..

Re:NAT != Firewall.

[TheThiefMaster]

See post:
http://it.slashdot.org/comments.pl?sid=437480&cid=22259056 [slashdot.org]

IPv6 is allocated in blocks of /64 (64 bit) or /48 (48-bit) depending on how stingy your ISP is. You don't get one IP, you get BILLIONS.

Which is better, having a single external IP which responds to maybe 30 ports out of 16k, or having 18,446,744,073,709,551,616 (64-bit) or 281,474,976,710,656 (48-bit) external IPs, each of which may or may not be a machine, and even if it is it may not respond on any port.

If you want security by obscurity, IPv6 is most definitely the way to go. If you only searched a single port (eg looking for a insecure internal website on port 80), and the company only had a /48 address block, and you tried to connect to one address every thousandth of a second, it would still take NINETY CENTURIES to find. If the port is also unknown, you're looking at 16,000 times longer.

As opposed to port-scanning a single IPv4 IP, which even at 1 per second (1000 times slower than the above example) is done in 5 hours.