Slashdot Mirror
Dept. of Defense IPv6 Interoperabilty Test Begins
securitas writes "The Department of Defense has launched Phase I of its delayed IPv6 interoperability test (mirror) in a six-month project dubbed Moonv6. It is the largest North American IPv6 test ever and its goal is to evaluate IPv6 for 'network-centric military operations.'
Phase II was originally scheduled to begin in January 2004 but may be delayed due to the late start of the current test.
'IPv4 addresses are 32 bits long, enough for around 4 billion unique addresses.' In contrast, the IPv6 address length is '128 bits, or 340 billion billion billion billion unique addresses.'
Experts hope this will solve a predicted IP address shortage as more devices are created to use the Internet."
I hope the DOD isn't building a network larger than this, why the heck would they waste the money on millions of machines that would be needed to be larger than the 6bone was. I can see claims that it is the largest single entity deployment of IPv6 - now that would be a useful claim
I have mod points and I am not afraid to use them
IPv6 should eliminate NATs. The people who enjoy the false security (prevention of inbound connections) that NAT provides will keep using them.
However, I see no reason for most people to use them. With this many IP addresses, there's no reason why every connection can't be given 255 (or more) IPs. For example, I connect with my cable modem. Where's the hurt in giving me 255 IPs to use? If this is the standard, filtering shouldn't be any problem. And say I've got 10 computers on a LAN. Rather than use a NAT, I can simply assign every machine their own IP.
Every machine can now create incoming and outgoing connections on all ports, as they (and TCP/IP) were designed to do in the first place. This will be a wonderful thing for many home users who simply won't pay for more IPs, and for businesses who will no longer have to pay as much for many IPs.
IP address space is currently scarce. Limited supply with increase in demand = increase in price. IPv6 will dramatically increase the supply, decreasing the price, and making (most) everybody happy.
340 billion billion billion billion = 340*(10^9)^4) = 340*10^36 = 340 undecillion.
Rank Presidents by th
For anyone who wants to 'pronounce' the number:
, 45 6
2^128 is:
340,282,366,920,938,463,463,374,607,431,768,211
Which is:
340 undecillion,
282 decillion,
366 nonillion,
920 octillion,
938 septillion,
463 sextillion,
463 quintillion,
374 quadrillion,
607 trillion,
431 billion,
768 million,
211 thousand,
456.
You don't need to use NAT to set your firewall to deny access to your publicly-addressable fridge.
IPv6 improves upon IPv4 in a number of ways:
One of the principle design goals of IPv6 was to simplify the workload for routers. IPv6 achieves this in a number of ways:
1. Part of the reason that IP addresses are so long is that part of the address space is being used for an improved addressing hierarchy. In turn, this will allow routers to maintain much shorter routing tables.
2. IPv6 routers not longer fragment IP datagrams
3. IP Header checksums are been removed
As many people have noted, the IPv6 addressing structure supports a much larger number of IP addresses. Experts are predicting that the number of IP addresses required are going to increase enormously in a relatively short amount of time. Most people are familiar with cell phone adoption rates and the impact on IP address assignment. Potentially a more interesting example is the impact of new PC bus architectures on networking models. Intel has announced a new bus architecture titled PC-Express. What makes PC Expressing interesting is that it applies a data networking model to the PC bus. [Thinking addresses, flow control, retransmissions, etc] Where this gets interesting is that PC Express can be scaled from the level of a PC bus up to an enterprise class switching fabric. Once this gets widely deployed, there is no reason why the processor on one system could not control the video card on another. We are rapidly migrating to a model in which all sorts of peripherals - processors, sound cards, hard drives - will need to be configured with their own IP addresses.
IPv6 provides much better support for autoconfiguration. This is critically important for the consumer electronics manufacturers in the Asia/Pacific.
IPv6 requires IPSec, so we might finally get pervasive network layer security. I'll be very happy to get rid of abominations like "SSL VPNs".
There is a LOT of good stuff coming down the pike.
Ease of routing is the reason. With 64 bits you have to be careful how many IPs you give to each ISP. If you give too few you have to renumber or add disjoint addresses, polluting the routing table. If you give too many, you could still run out. You would also give just a few addresses to end users, say 256. That makes it impossible to do proper routing at the customer end, and addresses still have to be carefully assigned by hand or by DHCP. With 128 bits you can afford to embed the MAC address in the IP address, guaranteeing that it is unique. Goodbye to (stateful) DHCP.
Finally! A year of moderation! Ready for 2019?
The reason is that 64 bits are used for the network part and the remaining 64 bits -- automatically derived from the interface MAC address -- comprise the host part. This allows stateless autoconfiguration, which makes IPv6 networks easier to administer.
Yes, you can use hexadecimal numbers, and I think I'd recommend it too. :-)
::ffff:1.2.3.4. ::1 in shorthand form. ::0.
There are some "address concatenation" features/rules to make IPv6 addresses shorter.
- You can skip leading zeroes.
- One sequence of 16 bit blocks of zeroes can be replaced by a double colon -- "::", but not more than once.
Some examples:
- An IPv4-mapped IPv6 address:
- IPv6 address 3ffe:ffff:100:f101:0:0:0:1 becomes 3ffe:ffff:100:f101::1 in short form.
- 127.0.0.1 in IPv4 (localhost), i.e. 0000:0000:0000:0000:0000:0000:0000:0001 in IPv6, becomes
- 0.0.0.0 in IPv4 (anyhost), i.e. 0000:0000:0000:0000:0000:0000:0000:0000 in IPv6, becomes
Beware: In C++, your friends can see your privates!
NAT != firewall
In case you missed that, let me say it again:
NAT != firewall
NAT was not designed for security. It was designed to delay the end of the world until IPv6 could come and save it (OK, that's a bit of a parabole...sue me).
Firewalls are just as (in-)effective in a NAT-free environment. NAT is just as (in-)effective in a firewall-free environment. By exchanging NAT for IPv6, you aren't "giving up" any functionality, you're gaining it, and giving up a nasty kludge that never should have been invented.
It's time for NAT to die a long overdue death.
noah