Slashdot Mirror

Could it be that people who have a vested interest in the adoption of ipv6 are more likely to try and alarm us about the impending IP crisis?

No, it isn't. Read this to find out why.

Serveral ways.

(1) Official, legit way: become a member (fees required) of your RIR (Regional Internet Registry or something similar). Apply for assignment of unallocated space. Example is this fee schedule from APNIC
The downside here is that you can't get (and pay for) just a few addresses.

(2) Common, legit way: sign up for some kind of service package with an ISP and ask for however many IP addresses you want. You generally pay monthly or annually based on your service agreement and number of IP addresses.
The downside here is that those IP addresses aren't really yours. Your ISP just let's you use them and handles the routing for you. In some cases, you ISP doesn't even 'own' them... their upstream just lets them use the IP addresses.

(3) Hijack them. (a) start announcing bogus routes and hope no one notices very soon. (b) Hijack a RIR (ARIN, RIPE, APNIC, etc) tech/admin handle for an unused or under utilized netblock and then start announcing routes (you're a little more likely to be trusted this way).

How can an article about IP address exhaustion in ASPAC make no mention of APNIC, the authority assigned the task of regulating IP addresses in the region?

There should still be a fair amount of unallocated global space available which can be given to APNIC to be allocated to members (mostly ISPs), who then assign it to their customers.

I would say this is a non-issue.

I.

You have to be a really big ISP to get IPv6 addresses, at least in the Asian-Pacific region. Read section 5.1.1 of the APNIC policy on IPv6 allocation.

Know 200 clients who need /48s in the next two years?

...but this story is crud on so many levels.

• 3FFE::/16 is the experimental 6bone space, where you try out allocation policies before settling on a real one. They've settled on a real one. Even better, it's the same in all three (er, four) regions. The 6bone's purpose is fulfilled , we're in production mode and, as was always intended, it's time to think about retiring it.
• How many times: IP address don't cost money. Sure, the RIRs charge for the service of allocation, and your ISP is entitled to charge for the services around them. They do their job pretty well, and with consensus of the community (a rarity in this day and age). Great as Bob Fink is, do you really want to continue trusting address allocation to one guy as a volunteer project?
• You get addresses from your ISP.
• You get addresses from your ISP.
• You get addresses from your ISP. There are loads of them. If you need them, you can have them. The expense is not in getting the damn addresses. "Experimental" does not mean "free". "Production" does not mean "business".
• AftanGustur: IPv6 is not a bastard protocol, routers don't need to fragment anymore, and the IETF is not working on a new damn protocol. You don't cite any sources, so I can't refute it. Please do.

Guys, there are a lot of misconceptions about IPv6. I appreciate this - it's not an intuitive subject, and it's possible to believe you know a lot more about it than you actually do. But, the details are there. Please do the reading and start asking your ISP for connectivity. No, your real ISP. There are people out there who want to deploy this, now, and we're waiting for customer demand. Go nuts!

Dave

Well, based on the ARIN stats and APNIC stats that are made available to the public...

IP addresses (US): 1,847,483,219
IP addresses (Japan): 41,943,663
IP addresses (Canada): 61,747,968

The number of users is debatable, but make it, say, around 30% of the population of each country.

Users (US): 250 million x 0.2 = 50,000,000
Users (Japan): 120 million x 0.2 = 24,000,000
Users (Canada): 30 million x 0.2 = 6,000,000

Which means the ratio of IP addresses to population is:

US: 36.95 IPs/person
Japan: 2.573 IPs/person
Canada: 10.29 IPs/person

So, as you can see, Japan's getting a little desparate... hell, even Canada has five times more IPv4 addresses per user.

Yeah. I bet Microsoft has never thought of shipping software in Tamil or Hindi. They'd never think of making the support that either.

I was going to guess that the server itself was not in bhutan, but according to asia-pacific nic, it is... 202.144.155.2

Now that they've got that down, let's see how far they get sending C&D's to people based on APNIC.

Is listed here: http://ftp.apnic.net/stats/apnic/apnic-2002-07-01

Almost, not quite.

ICANN stands for "Internet Corporation for Assigned Names and Numbers". It is a non-profit set up a few years back to take over the duties of the Internet Assigned Numbers Authority.

One of these is the clerical duty of assigning /8 blocks of global IPv4 address space and /16 blocks of IPv6 address space to each Regional Internet Registry as needed. The users of the address space decide policy, and it's this policy that the RIRs implement.

Another duty ICANN took over is maintenance of the DNS root (which has been the controversial part), and a third duty is maintenance of the list of protocol numbers (imagine a link to your /etc/services just here - something's stopping me posting triple-slash).

Well, if you want to block spam why not start at home.

But if it's Asian IP address blocks you are after you can use this to start looking.

Try this link to get you back tracking on that IP: http://www.apnic.net/apnic-bin/whois2.pl?results=a ll&search=203.167.112.100+&whois=Go%21.

Anyone with a 100Mbps ethernet connection in a large office knows that the link speed alone is often not the limiting factor!

Furthermore, the assumption that the only, or primary, costs involved are the network termination equipment is simply incorrect. Yes, if we are talking about terminating a 10Gbps (or even 2.5Gbps) SONET or SDH circuits, there will be an expense. But, don't forget that the larger the network (i.e. the greater the number of "end-systems") the more intermediate systems (routers, switches, repeaters, etc) are required. Each one of these network elements then must be monitored and managed.

Now, if we assume that the service will be priced inexpensively enough for consumers to purchase, and that there is enough consumer demand for this sort of service; and if we can assume an inital customer penetration rate of, say between 1-10%, the number of network nodes in a city of 500000 is between 5000 and 50000. This is becoming a fairly expensive network to manage.

One possibility is that a city or other entity could build the fiber infrastructure and then lease "dark fiber" to service providers. This is the model deployed Stockholm, for instance. This approach has the advantage of shifting the expense of active network elements to the service providers, but now additional expense is introduced by separating the operation and repair of the fiber component from the transmission equipment (which still may be separated from the higher-level network-layer elements such as routers and servers).

Futhermore, consider the "peering problem" that will occur if many ISPs and internet users choose to interconnect with multiple IP networks: Through careful address allocation policies, the internet community (by means of regional routing registies like those provided by ARIN, RIPE-NCC, and APNIC) has constructed a hierarchical routing system that limits the growth of the size of routing tables on the core backbone routers in use on the internet. This is important for two reasons.

First, routers have a finite amount of memory. Even if memory is cheap, it still needs to be installed and perhaps increased from time to time. Each upgrade causes downtime as the router is taken out of service and upgraded.

Second, and perhaps more important, each provider advertises its network reachability information to others through a external routing protocol (BGP-4). The BGP process on each router must compute the shortest path to each network and inject that information in the router's fowarding table. The more complex the routing table, the longer BGP takes to update the fowarding table leading to network convergence issues. Also, since BGP-4 is mostly manually configured, an increase in complexity serval of orders of magnitide would require the development of new extensions to the system, this would be futher exasperated by the limitation currently imposed by the use of 16-bit autonomous system (AS) numbers which identify each administrative realm of routing policy. Someone will have to absorb the expense incured in the development and implementation of new rotuing protocols. Then, again, each core router will have to be upgraded.

Inexpensive broadband technology is still a-ways away. It will revolutionize the internet (and probably telecommunications, in general) when it becomes available, but that revolution itself will not be cheap.

erm, i meant to say -this directory- ...won't work without the www, maybe i should test it next time.

-matt

well, -technically- you might want to check out This TLD directory... LA actually stands for Lao People's Democratic Republic.. I can't stand how companys twist other countries TLDs to fit their need to fill their pocketbook and whore out TLDs that belong to another country as their own 'brand new TLD'.. that's just me though..

-matt

It sounds like these crackers are going to be only an advisory group to the Indian "Cyber Cop Force" talked about in this article, which itself is mostly advisory.
I don't see anything in the article that implies that these kids are going to be building firewalls. That, I agree, would not be a great security stategy.
But if they are, they're welcome to share their techniques with this kid from Minnesota who posts to slashdot. It's too cold up here to play outside.

In the Americas, go to ARIN; in Europe go to RIPE; in Asia and the Pacific, go to APNIC. (Some places, such as Mexico and Brazil, have separate arrangements.)

ARIN "allocate" numbers to ISPs and "assign" numbers to end users; but be warned that it costs Big Money to be assigned numbers directly (at least US$2,500 per year).

As you might have guessed from the article, APNIC seem to be cluefully ready to give out IPv6 addresses; ARIN are apparently talking about it.

In the Americas, go to ARIN; in Europe go to RIPE; in Asia and the Pacific, go to APNIC. (Some places, such as Mexico and Brazil, have separate arrangements.)

ARIN "allocate" numbers to ISPs and "assign" numbers to end users; but be warned that it costs Big Money to be assigned numbers directly (at least US$2,500 per year).

As you might have guessed from the article, APNIC seem to be cluefully ready to give out IPv6 addresses; ARIN are apparently talking about it.

You also have to keep in mind that ARIN, based in the US, allocates IPs, both for US-based entities and to overseas folks.

Err ... no, ARIN only allocates IPs for Canada, North America, and South America, hence "American Registry for Internet Numbers".

RIPE allocate IPs for Europe and Africa, whilst APNIC allocate addresses for the Asia Pacific regions, so the reliance on ARIN is not international. Obviously a proportion of root nameservers are located outside of the US too.

I find it interesting that even ISPs don't, in general, "own" their IP address ranges. For example, APNIC explicitly states in its Policies for Allocation and Assignment that IP addresses should be considered "leased", not owned. I dunno if anybody has succesfully "taken back" IP address ranges, though.

• It is worth noting that malicious, as opposed to merely badly-behaved, hosts, can overload the network by using many different source addresses in their datagrams, thereby impersonating a large number of different hosts and obtaining a larger share of the network bandwidth. This is an attack on the network; it is not likely to happen by accident. It is thus a network security problem, and will not be discussed further here.

Savage has done a good job on this. I think I see a way to stop the optimistic ACK attack (the hard case) with mods to the attacked end only, but it's ugly and needs more thought. The general idea is to introduce some randomness into the segment sizes sent, and if the replying ACKs don't reflect this, the ACKs are probably fictitious.

Another class of attack suggests itself. Streaming protocols over UDP are probably very vulnerable to attacks like this. If you can convince some video server that you have huge bandwidth, you may be able to get it to flood a section of the net. Those proprietary streaming protocols need a hard look.

John Nagle

Some whois servers :
America
Asia Pacific
Europe.

arin.net link to "rs.internic.net for domain related information" is broken :(