Sale of IPv4 Addresses Hindering IPv6 Adoption 214
hal9000(jr) writes "While IPv6 day was a successful marketing campaign, is anyone really moving to IPv6? On World Launch Day, Arbor Networks noted a peak of only .2% of IPv6 network traffic. It appears that IPv4 addresses are still valuable and are driving hosting acquisitions. Windows 8 will actually prefer IPv6 over IPv4. If you want IPv6, here's what to do about it."
No need (Score:4, Interesting)
From the article:
"Transitioning to IPv6 will take much, much longer than anyone expects, mostly because there is no clear reason to move to IPv6 anytime soon."
Not everything works with IPv6 yet. Most stuff does, but most organizations still have some stuff that doesn't quite yet. It'd be great if it was all just transparent, but it's now.
Re: (Score:3)
Re: (Score:2)
You probably already have a link-level ipv6 address. If your ADSL modem is in bridged mode you have probably already exposed some services to your ISP :)
Re: (Score:2)
Re:No need (Score:5, Informative)
ip6tables is a doddle to use, and assuming you have a new enough kernel pretty much all you'll need will be a variation upon:
ip6tables -A FORWARD -i lo -j ACCEPT
ip6tables -A FORWARD -i $lan_if -o $upstream_if -j ACCEPT
ip6tables -A FORWRRD -i $upstream_if -o $lan_if -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -P FORWARD DROP
sysctl net.ipv6.conf.all.forwarding=1
(NB: you probably want more than that, but assuming your $lan_if and $upstream_if have appropriate IPv6 subnets on, and everything is routing correctly, then you get "the same behaviour you used to" when you had your IPv4 NAT... only now you have "real" end-to-end connectivity)
Re: (Score:2)
Re:No need (Score:4, Informative)
-i X means 'if the packet is inbound on interface X'
-o Y means 'if the packet will be forwarded (outbound) on interface Y
$lan_if and $upstrea_if are variables to which you've assigned the proper names for the interfaces conected to the LAN side and the Internet side (respectively)
# accept anything originating at localhost (this machine/router)
ip6tables -A FORWARD -i lo -j ACCEPT
# Allow outbound connections to be initiated by machines on the inside net.
ip6tables -A FORWARD -i $lan_if -o $upstream_if -j ACCEPT
# allow packets associated with aformentioned connections to come back in.
ip6tables -A FORWRRD -i $upstream_if -o $lan_if -m state --state ESTABLISHED,RELATED -j ACCEPT
# Drop anything else.
ip6tables -P FORWARD DROP
# Turn on packet forwarding of IP6 packets between interfaces. (off by default)
sysctl net.ipv6.conf.all.forwarding=1
This effectively gives you the same protections as an IP4 NAT setup -- but with none of the disadvantages. -- Like the fact that each machine on the inside gets it's own (external) IP address. This means that if you want you can give machines on the inside the ability to be servers (acccept inbound conections to the machine and port) without the NAT thing of also having to assign each machine an inbound (non-standard) port number.
Re: (Score:3)
This means that if you want you can give machines on the inside the ability to be servers (acccept inbound conections to the machine and port) without the NAT thing of also having to assign each machine an inbound (non-standard) port number.
It also means if you screw up.. your box is open to the net.
NAT acted as a pseudo-firewall because you had to explicitly forward to your box .. rather than the IPv6 approach of having to explicitly block.
Re: (Score:3, Informative)
NAT acted as a pseudo-firewall because you had to explicitly forward to your box .. rather than the IPv6 approach of having to explicitly block.
This only works if the attacker cannot send packets to the internal addresses, which is a dangerous assumption. I have seen several firewalls where only NAT was keeping them from being fully open. Standard security scans won't show anything wrong, but any attacker who can get onto the outside network has complete access to the inside. Suddenly your outside modem and/or router become your security perimeter, and they often fail miserably at that task.
Re: (Score:2)
I guess, but the same people who don't firewall at the box level are the same who arn't going to set up their gateway/firewall properly with IPv6.
I don't trust my cheap d-link router, but I like that if I screw up my shorewall config (I'm not cool enough for iptables direct) .. traffic probably isn't getting out of my network segment.
Re: (Score:2)
Yeah, ok. Now show me allowing a particular trusted subnet.
And why do I want "end to end connectivity"?
I still think the problem w/ IPv6 is it has moved addresses from "recognisable with repetition" length to "incomprehensible" length.
It's like that change to the 999 number in the IT Crowd:
TV Advert Narrator: [Voicing an Emergency Services advert] Has this ever happened to you? :[The old woman on the advert twists her ankle and falls down stairs, gets up and falls down second flight of stairs before picking
Re:No need (Score:4)
IP addresses were never meant to be used by the masses - and guess what, the masses don't use them.
Memorizing IPv6 addresses is a snap. First you learn you prefix (mine is something like 2600:103:b00[0-f]::), and then you have network blocks inside that. Yes, it's longer, but it's also globally unique.
Here's a "wasteful" but useful trick - imbed your VLAN IDs and IPv4 addresses inside your IPv6 addresses and then there is really nothing new to learn beyond your prefix.
Example: 2600:103:b001:53:10:250:250:1
2600:103:b001 is a prefix we use for DMZs. 53 is the VLAN number of our nameserver DMZ. You can probably guess what 10:250:53:1 is and what the corresponding IPv4 internal address is.
Another example: 2600:103:b000:207:10:2:7:156
2620:103:b000 is the prefix for one of our main sites. 207 is the VLAN (second floor, 7th VLAN on that floor, VLAN'd by department/use).
So long as you use IPv6 logically, it's really not hard to remember and recognize.
SLAAC/DHCP addresses should be registering in DNS (well, all of it should be). Use DNS for those semi-random hard to remember addresses. We have 100K+ electric meters with IPv6 addresses (small electric utility). I can look at the prefix and tell you if it is from our AMI NAN, WAN, LAN, or server networks, and what substation the meter is routing through. Natually I'll never memorize the SLAAC-based NIC portion of the meter address. DNS using the service point name is all I need.
[jason@its5156 ~]$ traceroute6 -n ami-jjr.mid.org
traceroute to ami-jjr.mid.org (fd7f:a4b6:4ee6:4:213:5001:0:6ac9), 30 hops max, 80 byte packets
1 2600:103:b000:207::1 0.651 ms 0.618 ms 0.882 ms
2 2600:103:b00f::1 2.085 ms 2.073 ms 2.487 ms
3 fd69:f556:4dba:4:213:50ff:fe02:23cd 76.485 ms 115.080 ms 165.136 ms
4 fd7f:a4b6:4ee6:4:213:5001:0:6ac9 2014.907 ms 2055.036 ms 2084.870 ms
fd69:f556:4dba:4:: is a LAN address going to substation 4
fd7f:a4b6:4ee6:4:: is a WAN address routed through substation 4's AP to my meter at my house.
999 (Score:2)
Help me out: Is this a joke, or real?
http://www.01189998819991197253.co.uk/ [0118999881...7253.co.uk]
Re:No need (Score:5, Informative)
I'm mostly wondering what to do about my iptables in linux.
The good news is that ipv6 has been available on linux for I donno a decade or so, and ipv6 tunnels have been available, etc. The ipv6 land rush is very much like people in 1997 talking about that "brand new" internet thing, and just like the great ipv4 rollout its a good thing there's a decade or so of sound traffic engineering experience out there already for ipv6.
1) I guess it depends a lot on your distro.
2) Some terms to google for beyond the obvious are "ip6tables".
3) nobody needs NAT on ipv6 which inherently provided stateful firewalling on ipv4. TCP is pretty easy, SYN packets only allowed in one interface...
4) Personally I find it easiest to make two firewall scripts a ipv4 and a ipv6. If for no other reason than totally screwing up ipv6 will not mess up your ipv4 access and vice versa making it simpler to recover from mistakes.
5) Good luck wrapping your head around the concept of "every host is a multihomed host" aka "link-local addresses". Please don't attempt to route LL out on the greater internet, mkay, they're for mdns / bonjour type stuff.
6) Good luck with dynamic addresses and revdns. If you never used BIND's ORIGIN lines well you best learn how, and quickly.
7) Please block all RH0 aka rt-type 0 packets they're the ipv6 evil bit
8) Go to Hurricane Electric (they rock in general, BTW) and become a sage ipv6 dude. I found this quite easy when they initially rolled this out several years ago, maybe its harder now. You need to do this "course" to learn the ropes and glossary before you can learn to firewall or you'll turn all sorcerers apprentice.
http://ipv6.he.net/certification/ [he.net]
9) Once you know ipv6 you could do worse than to start at
http://www.sixxs.net/wiki/IPv6_Firewalling [sixxs.net]
SIXXS is kind of like a major cell phone company, in that everyone's opinion of them seems exclusively driven by their local sixxs pop or their local cellphone tower quality. So you'll get meaningless comments all over the map about how they rock or suck based on the little neighborhood the commenter lives in. That said if you live in range of the Chicago pop, it rocks, although it had some exciting momentary outages a couple years ago. I use them on a dynamic endpoint and HE's tunnelbroker on a static endpoint and I'm very happy with both... your mileage may vary...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
How do I get me some ipv6 addresses?
That's kind of toward the end of my epic long post... to restate... what worked for me when I last set this up years ago. Both services are free.
Your ipv4 addrs is static -> Go to hurricane electric aka tunnelbroker.net no hassle just works very quick mostly painless.
Your ipv4 addrs changes every Fing time the cablemodem reboots, or so it seems -> Go to sixxs and they put you thru quite an amazing hassle to sign up but eventually you have perfect automatically re-connecting dynamic service.
You can ju
Re: (Score:2)
Not everything works with IPv6 yet. Most stuff does, but most organizations still have some stuff that doesn't quite yet.
That list is ridiculously short. Even my half decade old brother laser printer supports ipv6. The only barrier at this time in "my organization" is my openafs fileserver cluster doesn't support ipv6. Other than that...
Re: (Score:2)
Not everything works with IPv6 yet. Most stuff does, but most organizations still have some stuff that doesn't quite yet.
That list is ridiculously short. Even my half decade old brother laser printer supports ipv6. The only barrier at this time in "my organization" is my openafs fileserver cluster doesn't support ipv6. Other than that...
Unless you work in VoIP. Then then that list is "most of your non-commodity equipment and none of your carriers."
Re: (Score:3)
Equipment is probably the reason the carriers don't.
Yes, like I said "most of your non commodity equipment". While I could set up signaling with IPv6 using OpenSIPs or similar, the idea of running a bi-lat with a major carrier that way is laughable. Not to mention the fact that you'll pretty much have to B2BUA traffic going from v6 to v4 (since none of your other carriers support v6) or it will be an even bigger support nightmare. And as far as support nightmares go......none of the packet capture and analysis tools commonly used support v6.
VoIP (real c
Re: (Score:3)
I work in a messaging/transmissions service that interfaces with pretty much the whole world, one way or another. We recently did a survey and ... 80% of the software products out there in actual use with our products didn't quite support IPv6 fully yet. Oh, most were coming "soon", or in the next release, or in the roadmap for X .... but not yet.
Network level devices, routers, switches, firewalls, LBs, servers, storage, etc... have done a much better job of current revisions supporting IPv6. Now consider a
slashdot (Score:2)
ipv6 is coming to a slashdot near you.. soon!
Re: (Score:2)
Re: (Score:2)
I guess the easiest way to "support" IPv6 is by name alone...
ipv6.slashdot.org = 216.34.181.48
No IPv6 AAAA record for ipv6.slashdot.org
Buy an IPv4 Address Here!! (Score:5, Funny)
For sale, one barely used 127.0.0.1 ip address. $5000. First come first serve!
Re: (Score:3, Funny)
That address is like the village bicycle... or like all the villagers' bicycles.
Re:Buy an IPv4 Address Here!! (Score:5, Funny)
For sale, one barely used 127.0.0.1 ip address. $5000. First come first serve!
I'll show you. I'm going to launch a DDOS attack against that IP and then we'll see how much you can sell it f[NO CARRIER]
Re: (Score:2)
Just root it. Then you can install a nice trojan.
Re: (Score:2)
Re: (Score:2)
I have one too! I will sell it for $4999.99!
"here's what to do about it?!!!" (Score:3)
Re: (Score:2)
It's not a problem. (Score:2)
I've seen vines, ipxspx, osi etc fall by the wayside.
Really. Nobody cares about ipv6. It's not a problem, people like you are a bigger problem.
Why? (Score:3)
Re: (Score:3)
Re: (Score:2)
It will be, if you have a reasonable router (AirPort is one, but not the only, example) and your ISP uses something like DHCPv6 with prefix delegation. One day your ISP will say "hey, here's a v6 subnet!" and your router will go "alright, you guys (your devices) go ahead and pick one from this range". And it'll just work. If you don't have a new enough router, this won't happen, but it shouldn't affect v4 connectivity.
FWIW I've been running v6 at home for 5-6 years (through a tunnel), my university has it f
Re: (Score:3)
The consumer had to worry about the transition from leaded gas to unleaded gas. The consumer had to worry about the transition from analog TV to digital TV. The consumer had to worry about the transition from 7 digit phone numbers to 10 digit phone numbers (where applicable). Why shouldn't the consumer have to worry about IPv6?
No one cares! (Score:2)
Re:No one cares! (Score:4, Interesting)
Businesses will switch when IPv4 addresses get so expensive that there is no other option, and the ugly hack on ugly hack to maximize the use for them gets to a point where it isn't worth doing.
Call me crazy, but NAT, ugly as it is, may still be a useful tool. It isolates the internal fabric, so that regardless of what the external routers are talking to, packets get out. Does it improve security? NAT by itself doesn't, but that is what SPF, a good IDS/IPS, and proper segmenting is for.
IPv6 has been around for a long time now. You can't buy an IPv4 only device pretty much, as almost anything that has Net capabilities has at least a dual stack.
Re: (Score:2)
Re: (Score:2)
You can't buy an IPv4 only device pretty much, as almost anything that has Net capabilities has at least a dual stack.
IPv6 in LWIP [wikia.com] is still experimental. Every byte counts - I don't have a 1 GB DDR3 connected to a microcontroller. I may have only 64 kB of on-chip RAM for all the networking, on a good day. I already have to count TCBs and active connections. How do you suggest I add IPv6 support to existing and new devices?
Re:No one cares! (Score:4, Informative)
Until some new technology that everyone wants comes along and requires IPv6, no one will care about it.
The killer app for IPv6 is maintaining a global network of PEERS. It's what you or others don't have to worry about loosing which makes a transition more appealing than accepting status quo for eternity.
Content extracts value by reaching everyone directly without having to worry about degregation through additional hops/congested CGNs.
Service providers extract value by not having to operate expensive CGN.
Governments and LEA extract value by not having to deal with multiple devices cloaked behind a CGN.
Even partial deployment provides some value to all stakeholders.
It makes no sense for businesses to pay thousands on larbor to reconfigure their entire network for IPv6, and see no beneficial gain.
Nobody is suggesting they do. All they need to do is make their *external* presence accessible via IPv6. They can keep IPv4 internally forever for all anyone cares.
Not to mention a lot of legacy hardware still don't support IPv6, like network printers/copiers, camera systems, security systems, etc.
IPv4 is not going away anytime soon. IPv6 is being added. Noone is taking away your toys. You don't have to go out and buy new stuff.
Even if the global IPv4 network went away IPv4 private networks would still be avaliable. You could still tunnel your IPv4 network over IPv6 with anyone you chose to have access to it.
It also complicates maters worse when you try to network across long distances
Having more globally unique addresses complicates matters? I won't pretend I understand how this complicates matters more than attempting to communicate with two peers both stuck behind CGNs.
Re: (Score:2)
Lol (Score:5, Insightful)
Each and every one of you reading this is a customer of service providers and equipment vendors. It's time to use your voice and demand an IPv6 migration strategy that you can plan on.
On my walk in to work, there is this beautiful historic stone fence with cobblestone walk way for about a 2 block stretch... and demanding an IPv6 migration strategy I can plan on from it would likely be a better use of my time...
The article does nail the obvious problem on the head... the fact that IPv6 offers no benefit anyone cares about (we've learned to work with nat and even come to love it) except a solution to a problem that hasn't actually hit yet. Thing is this is the easy part. We all _know_ why IPv6 isn't being adopted. The hard part is how do we change that.. and "call up your ISP" is a really silly answer.
Re: (Score:2)
Current impact to most of the populations daily life: 0
And that's what it comes down to. People en-masse are reactive, not preventative. You can have all the charts and stats and proof showing that it's _going_ to cause huge headaches for everyone.. but until it actually does, nothing will be done.
We can either spend money and transition to IPv6 or spend more money managing the problem rather than solving it.
Big time on option 2. That's just reality.
Re: (Score:2)
And that's what it comes down to. People en-masse are reactive, not preventative. You can have all the charts and stats and proof showing that it's _going_ to cause huge headaches for everyone.. but until it actually does, nothing will be done.
This is irrelevent. People en-masse don't know what the heck IPv4 or IPv6 mean nor do they care. They just want their shit to work.
What do you mean the IP Stack on my PC or tablet or phone was updated to support IPv6 years ago? What is a stack? What is an IPv6?
What do you mean my ISP flipped a switch, pushed firmware or configuration and now I'm on IPv6? What is IPv6? I don't see anything different.
The transition does not require action on the users part. It will just happen at some point even if that
Re: (Score:3)
We can either spend money and transition to IPv6 or spend more money managing the problem rather than solving it.
Unfortunately IPv6 has a massive chicken and egg problem. We can't really start deploying v6 only stuff until most of the internet has moved to dual stack but there is little financial motivation to move to dual stack while there is virtually no v6 only stuff out there.
So for the foreseeable future the choice for an ISP that is short on addresses (or one that has decided that the market value of their addresses is greater than the "use value") is between deploying some form of ISP level NAT and deploying IP
Re: (Score:2)
NAT64 seems like a horrible soloution to me, protocol translation adds a load of complexity and afaict you have to mess with dns to direct users to your nat64 gateway (which breaks dnssec). I sure hope it doesn't become the default solution to the v4 address shortage but I fear you may be right that the mobile networks will pick it to simplify things at the device end.
Instructions? (Score:2)
Re: (Score:2)
IPv6 cons (Score:2)
Lacking toolsI have not seen any transition tools to allow a quick and easy remapping from IPv4 to IPv6. The existing blocks and their descriptions (you do put descriptions on your blocks don't you?) should be detected and re-tailored for IPv6.
DHCPv6 is a stupid idea (Score:2)
Unless you are an anal meta-administrator attempting to keep yourself employed, or a repressive government trying to keep your people firmly under your jackboot, everything should be done via stateless autoconfiguration.
Personally, I know I will not miss having to set up tons of hardware that's too stupid to assign its own address correctly.
Re: (Score:2)
Wait, is there something I'm missing here?
Under DHCP, admins don't assign addresses to devices manually, the device asks for an address, and it gets one. Is that jackbooted?
What is stateless autoconfig? A device asking every other device over the entire address range "do you exist" and can I take this number?
Prefer IPv6? (Score:5, Interesting)
Vista and Windows 7 "prefer" IPv6 too... Heck even Windows XP with its crappy IPv6 stack turned on prefers IPv6.
If you read the whole cnet article what has changed is network awareness sending an IPv6 only HTTP request periodically to a Microsoft server using this to judge if IPv6 connectivity is actually available.
In other words the behavior of all windows 8 systems on the planet with regards to IPv6 usage is dictated by the availability by a single Microsoft URL. What could possibly go wrong with that? Is it not also wonderful MS having their system ping out to MS servers by default periodically without anyone knowing or providing a user choice to turn it off not involving registry hacks?
With regards to IPv6 usage I just checked the interface stats on my gateway with an HE tunnel configured. Very interesting...IPv6 Internet traffic is a full 25% of overall Internet usage over the last 145 day period. This predates the June 6th IPv6 go live day by several months.
IPv6 = 32GB
IPv4 = 129GB
ISPs are still dragging their feet lighting up IPv6.. I fear we will have to wait another two years before most large ISPs get their act together on full production deployment.
The most interesting thing seems to be the "long tail" effect reflected in my actual usage.
Given current environment where just a handful of megasites are responsible for the majority of all Internet traffic by volume huge changes in traffic patterns can tip the scales on IPv6 usage rapidly while the countless millions of other sites run by the rest take just as long to switch over as the IPv6 naysayers say it will.
Useless Article (Score:2)
The "here's what to do about it" teaser amounts to, "complain to your ISP." Thank you so much. If only we had thought of that.
The article is useless.
IPv6 address = person? (Score:2)
We all know IP4 addresses don't identify a person. Will this change with IP6? With the "an IP address for every toaster" idea, will they still be dynamic enough for plausible deniability?
Here's an idea... (Score:2)
Give all the IP4 addresses away to China and other countries where botnets tend to originate most often, and make then NAT to get on the IP6 network the rest of us will live on when we don't own any of the IP4 space any more.
Why are mobile devices on IPv4 any more? (Score:2)
For mobile devices, the software is controlled by the carrier and the data path is controlled by the carrier, and the apps are controlled by the carrier or the handset maker. Mobile devices don't act as hosts. And all the growth in devices is in mobile. So why aren't they all on IPv6?
If the carrier has to do an IPv6 to IPv4 translation, they can do that at their head end.
Re: (Score:3)
Mobile devices don't act as hosts.
A company I've worked with has a deployed fleet of over 50,000 embedded commercial vehicle monitoring units that all allow back connections (ie. act as hosts) to request immediate status updates and send messages to the driver. Unfortunately, the majority of carriers don't have IPv6, so we're forced to play all sorts of games to handle dynamic IP address changes. And even more annoyingly, most of the carriers dynamically assign 10.x.x.x addresses to the units, so we have to jump through even more routing ho
.2% is not 'just a blip' (Score:2)
An Arbor Networks graph shows less than .2% of the traffic the company measured was IPv6. That's up from a peak of .04%, which occurred on the first Worldwide IPv6 Day in 2011; hardly a blip in a year.
That's a 5-times increase in a year.
If we pretend that we're business math students, then next year we'll see 1% -- then 5% in 2 years and 25% in 3 years -- which would be easily enough to trigger further network effects.
It all breaks down in the 4th year with 125% of traffic, but I'll just take that to mean that the remaining IP4 traffic will be encapsulated in IP6 packets by then.
ipv6 gaming ? (Score:2)
Sorry, my speciality is graphics + optimizations not networking. Question for the /. crowd ...
If I have a ipv6 address how do I guarantee all my "old" ipv4 games work ?
Is this a non-issue? I realize ipv6 doesn't have NAT, but are there any special configurations I need to do on the router if I switch my entire home network over to ipv6 ?
Thanks.
Already There (Score:2)
My company is already using IPv6 addresses. All of our sites have public addresses... as well as all of our desktops. All of our users now use Facebook and Google over IPv6. So... nothing will help me adopt it. Already done.
Every host a peer, and chicken in every pot (Score:2)
>All of our sites have public addresses... as well as all of our desktops.
(Not directed at you, but your adminstrator): How is this a good thing?
If your company wants to make stuff available (whether to the public or to vendors), it should do so on specifically defined servers. What's the point of making every desktop a peer?
That's sort of cool in a university environment, where you're there to learn, experiment, and play. But not in a corporate environment.
Re: (Score:3)
How is it a bad thing?
You firewall it just the same, so the only change in traffic flow is the lack of NAT, and NAT is not security despite what some people will try and claim.
Re:IPV6 == no security (Score:5, Insightful)
Scan your network topology from anywhere in the world?
See also: stateful firewall. NAT is not a firewall.
Re: (Score:2)
Of course not. However, if properly implemented, NAT can be one of the outlying parts of your firewall. If your router is set to drop all incoming connection requests, port scanners will never find your machines, making them that much safer. Yes, I understand that there are other routes in that this can't protect you from. That's why I called it part of a firewall.
Re: (Score:2)
Re:IPV6 == no security (Score:5, Informative)
Yes, I think worrying about someone scanning the 18,446,744,073,709,551,616 addresses in your /64 is a valid concern.
Re:IPV6 == no security (Score:5, Informative)
so with a 1ms response time, it'll only take 584,942 years to scan the pathetically small /64 my ISP has given me. Go for it hackers.
Re: (Score:2)
Still, brute force scans on IPv6 are not going to be very common I think.
Re: (Score:2)
Oh dear. I better put my web server at the LAST address.
Re: (Score:2)
That assumes that the addresses are not predictable. I believe that one proposal is to use the MAC address of the machine as part of the address. The OUI is fairly predictable based on market share (for example, realtek sells a rather lot of NIC controllers), so if you assume that the target is using a realtek NIC (or if you know what manufacturer they use), that knocks off 24 bits right there. That gets you down to 40 bits, and require only 1TB of bandwidth to scan. That is fairly cheap to do with a botnet
Re: (Score:2)
In response to 3 - or we no longer need dynamic IP's and can give everyone their own address, at which point it no longer matters what ISP you are using.
Re: (Score:2)
NAT is useful as an economic barrier to force people to pay a premium for a static IP.
Re: (Score:2)
at which point it no longer matters what ISP you are using.
Did I miss that part where home routers are all running BGP now?
Re: (Score:2)
Re: (Score:2)
On point 1 and 3, that is mainly not "NAT" but "routing".
You can put all your internal stuff in a Private IPv6 [simpledns.com] address range, then have one router in the network of the ISP that gives you your internet connection. Routing is a basic functionality of both IPv4 and IPv6, NAT is an ugly hack.
Re:IPV6 == no security (Score:4, Insightful)
Not true. Linux has a NAT implementation for IPv6 already. There's nothing about IPv6 that inherently prevents NAT. It just isn't necessary in nearly as many places.
Probably because in practice, encapsulation is "good enough".
Only if you aren't using NAT. Besides, with service discovery and SLAAC, chances are you won't have to reconfigure anything anyway.
No more so than any other piece of OS-level code.
Re:IPV6 == no security (Score:5, Informative)
1: No NAT, so an intruder can fire up a scan and find your network topology from anywhere in the world. Only way to deal with this is to tunnel to IPV4 then back again, which is a hack.
Maybe you should install FreeBSD then, it's pf has supported IPv6 NAT since 2010 [blogspot.com] (at least).
2: No support for packet level encryption. It is mentioned, but it is an option that vendors don't need to follow or bother with.
Which is how ipsec works now. In other words, you and your partner obtain compatible implementations and it works.
3: no address independence
See nat66 (or freebsd).
4: Unknown 0-day security holes. Just what we want... to relive the days of pings of death, land, teardrop, smurf, SYN flooding and other attacks.
Now it's true that there are probably buggy implementations, after all the implementations have only been around a decade or so and only 0.2% of the internet has used them. That's what, 10 people?
Re: (Score:2)
If ISPs are giving out /48's or /64's to users, I see it as a great opportunity to DDoS people again. Before, they had one IP address and if they changed their IP, you couldn't flood them off. Now, they get a whole range of IPs and you can easily get a bunch of PCs to just flood any address in that range - the bottleneck will be their connection. So unless they change their prefix (which probably won't happen too often), you could keep someone lagging out during gaming and they can't do a damn thing about i
Re: (Score:2)
Re: (Score:2)
You don't need to flood the whole range.. just one...
This is effectively like giving everyone static IPs.. as the prefix will likely be static.
Re: (Score:2)
IPv4 NAT can do 1:1 if you bother to set up the mapping (this is how "address independence" works: your internal 192.168.1.x network stays the same when you change ISPs, you just update the firewall with the new address mappings), and you could probably whack at iptables/conntrack on linux to get N:1 mapping in IPv4 as well (you need conntrack to get the return packet back to the right external IP). Even if it was easy, IPv4 just doesn't have the address space to do cool tricks like your automatic multi-ho
Re: (Score:2)
That's not unique to IPv6. Every Internet protocol, every web or database server is subject to that, along with many, many other programs. Changing to IPv6 doesn't increase the issue in the slightest, so it's not relevant.
Re: (Score:2)
1, nat and stateful firewalls are not the same thing (although you generally need a stateful firewall to implement nat), theres no reason you cant configure a stateful ipv6 firewall to block inbound connections and allow outgoing. the stateful firewall aspect is where the apparent "security" (or in reality, hiding) comes in, nat itself is just a nuisance which breaks things.
2, and this is a problem with ipv6 how? ipv4 doesn't have such features at all, and to enable it on v6 you only need support at either
Re: (Score:2)
1. It is trivially easy to configure a firewall that gives all of the advantages of NAT without the downsides.
2. Packet level encryption isn't mandatory in IPv4 either.
3. Use autoconfig like you're supposed to.
4. as opposed to what? Everything potentially has 0-day vulnerabilities.
Re: (Score:2)
Re:delays ... delays ... delays... nothing but del (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
As far as I can tell, yes. Or at least, they do in our office.
Re:delays ... delays ... delays... nothing but del (Score:4, Informative)
Re: (Score:2)
This is the price we pay for handing them out freely in the beginning and failing to force them to be treated as a public resource.
Ceding quasi-property rights in them was the big mistake that let early adopters scoop up loads of addresses for free and presently milk them for all they are worth. It's a black market that is paying monopoly profits to the hoarders of old.
This is nothing more than speculation in a cornered market.
Internet registries need to grow some balls and start seizing IP space that is b
Re: (Score:2)
Come to think of it, I don't really think IPv6 is going to fare any better if efficiency is not enforced.
The short answer is we have 16 billion billion networks (with many hosts on each), compared to 4 billion unique host addresses.
The longer answer (from someone at HE who has done the math): http://mailman.nanog.org/pipermail/nanog/2012-July/050298.html [nanog.org]
The calculation shows how long it might take to use up one eighth of the possible space. Our grandchildren can always change the policies at that stage. It depends what you mean by "efficiency", but it takes a lot of effort to run out when giving out /48s to
Re: (Score:2)
I have no problem with the free market treating them as quasi private property.
Except for the presence of early adopters that were allowed to hoard them in the days of plenty and are now collecting a windfall.
Re: (Score:2)
I always wondered why the ISP I worked at could just be handed a /16 for free .
They weren't. AS numbers cost money, as do IP allocations.
Re: (Score:2)
Actually, the cost of the address is not really proportional to the cost of giving it up as it is to the value that can be extracted from a desperate buyer.
Prices are high because demand is high and early adopters with a large hoard of addresses are effectively a cartel.
Re: (Score:2)
Re:Question, Why was IPv4 Even Allowed? (Score:5, Informative)
Perhaps somebody has an (expert) answer here to this question: Why was IPv4 even allowed or implemented in the first place? Did this have to do with computing and/or memory limitations back in the day (1974 to 1981) that nobody every thought could be overcome or even required? I know hindsight is 20/20.
I find it hard to understand how the researchers developing the IP protocol could think that 4.29 billion address would be sufficient given the scale of possible adoption in the future.
First things first: due to all of the reserved address ranges, particularly (what were once called) Class D and E addresses, there are fewer publicly routable internet addresses than ~4.29 billion. The number is ~3.70 billion addresses once you take the various reserved address ranges out [wikipedia.org].
With that out of the way, the world was a vastly different place back in the 1970's when IPv4 was first defined. The idea of everyone carrying a telephone with them everywhere was science fiction, and the notion that such devices would feature processing functionality that would be able to take advantage of being network-enabled probably wasn't even conceived. The personal computer revolution hadn't happened yet either. As you said, hindsight is 20/20. It's easier to see how we got to now from there than the other way around.
It's also worth keeping in mind that when IPv4 was standardized in 1981 ([RFC 791] [ietf.org]), computers were not particularly powerful; a state of the art desktop machine of the era would have little RAM, an 8 bit processor, and would run at less than 5Mhz. A device with an 8 bit processor would require at least 4 LOAD instructions to load an address from memory into registers, plus whatever processing would be required against the address (particularly for routing). Newer 16 bit processors (such as the 8088 and 8086) could do the same sort of processing with only two MOV instructions, but using a 128 bit address like in IPv6 would have required 8 bit systems to do a lot of processing just to handle the addresses -- you'd have to run 16 LOAD instructions just to read every part of the address into registers. This would be very significant processing wise for the time; I'd venture to say you'd need a supercomputer just to act as an IPv6 router back in 1981 (even with the limited number of hosts actually on the network). Memory would be a consideration as well -- 16KB fills up pretty quickly, so squeezing every byte out that you can would have been advantageous.
I'm also not particularly sure that the designers of IPv4 had a public Internet in mind. It wasn't until the early 1990's that the Internet was generally opened to commercial use; prior to that it was limited to government and research use. I don't think in the mid 1970's when Robert E. Kahn and Vint Cerf started work on trying to unify the various networks then in operation, that they considered that people would have a dozen or more Internet enabled devices in their homes (at current count there are 24 IP enabled devices in my home, although I certainly don't claim to be typical). That is, the "purpose" of the protocol at the time wasn't to provide a pervasive network that covered the globe, and the idea of 2^32 hosts was probably completely inconceivable. IPv4 has since invention been shoehorned into uses and purposes that were never conceived at the time of its invention. Indeed, considering how many protocols were being invented, and how quickly new iterations were being introduced, it probably wasn't expected that the world would still be using IPv4 over thirty years after it had been first defined.
IPv4 is getting to be a creaky, old technology with all sort of band-aids applied to it over the years. It is time for replacement -- the research and development community has been saying so for fifteen years or more. Unfortunately, the momentum behind IPv4 is massive, and entrenched inte
Re: (Score:2)
Check this link: Why IPv6? Vint Cerf keeps blaming himself [networkworld.com]
Re: (Score:3)
Instead of properly standartizing NAT they removed it, with the argument that there are enought adresses now.
Well, if you used Nat for anything else than adress space expansion, like multihoming, topology hiding, ... you are f**d with ipv6.
To understand why this is not true requires us to parse what is meant by "NAT". Not all "NATs" are created equally.
1. NAT where 1 IP is being used by a boatload of hosts. (1:many)
2. NAT where each host has a corrosponding mapped address. (1:1)
With IPv6 only the first case is dead. The second case is still very much possible.. for example via snat target in ip6tables.
From systems perspective there is a big difference between deterministically rewriting IP headers (#2) which is quite trivial vs fancy ALG c