Slashdot Mirror


Dispelling the IPv4 Address Shortage Myth

Zocalo writes "While looking up some WHOIS information at RIPE just now I noticed a couple of articles about the IPv4 address space allocation status. IPv4 Address Space: October 2003 is a short summary by RIPE themselves, and IPv4 - How long have we got? is from July 2003, but has lots more detail and pretty graphs! In short, the "Death of the Internet" due to lack of IP space is a myth, which doesn't bode well for getting IPv6 rolled out any time soon."

77 of 505 comments (clear)

  1. just remember by Anonymous Coward · · Score: 2, Informative

    Class E addresses are still under the "Reserved for Future Use" mantra.

    1. Re:just remember by JWSmythe · · Score: 4, Informative

      I finally took the CCNA class. Been working with the Cisco hardware for years, but finally took a class. I couldn't get the routers to assign class E addresses.

      But, for those that don't know, the CCNA book says:

      Class A 0.0.0.0 to 127.255.255.255
      Class B 128.0.0.0 to 191.255.255.255
      Class C 192.0.0.0 to 223.255.255.255
      Class D 224.0.0.0 to 239.255.255.255
      Class E 240.0.0.0 to 255.255.255.255

      Class D are multi-cast, which I don't believe very many people use..

      Class E are "Scientific Purposes" or "Research".

      I was running a little personal project a while back, to try to find logical distances from various points (places I had access to machines) to other places, and try to map them, to determine if there were more advantagous places to put servers, or redirect customers on particular networks to particular servers.

      A whole bunch of those first /8's don't have anything in them, or at least nothing reachable by a couple different methods. My tests weren't completely exhaustive. I didn't try every port on every IP. I just did a sampling of IP's for a few different ports and packet types. So, there are a whole lot of unused IP's out on the Internet.. Looking at the logs of some of our sites, with over 1 million uniques/day, you can see where the IP's are clumped up, and huge gaps in the usages.

      Of course, if I was the network god of 3.0.0.0/8 (General Electric), and I was only using say 100,000 IP's, they'd be hard pressed to make me give up any part of that, especially in knowing that they've had that block since the first days of the Internet. Whois says they registered 3.0.0.0/8 in 1988. I definately wouldn't want to be the admin that had to change 50,000 IP's.

      I guess it does help with the old estimates, that people are using NAT more frequently. The stories I heard years ago said we would have run out long before Y2k, but since people run NAT's at home and many offices. Nextel has assigned IP's to every phone (ahhh, the wonders of the Internet), but they're all 10.0.0.0/8 .

      For example, on my phone, I select

      Menu -> More -> My Info -> Carrier IP

      And it shows me 10.154.85.xxx

      Using a Nextel im1100, I also get assigned an IP in the 10.0.0.0/8 network.

      For those that don't know, 10.0.0.0/8 is a private network. You can use it any way you'd like, but it's completely useless to you on the Internet unless there's a NAT or something between you and the rest of the Internet.

      --
      Serious? Seriousness is well above my pay grade.
  2. 4,294,249,958th post. by Anonymous Coward · · Score: 3, Funny

    The last post possible, Please upgrade to SlashV6 to post more.

  3. Grab em! by zyridium · · Score: 5, Funny

    I'll take all the addresses I can :-)

    If I get enough for free, we will have to use IPV6..

    I think I want a screensaver where each pixel has an ip, and then we can replace X with a simple protocol just sending colors!!

    1. Re:Grab em! by zyridium · · Score: 4, Funny

      X sends higher order primitives, true.

      My super-leet replacement would not.

      We are talking about replacing X, remember. This is an important aspect of the grand plan.

      Should I apply for a patent?

    2. Re:Grab em! by Cheeko · · Score: 2, Informative

      I think HP has a lead on you. At last check they had both the 15 (HP) and 16 (DEC) Class A's and a few class B's. So thats a whole lot of the total address space right there. Better start buying up old tech companies :) Among others that I can recall IBM, MIT, and Berkley also had class A's.

      This point was somewhat unclear in the article. He mentions how assignment has moved away from the class licenses, but as far as I know, HP anyway, still maintains control over all of the 15 and 16 addresses. I believe something like 1/4 of the total address space was allocated to companies and organizations (DARPA, etc) initially. Though this may have changed in the last year or two, if so please feel free to correct me.

  4. Good articles by Anml4ixoye · · Score: 4, Interesting

    I enjoyed both of the articles. The question I have is this. With the number of networks now being NATed and the such, will we ever truly need something like IPv6? It seems like whe I hear about it, the talk is always that every device will have a unique IP address. But what I see is that large deployments of devices needing IP addresses are more and more being done using 192.* or 10.* addresses. Anyone else have more insight?

    1. Re:Good articles by lemmen · · Score: 5, Insightful
      The need for IPv6 is _not_ shortage of IPv4 addresses, but you find it in the extra features in IPv6 (Build-in security, Automated addressing, etc).


      Check this presentation: mms://webcast.ripe.net/ripe46/plenary-2.wmv

    2. Re:Good articles by Branc0 · · Score: 5, Insightful
      IP addresses are more and more being done using 192.* or 10.* addresses.

      This is done because we have to, not because we want to. If IPv6 was a reality today i would put many machines with a public IP address that today are behind NAT.

      --

      rm -rf /home/leia

    3. Re:Good articles by Anonymous Coward · · Score: 5, Insightful

      For philosophical reasons, there's some opposition to the mass NAT-ing of the Internet; it tends to break the equality between computers, creating the artificial distinction between servers and clients (just imagine all the pain you have to go through to use your favorite P2P/game/whatever behind a NAT router). IPv6 will solve that, although NAT will probably continue for other reasons.

    4. Re:Good articles by Mysticalfruit · · Score: 5, Insightful

      My insight is to say that your right on the mark. NAT killed IPv6. Also, now with the focus more on security, more people are seeing isolated networks with single points of IDS monitoring as solid solutions to security. Hence people put everything on a non routable blocks of IPs and put a snort NAT box at the head end.

      --
      Yes Francis, the world has gone crazy.
    5. Re:Good articles by Firehawke · · Score: 5, Interesting

      NAT is a quick and dirty hack that has to be updated for newer, complex protocols-- it wasn't until fairly recently that NAT would actually deal decently with FTP, but it requires mangling the packets.

      In the end, the only truly STABLE method for addressing is just to have real IP addresses. NATs just add points of failure and complexity in diagnosis.

      It doesn't help that Microsoft's own implementation of the system is nearly impossible to configure-- since NAT is useless for servers, you're only going to see it on clients, and there's your #1 most likely NAT solution to see.

    6. Re:Good articles by Anonymous Coward · · Score: 2, Insightful

      There's not really a shortage as in "we will run out of addresses in X years". But that's because RIPE, IANA, etc. are being so stingy with IP addresses. Many people are not using NAT by choice, they are using it because they can't get a suitably-sized IP block. It's a pain in the ass - small companies with 50 computers are lucky to get 8 IP addresses. They might get another 8 if they demonstrate the need, but then they'd be advertising multiple IP blocks, bloating the internet's routing tables. And if every computer had a globally routable address, we probably would run out of them.

      We won't truly need IPv6, but you could say we don't truly need the internet either. IPv6 should simplify things like address assignment and routing. It has some other benefits too, like built-in encryption (IPSEC) and multicasting.

    7. Re:Good articles by talon77 · · Score: 4, Interesting

      Nonsense, I think most of us do it because it makes good sense. You don't want your local network having a public IP address, even if you do have a firewall and the best IDP system available. Why create the risk? And even if you have a public server with a public IP address, most firewall's require you to NAT the public IP address anyways if you are nat'ing anything behind the firewall. (usually you nat it to itself, but nat'ing none the less)

    8. Re:Good articles by CausticWindow · · Score: 5, Informative

      There is more to IPv6 than a larger address space. The address space issue is just what is commonly pushed, since it's something that's easily grasped even by non-techies.

      The true benefits of IPv6 are things like; improved routing, multicasting scope, greater flexibility in what packets contain, flow labeling, privacy and authentication.

      Especially flow labeling will be important if the net is going to be a source of media. Streams could get a higher priority, so low latency and glitch free audio and video can be possible. Makes me wonder if this couldn't be abused though.

      --
      How small a thought it takes to fill a whole life
    9. Re:Good articles by leerpm · · Score: 3, Informative

      NAT does nothing that any decent real router/gateway cannot do as well. You install a router at the entrance to your network. It hands out REAL IP adresses to your hosts, and you put rules in your router that say 'drop TCP/UDP packets that are heading for port 1024', excluding those hosts that you want to run web/email/SSH on, etc.

    10. Re:Good articles by splatter · · Score: 2, Informative

      Survey says........ WRONG... try reading the article. I know it's a lot to ask , and that this is /. but just try before posting.
      I quote
      it has been suggested that Asia will experience an IPv4 address shortage before other regions. This is simply not true.

      --
      "(I) have this unfortunate condition that causes me not to believe a single thing any politician says when a mic's on.
    11. Re:Good articles by mjh · · Score: 4, Interesting

      The biggest problem with NAT is not for the home user. It's for corporate users. If you're a medium sized or larger business, there's usually some third party that to whom you have to make a connection. If you've got all of your internal network running on RFC 1918 address space, and they've got all of their network running on the same address space, you're almost certainly screwed. You can hack it with dual NAT but it's almost always a maintenance nightmare to get it working right.

      IPV6 is needed because RFC 1918 is a bandaid. We need to have globally unique IP addresses, whether we expose those IP addresses to the internet or not is irrelevant.

      --
      Key to financial independence: Spend less than you earn. Save and invest the difference. Do it for a long time.
    12. Re:Good articles by Minna+Kirai · · Score: 5, Informative

      wouldn't you have to run some sort of firewall on each individual machine, rather than just the gateway/router?

      No. The questions of whether computers on a LAN have their own IP addresses and whether they are firewalled by a dedicated box are independent. Even if each machine has an IP address by which it is publically addressable, you can still have a system which protects it by blocking known-dangerous ports.

      The advantage of a situation like that, for instance, would be that you could have the firewall block file-sharing/RPC ports, while still allowing port 80 inbound so the individual machines can run webservers. With a NAT, only one local system could have a webserver, and you'd have to configure which one got it on the firewall.

    13. Re:Good articles by nsxfreddy · · Score: 2, Insightful

      What happens when the number of addresses available in 192.168 or 10. runs out? If we continue to move toward embedded devices with IPs, more computers, more servers, more , it's not that unlikely that a corporate NAT would get filled up. What do you do then? Start NATing the NAT? Each person gets their own NAT box and a single 10. address that then gets NATed to a single corporate address?

      I guess the solution then is to switch to an IPv6 NAT... but then why not just switch to IPv6 and not have to worry about NATs anymore? If you want a NAT for the security features, go ahead, but if you use NAT just because you can't afford/don't have anymore IPs, then IPv6 is better.

    14. Re:Good articles by kwerle · · Score: 2, Informative

      You don't want your local network having a public IP address, even if you do have a firewall and the best IDP system available. Why create the risk?

      That argument makes no sense.
      1. The parent poster clearly DOES want to have more public IP addresses. So do I.
      2. Do you block all outbound connections from your NAT'd machines? That's the only way you could be more secure than blocking all inbound connections using a firewall.
      3. If you want to keep NATing, go for it. IPv6 ain't gonna stop you.

    15. Re:Good articles by Marillion · · Score: 2, Informative

      Most of the $100 DSL/Cable appliances from Linksys, Belkin, 3com and similar vendors perform NAT out of the box. Plug it in and go. They DHCP to the ISP to get the public address and provide RFC1918 addresses internally via a built-in DHCP server. For small/ customers who don't have static address from their ISP, these devices also provide IP address stability internally. I can assign printers static addresses and know that I won't be subject to the whim of the dynamicly assigned number from the ISP. Most home users are probably unaware, at least at any level of detail, of the fact that they are being NAT'ed. I've even recommended these devices to people as cheap firewalls.

      --
      This is a boring sig
    16. Re:Good articles by E-Rock · · Score: 3, Informative

      Not exactly. If you have a professional grade NAT device you can bind multiple real IPs to the router and then forward internally based on port and IP. So if you have x.x.x.1 and x.x.x.2 bound to your NAT, you can point x.x.x.1:80 to 192.168.0.1 and x.x.x.2:80 to 192.168.0.2. Just like with a firewall and real IPs.

    17. Re:Good articles by Anonymous Coward · · Score: 5, Insightful

      Ok, this is idocy. Yes, the net can survive with NAT. The thing is, IPv6 is about looking forward.

      If every phone, mobile phone, internet appliance, whatever had a publicly available internet address, things like VoIP could be routed over the internet, be more secure, have better latency, possibility of point to point encryption, etc. It would drive down the cost of mobile internet service, and make service better on the whole. Want your home phone# to ring your cellphone or computer? Forward it.

      Phone numbers of the future should be like URLs. phone.yourname.com, mobile.yourname.com, and you could have as many of these as you could want to resolve to your phone's address. Want to have your cell listed by your employeer? joesmith.bigcompany.com. Confrence calls? IPv6 has much better facility for multicasting. Video, etc etc etc. are all quite possible.

      It's not that complicated. IPv6 represents a paradigm shift for future accessible technologies, that aren't possible/interoperable any other way. People want mobile internet aware devices, lots of them.

      What I want is to be able to subscribe to a mobile carrier like I would an ISP. They host my connection, give me some benefits (web space, whatever, more data transfer), and charge me for the byte. It's redicliously expensive to use internet enabled phones in most places in the world--Especially concidering that voice data is so much larger, by nature..

    18. Re:Good articles by Khazunga · · Score: 2, Insightful

      You'll never escape the limit of n internal servers for n publicly addressable IPs. Not unless you do some kludge like having an http proxy looking at Host: headers on requests.

      --
      If at first you don't succeed, skydiving is not for you
    19. Re:Good articles by aminorex · · Score: 4, Interesting

      Oh, you mean like IPSEC, and DHCP?
      IPv6 offers nothing but a fat address space,
      really. Everything else can be retrofitted
      to IPv4.

      Frankly, I think we'll devolve to a system
      of discrete IPv4 address spaces with
      intelligent routers between them before
      IPv6. It doesn't matter how much mindshare
      v6 has, if the economics are wrong.

      --
      -I like my women like I like my tea: green-
    20. Re:Good articles by Tailhook · · Score: 4, Insightful

      The need for IPv6 is _not_ shortage of IPv4 addresses, but you find it in the extra features in IPv6 (Build-in security, Automated addressing, etc).

      Disclaimer: First, understand, I'd like to agree with this. IPv6 is a good thing.

      However, the IPv6 motivations you mention are incorrect. IPv6 does provide the things you mention, but these are not sufficient to cause a migration and do not constitute a "need."

      Security; Adhoc VPN is providing this in IPv4. It's messy and complex, but it works within limits. IPv4 was not designed with this in mind and the hacks that appear as a result are deeply wrong, but it works.

      Autoconfig; DHCP is providing this to a large degree already. It is working "in the wild" right now in both fixed installations and more recent wireless environments. Again, it's messy and imperfect, but it's working.

      NAT is being extended to multiple levels through routing domains (my phone has a RFC1918 address and I wouldn't be surprised if some cable/DSL ISPs aren't distributing them too. A major issue for corporate WANs is making sure RFC1918 subnets don't overlap.) Protocols that don't play well with public IPv4 and NAT are being implicitly deprecated (consider SOAP running an entire RPC stack through HTTP ports and TCP/IP.) Obscene hacks necessary to overcome NAT are being created (IPSEC NAT-T.) How long will it be before ISPs set up tiers where you're only cost effective choice for small enterprise is a single public IP on a NAT gateway because a classless /28 public subnet is 5x more money?

      IPv6 will happen only when the pain of the transition approaches zero. Until then IPv4 will persist regardless of how painful it is. People will deal with figuring out how to run multiple virtual hosts through a single address to a NATed DMZ before they read page 1 about IPv6.

      When every OS and device supports it out of the box and the base of administrators are finally no longer mystified, it will occur. This will take a long time. I doubt IPv6 will be ubiquitous in the next 8-10 years. IPv6 proponents must continue to focus on vendor support and educating administrators. There is no magic bullet.

      --
      Maw! Fire up the karma burner!
    21. Re:Good articles by asdfghjklqwertyuiop · · Score: 2, Interesting

      NAT has absolutely nothing to do with security or firewalls. If you have NAT, it is still possible to get packets to machines behind it by source routing or breaking into your ISP's routers. Furthermore, source addresses can be spoofed which may have security implications.

      Things like these are prevented by a firewall. Not NAT.

      You are probably creating more of a risk by trying to rely on the obscurity of NAT for security (false sense of security).

      You want your local network to have real IP addresses because that is the way it was meant to operate. If it did you wouldn't have to screw around with port forwarding or proxying and remembering which port numbers correspond to which servers (if you have multiple services of the same type).

      I think most of us use NAT because ISPs charge ludicrous sums of money to get real IP addresses for broadband or dialup connections.

    22. Re:Good articles by squiggleslash · · Score: 2, Insightful
      Even worse, chances are each machine would be being allocated 65,536 ports. 65,536! What a waste! Why would they want that many connections open - indeed, it's 131,072 ports if you consider both UDP and TCP!

      Clearly we need to stop allocating IP addresses to people. I can have 152.102.96.23 port 2001, and you can have 152.102.96.23 port 2002 (both the UDP one and the TCP one! See I'm being generous). Larger companies like Ford and GM can share an IP address and have 32,768 ports each.

      This is much more efficient, and absolutely necessary. Sure, it will take much more administration to administer networks where every port has to be accounted for, but clearly if we can hold off upgrading to superior technologies by merely sacrificing convenience, that will be a price worth paying.

      --
      You are not alone. This is not normal. None of this is normal.
  5. So.. by pirodude · · Score: 4, Insightful

    So yeah, it'll take 20 years to exhaust the space. Let's wait until 2029 to switch to IPv6.

    Or instead start switching now (after all, it'll probably take atleast 10 years to get everything switched over) and not worry about IPs until we're extinct.

    1. Re:So.. by leerpm · · Score: 5, Insightful

      According to their study, yes it will take 20 years for 100% of the address space to be used up. But there was a study done (trying to find the URL right now..) saying that once we reach a critical mass of around 85% usage, it will become nearly impossible for an organization to obtain new address space. At this point, we will essentially be in a crisis-state, where no one will be able to request more space.

    2. Re:So.. by serial+frame · · Score: 2, Insightful
      Heh heh heh...Wouldn't you wish.

      First off--Where at, then, in the IPv4 packet header, do you suggest putting the "differentiator"? Oh, shucks, I guess there isn't much space left in the header. (I'm interpreting you literally, here.)

      Not to mention, the Internet is about connectivity, and what you describe is balkanizing it all. What if my friend in Zimbabwe was running a web server, and me, in Ukraine, wanted to view his web site? The only possible way to view the web site would be to know the address of a proxy server that was also within the same portion of his network, and possibly, any addresses of any proxies in between, in order to get a single HTTP request out.

      The results of your idea wouldn't be far from necessitating something akin to bang paths like in UUCP. Once again, the Internet was architected with the value of end-to-end connectivity in mind, and you are obviously attempting to negate that value.

      There is a point in time where duct tape and baling wire isn't so much of a good option.

      --

      -
      And the Angel said unto me, "These are the cries of the carrots! The cries of the carrots!"
  6. If it isn't broken... by heironymouscoward · · Score: 3, Interesting

    The cost of moving to IPv6 is going to be so huge that it will remain a research project until the benefits are correspondingly irresistable.

    It will almost always be cheaper to hack IPv4 than to switch to IPv6, and this will be the rule for 99% of IP users.

    My prediction is that IPv6 will never come into general use, we will stick with IPv4 for at least 40-50 more years. I have absolutely no idea what will replace IPv4, something will, but it will not be IPv6.

    --
    Ceci n'est pas une signature
    1. Re:If it isn't broken... by leerpm · · Score: 3, Informative

      The US military is moving to solely IPv6 by the end of the decade. The rest of the US government will probably be not too far behind. IPv6 is happening right now, and will replace IPv4.

  7. NAT firewalls a huge factor by websensei · · Score: 5, Interesting
    my brother david weekly had this to say about it, which I found interesting:

    This message was posted on a mailing list in response to a post that claimed that IPv6 would be widespread by 2005 due to an IPv4 address shortage

    NATs, unfortunately, made a need to switch over to IPv6 wholly unnecessary. Such a switchover will probably not happen for at least another ten years. Even ten years ago, we were "running out of" IPv4 space due to incredibly inefficient allocations using the "class based addressing" method - by which your network was deemed to either to likely possess 253 computers, 65,533 computers, or 16,777,213 computers. A specific network was identified by 24, 16, or 8 bits. (The more bits it takes to identify a network, the more networks can exist but at the expense of having fewer unique addresses per network.)

    This was quickly determined to be an inordinate waste of addresses and as early as the early 90's folks were predicting we'd rapidly run out of addresses. So class allocations changed a little, and instead of giving an organization with 1000 computers a class B (with 65,533 useable addresses), they'd give them four class C's (with 1012 addresses). This helped stem the tide for a bit and arguably saved the Internet's ass, but it was clear that a more elegant system for identifying networks was needed.

    After some backbone technology re-architecting, a new scheme called Classless Internet Domain Routing, or CIDR was introduced, which allowed bit-sized granularity, meaning that a network was identified by exactly as many bits as you needed. Your network could possess 13 computers, or 16,381 computers, and the system could deal with that efficiently. CIDR definitely also helped save the Internet's ass. But the addresses kept on coming; that dang Internet was getting popular very quickly! Pundits started talking about The Great IPv6 changeover, despite the fact that less than one person in 100 on the Internet had an IPv6-enabled operating system.

    Then came NATs. While Network Address Translation had been used in many environments, it hadn't really taken off tremendously. Then Linksys released a rather affordable cute little blue box. This piece of hardware let home users plug in several computers to the blue box, configure it with a web interface, jack in their cable/DSL connection and suddenly be sharing Internet access easily with everyone in the house, using one IP address and so fooling the ISP into thinking that there was only one computer using the Internet (many ISPs either don't permit or don't have the infrastructure to give out multiple addresses to a customer). These NATs had a secondary benefit, which was that by default, all incoming connections from the outside are dropped on the floor. I'm not sure Linksys had such "firewalling" in mind when originally designing the device - it's purely a practical issue. I mean, if someone says to a NAT "here's this piece of information" - to who which of the four connected computers should the NAT send it? By default, the NAT will give up and just drop the sorry packet. This means that when you're behind a NAT, you're protected from a whole class of Internet attacks. This realization further drove adoption.

    Companies with low IT budgets realized that they wouldn't have to buy extra IP addresses from their ISP (which often came at a premium) and that they could have simple firewalling without a complex configuration. Both companies and people could not see the inherent value in having each of their computers have an Internet-deliverable address, and there was real value (protection) to be had in NOT be addressable from the Internet.

    This, again, saved the Internet's ass. Instead of an organization of 1000 needing a class B, wasting hundreds of thousands of IPs, or even four Class Cs, this organization now only needs a single IP address to cover all of its desktops. Now instead of thinking about IP addresses as computer addresses, they have started to become network addresses, which is to say,

    --

    La via sola al paradiso incommincia nel inferno
    1. Re:NAT firewalls a huge factor by Tim+C · · Score: 2, Insightful

      Would make for more grassroots servers.

      But you can set up your own grassroots server now, even with NAT. At worst, if you want to set up more than one server providing the same service, you run some on non-standard ports and have your gateway/NAT box forward the connections based on port. True, then people have to remember to use the port as well - but you could set the "standard" one to list all available services.

      Alternatively, if you host each on a seperate domain name, you could set up some sort of controller that forwarded the requests to the appropriate interal box & port transparently.

      In short, the IP address restrictions are easily worked around - it's the upstream bandwidth that's the fundamental limit. My current home connection is 256Kbps upstream, and nothing I do can change that. That limits music streaming, for example, to one stream, without dropping quality to an imho unacceptably low level.

    2. Re:NAT firewalls a huge factor by Vargasan · · Score: 2, Insightful

      "IPv6 would remove the practice of ISPs selling
      IP address at a premium. For that alone its worth it. Would make for more grassroots servers."

      Or they could just keep selling IPs at premium and make even MORE money.

      You have to think like a corporation, not like a hopeful user.

      --
      Putting the romance back into necromancer.
    3. Re:NAT firewalls a huge factor by pueywei · · Score: 2, Insightful

      I absolutely despise having to deal with crap that NAT introduces. I currently have my nat box forward all ports not defined to my main machine. For some reason, the forwarding breaks some stuff. Like prissy file transfers brokered by the various im networks. The other three boxes are essentially screwed. No incoming connections means no file transfers, no ddc (for irc). The outbound triggered dynamic port mapping doesn't help much if all of the boxes want to be connected to the same irc server, for example. I want IPv6 now!

  8. IPv6 isn't just for bigger addresses by lildogie · · Score: 3, Insightful

    IPv6 also provides security infrastructure.

    Imagine a world where you can trust the "from" IP address in a packet.

  9. Different Problems? by Richard_at_work · · Score: 4, Interesting

    I thought the current issue with IPv4 was not the limited number of ip addresses, but the increased routing tables brought on by classless routing? These days, the central routers on the Internet have routing tables which are huge, which must cost someone somewhere to upgrade them.

    IPv6 was supposed to deal with this issue as much as it dealt with the number of ip addresses available, in that it would revert back to a semi class based routing set, with ISPs being assigned a range of addresses.

    Thats how I understood it when I asked anyhow.

    1. Re:Different Problems? by leerpm · · Score: 2, Interesting

      Yes, the size of the routing tables is one more reason for the upgrade to IPv6. But there are a few problems with IPv6 that still need to be worked out before we can say for sure that the routing tables are going to get much smaller. The biggest one so far is the issue of multi-homing (having more than one provider to your network). No one solution has come forward that isn't without some significant disadvantages over the current way it is done in IPv4.

  10. "Uncertainties" by Andorion · · Score: 2, Insightful

    The entire second article is null and void for this reason, quoted from the article:

    Of course such projections are based on the underlying assumption that tomorrow will be much like today, and the visible changes that have occurred in the past will smoothly translate to continued change in the future. There are some obvious weaknesses in this assumption, and many events could disrupt this prediction.

    The argument that we're going to run out of space is based on the assumption that in the (near) future MANY MANY household appliances and objects which don't currently have anything to do with the internet are going to become attached to it.

    ~Berj

    1. Re:"Uncertainties" by Zocalo · · Score: 2, Insightful
      I think you misunderstand me. Sure, I can see the "benefits" to a Big Brother entity of having static IPs everywhere, but that wasn't my point. Having dealt with RIPE it's already impossible to get a /24 for 200 workstations because of NAT. Imagine what the reaction would be if A.N.Other Telco asked for a /8 for its 3G network. I suspect the laughter from RIPE's offices in Amsterdam would be heard right across Europe.

      Mobile Internet and Internet appliances are largely a green field technology; what better place to start a widescale deployment of IPv6. I personally don't give a damn about the billions of IP addresses that I personally can have, I want the enhanced security features! And yes, I am aware that would entail a static IP and so on with all the Big Brother issues you allude to.

      --
      UNIX? They're not even circumcised! Savages!
  11. The question is wrong... by lgeezer · · Score: 2, Funny

    If ipv4 isn't broke, then there's no need to fix it with ipv6: instead, the time is used to allow ipv6 killer apps (your fridge telling your tv that you need more milk) to further mature. Like BBSes and JaNET had Internet gateways, there'll eventually be gateways between ipv4 and ipv6 Internets, and it'll suddenly be with us as if it always had been.

    About then we should be discussing whether housebricks should have IP addresses to report being dug through, or whether being able to detect movement means it could detect the movement from soundwaves, people talking. I can only hope I don't have to shout into each brick the serial number from the inevitable shrinkwrap license.

  12. IPv6 will be adopted, just not in USA first by sdxxx · · Score: 5, Interesting

    IPv6 will eventually be adopted, because the way IPv4 addresses are allocated, many regions of the world *do* have a shortage of addresses. In particular, Asia has a serious shortage of IPv4 addresses. In fact, I know of people who run IPv6-only machines in Japan (because there are 6to4 addresses that allow you to reach IPv4 servers with approximately the same functionality as NAT).

    Moreover, as people deploy new infrastructure, they may be forced to use IPv6. For example, at some point every cell phone is going to have a routable IP address--and that is definitely going to require IPv6.

    So while North American desktop machines are unlikely to be switched to IPv6 any time soon, it will happen in other parts of the world and for other types of hardware.

  13. imho by pizza_milkshake · · Score: 2, Funny

    it's a race between IPv6 and *NIX running out of timestamp room in an int... only 3227004721 seconds to go!

  14. 04 by Malicious · · Score: 3, Funny

    While we're at it, we should switch to a 5 digit date for the year. Because you know it's going to be Y2k all over again in the year 9999.

    --
    01101001001000000110000101101101001000000110001001 10000101110100011011010110000101101110
    1. Re:04 by babyrat · · Score: 2, Informative

      actually it's in 2038 and we've already started the conversion, and it seems like it will last us for a bit, of course perhaps I'm being shortsighted...

      from

      64-bit UNIX time would be safe for the indefinite future, as this variable won't overflow until 2**63 or 9,223,372,036,854,775,808 (over nine quintillion) seconds after the beginning of the UNIX epoch - corresponding to GMT 15:30:08, Sunday, December 4, 292,277,026,596 C.E. This is a rather artificial and arbitrary date, considering that it is several times the average lifespan of a sun like our solar system's, the very same celestial body by which we measure time. The sun is estimated at present to be about four and a half billion years old, and it may last another five billion years before running out of hydrogen and turning into a white dwarf star.

  15. IPv6 more necessary than thought by mnmn · · Score: 4, Insightful

    At a certain point in the middle of the last decade, everyone thought they would run out of IP addresses. Work was then put into routers and firewalls to bring to the masses the CIDR and NAT to stem the tide. Now on cisco routers you can do fancy port forwarding to use several servers behind one IP. All this work however could have been replaced by investing in ipv6. The fact that ipv6 is not being implemented means investment is being put into a scheme in which people will eventually run out of IP addresses, while there is a complete alternative available.

    The single biggest damaging factor of ipv4 is the fact that you cant really run servers behind it. There are already ISPs in many countries that provide service from behind a NAT firewall. This kills many people's freedom of speech and the spirit of the Internet where everyone had their own servers and ran whatever they wanted.

    The second damaging factor of the ipv4 is the control that IANA has. Both ICANN and IANA have been used politically and now we have many American ISPs churning out 4 IPs per person and 64 IPs per company, mostly going to waste while ISPs in some countrys like Pakistan's PakNET have 100,000 customers behind one IP none of whom can run their own servers.

    ipv6 can fix all these problems in one fell swoop, simplify routing enormously and introduce IPSec and other security technologies.

    --
    "Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
  16. Usage vs. allocations by cperciva · · Score: 2, Insightful

    Lies, damn lies, and statistics.

    The author is looking at the rate of IPv4 address allocation, and extrapolating future growth based on the current rate. This is a severely flawed methodology, because it does not take into account efficiency of utilization.

    Ten years ago, as the author notes, most networks used around 1% of their allocated IP addresses. Now, networks are expected to use over 50% of their addresses before they can receive a larger allocation. As a result, while the number of *allocated* addresses has not been growing rapidly, the number of *used* addresses certainly has.

    Unfortunately, utilization efficiency is bounded -- it's hard to use more than 100% of your allocated IP addresses. As a result, the rate at which IP addresses are allocated is likely to take a sharp turn upwards, as organizations which until now have been making efficiency improvements, find that they really do need a larger address allocation.

  17. NAT by Alomex · · Score: 3, Insightful

    I saw an academic paper late last year stating that NAT's and finer subnetting had resulted in a reduction of nearly 30% of allocated IP addresses. That is the first time I saw the "IP shortage no longer a realistic possibility" argument.

    To be clear IP shortave wasn't a myth. There was a time where even conservative projections were pointing towards a dearth of IPs. A solution needed to be implemented. IPv6 was one option, NATs and subnetting was another. The market seems to have chosen this last .

    1. Re:NAT by Uhlek · · Score: 2, Insightful

      The market chose NAT because it was the only technically feasible solution that could be implemented in the short term and still ensure interoperability with the rest of the Internet.

      The fact remains that NAT is a kludge of a solution. We here in the US see NAT like you see in Linksys routers. There are many implementations of NAT that have hundreds -- sometimes thousands -- of users hiding behind various layers of NAT. It's an administrative nightmare to say the least and is not a permanent solution to the problem.

      All NAT has done is stave off the immediacy of the problem. Unfortuantely, no one will want to spend the money to fix the problem until it's too late -- just like the Y2K bug.

      Ah, well, more money for network engineers like me. Woohoo.

  18. No need for global IPs by bigjnsa500 · · Score: 2, Insightful
    This should be a myth because not all machines need too have a global IP. In part, I think this is part of the reason worms and virii are rampant nowadays since there are way more computers with global IPs than ever before. And the users don't have the experience of maintaining the machines.

    I like the idea of a good NAT firewall with private addresses inside. This way you only use 1 IP on the outside.

    --
    This is a test. This is a test of the emergency sig system. This has been only a test.
  19. hostip.info by Space+cowboy · · Score: 2, Informative

    Whereas this isn't really related, I've just put up a resource for geolocation of IP's to country/city. It'd be cool if some slashdotters were to type in/select their city - only takes 10 seconds :-)

    The url is hostip.info. The idea is to provide a free geolocation service that you can download the DB from. All the other ones I've found are either pay-for, limited in what you can do, or only to country-resolution. At the moment, this is just to country-resolution as well, but who knows how far it'll go :-)

    Simon.

    --
    Physicists get Hadrons!
  20. Why the status quo will stay as is by stratjakt · · Score: 2, Insightful

    Most ISPs are making good $ charging out the ass for multiple IPs.

    Comcast wants something like 20 bucks extra a month for each extra IP. Folks who don't understand firewalls and routers and NATs think they need one for their Xbox, PS2, laptop, etc.. Of course, they can only claim they need to charge because of the shortage within the IPv4 addressing space.

    IPv6 makes this means of income obsolete. We all know that phone, cable, and media companies absolutely HATE when an improved technology comes along and makes their business model null and void.

    IPv4 is here to stay for a long while.

    --
    I don't need no instructions to know how to rock!!!!
  21. Re:IPv6 by -brazil- · · Score: 2, Insightful
    is just a tool to allow nations and corporations to "get control" of the internet (hierarchical geographic routing, anyone?)


    And this is different from the current situation with IPV4 HOW??

    --

    The illegal we do immediately. The unconstitutional takes a little longer.
    --Henry Kissinger

  22. Couterexamples by hey! · · Score: 3, Informative
    Nonsense, I think most of us do it because it makes good sense. You don't want your local network having a public IP address, even if you do have a firewall and the best IDP system available. Why create the risk?

    Not at all.

    Just because you have an assigned network doesn't mean that that network (or all parts of that network) has to be connected. You could even NAT an assigned address behind a firewall if you wanted, and never put out any routing information. It would be just as secure as a non-assigned address, but very convenient in many situations.

    For example, I'm setting up an ad hoc VPN right now between several companies collaborating on a project. Naturally, we are not giving access to each others LANs, but separate segments. Howver, we can't ignore the unassigned addresss used by the other partners. If he uses 192.168.100.0/24 for his LAN, I can't use it for my VLAN segment.


    Another example is when companies merge. They could just plug their LANs in and know everythign would work.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  23. IPv4 Vs. IPv6 by blankinthefill · · Score: 2, Insightful

    The problem with IPv4 does not seem to be the lack of address space, but that will be a telling factor when/if a switch is made.
    The major problems are, as has been mentioned, its inefficiencies and its current state. Currently the IPv4 standard is a cobbled together mess. VLSMs and NATing are late additions to the game, and are merely attempts to save an old and dying hulk. The fact remains that no matter what we add to IPv4, it will always be inefficient. In IPv6, most of these methods are inherent and relatively efficient. The mere fact that they are inherent as opposed to added on makes the standard a better one than IPv4 will ever be. Heck, IPv6 even has features that IPv4 doesn't (And probably won't).
    Address space, though, will play a significant part. The graphs and projections are all well and good, but I don't believe they take into account many of the factors involved. As broadband and DSL become more popular and more implemented, it is going to increase the demand for static addresses. Even though there are bad points to having a static address, there are also good points. People will want to have their own address for everything from their cell phones to their home LANs to whatever you can think of. The rush of in the early 90's is nothing compared to what's coming. We have to account for the further IPzation of all products in life, from cars to houses to coffeemakers to refrigerators. Home networks are on the spread. All these things are going to make people want more addresses, addresses that IPv4 can't provide, and even if it could, it would be inefficient, time-consuming, and slower than any thing that IPv6 would provide. This will drive a move away from IPv4. As youngsters become more and more used to the changing faces of tech, they will become more educated in its use as well. This will mean that today's techies will be tomorrow's average citizen. I, personally, don't know of any geek, techie, nerd, whatever you want to call it, who likes using a system that is old, broken, and inefficient to boot! Maybe you do, but I doubt it. These tech savvy youngsters, coupled with increasingly knowledgeable management (hey, it could happen!) would only increase the drive away from IPv4.
    And finally, I think that the authors forgot to take in to account the fact that most growth in certain fields happens exponentially. Most of the technologies that will drive a move away from IPv4 are new, or not old enough to be established. As soon as they age just a bit, and the bad ones are weeded out, the growth in those fields will rise by leaps and bounds. We have seen it with television, radio, cell phones, and most especially computers. To predict an almost linear line of growth is approaching on the naive! Like I said, growth states slow and rapidly increases after it reaches critical mass.
    With all that said, may IPv4 rest in peace. Long live IPv6!

  24. Shortage of area codes teaches a lesson by UpLock · · Score: 3, Informative

    When the Bell system was broken up, the phone system's allocation scheme for area codes and prefix blocks was disrupted. Phone service providers were issued blocks of 10,000 phone numbers with a given prefix, from which they allocated local customers. There was no method for reclaiming unused portions of blocks from independent phone companies. So long as one number from a block remained in use, that prefix block could not be reallocated. THAT is why we suddenly needed new area codes--not because we had run out of unused phone numbers. At the time the new area codes were issued, the actual in service phone numbers comprised less than 50% of the available pool.

  25. Food analogy by Matthias+Wiesmann · · Score: 2, Insightful
    As usual, the problem is not that there are not enought ressources, but that they are not well distributed. There is plenty of food on this planet, yet people are still starving. There are plenty of free IP addresses indeed.

    • Do I have my own IP address? No.
    • Do I have my own subnet? No.
    • Can I get them for a reasonable price? No

    So please stop telling me there is no problem. I thought the basic premise of capitalism was that a resource that is plentiful should be available for a low price?

    Saying that NAT solves the problem is shortsighted. You can put many clients behind a NAT, setting up many servers is more difficult. Sooner or later, each portable phone will have an IP stack, and thus will need an address. As long as those phones are clients, NAT will do the trick, but sooner or later somebody will want to build an application where each phone is a server...

    Using NAT is the same kind of kludge than using offsets for 16 bits pointers in the 8086 instead of 32 bits pointers it worked for some time, but ultimately it was not the solution.

    I'm not saying I have a god given right for an IP address, but that for certain application, peer-to-peer, it will help. I will not be surprised when china or Japan has the next killer app that runs on portable phones, or lots of small computers and basically was possible because the region adopted IP6. When this happens, the same guys who are now saying the IP6 is irrelevant will bemoan the fact that this opportunity was neglected by politics.

    You might argue that the problem is not the address space, but the organisation distributing them - as with food, this is true (but I did not hear Bush saying that Montesanto should stop doing better crop and improve food distribution in the world). In the end, this is a political problem - in general it is easier to solve technical problems.

  26. "Fairly Recently?" by mveloso · · Score: 4, Insightful

    Fairly recently as compared to when? I remember using ftp behind NAT years ago, back in the mid-90s...and boy does that sound strange.

    Anyhow, the stuff now works and is stable (and has for years), so there's no reason to whine about stability, etc. If your software doesn't work behind NAT, it's because they hired an inexperienced network guy to write the code.

    Why not complain about something else, like the crappy X server stuff?

    1. Re:"Fairly Recently?" by Abcd1234 · · Score: 4, Insightful

      Fairly recently as compared to when? I remember using ftp behind NAT years ago, back in the mid-90s...and boy does that sound strange.

      Yeah... it took until around 6 years ago before FTP would even work through a NAT. FTP! One of the oldest protocols on the 'net! And this requires stateful management on the server, which is non-trivial. Basically, it requires a protocol-specific hack.

      Anyhow, the stuff now works and is stable (and has for years), so there's no reason to whine about stability, etc. If your software doesn't work behind NAT, it's because they hired an inexperienced network guy to write the code.

      Sorry, but you're totally wrong, here. There are many applications (IPSec being the most obvious, as well as end-user apps, like VoIP, P2P apps, etc), where the very architecture of said application means NAT fundamentally breaks things. And yes, there are ways to hack around these limitations, but they're just that, hacks. And this is unavoidable... the minute you want machines to be able to directly contact other machines, things break down in the face of NAT.

    2. Re:"Fairly Recently?" by Webmonger · · Score: 2, Insightful

      Putting a policy enforcement point (aka a firewall) between your network and the rest of the Internet keeps bad things from coming in and ensures that your users are using the network properly.

      Indeed. But firewalling without NAT is equally effective, and allows you to selectively unblock machines and/or ports.

  27. IPv4 won't run out for a while because.. by riflemann · · Score: 2, Insightful

    A lot of the reason why IPv4 won't run out is due to the fact that it's so hard to get any space. With extremely strict assignment rules, of course it will be a while before they are all used up.

    Unfortunately, this just means that the ugly hack known as NAT will continue to be used, breaking many applications and protocols, not to mention external reachability of many devices. If there was reachability to all devices, the net would be a lot more useful for controlling embedded devices, but then we'd quickly use up a lot of space more quickly.

    Address space is only a part of the reason to move to IPv6. There are plenty of other features which should be reason enough to move over:

    - Auto address configuration
    - No more LAN renumbering/resizing games
    - Built in tunnelling functions for portable devices
    - Simpler address hierarchy
    - Address renumbering is much simpler, and will soon be do-able automatically
    - Standardised IPSec functionality in all devices

    IPv4 will not run out with the current allocation guidelines - but it will continue to have incredibly restricted functionality due to NAT.

  28. We've already run out by Morth · · Score: 2, Insightful

    Well at least I have. I want to run https/ftps on several of my subdomains, but I only have one ip. I can only use https with one hostname per ip.

    That's just one example. Another is sending a file or playing a game or whatever between two computer each behind a different NAT. You have to do ugly port forwarding rules that might be more or less huge ranges. People have to learn how tcp/ip works on a level completely unnecessary unless you're a techie. And god forbid you want to run two public game servers behind the same nat (many games don't let you specify port to connect to).

    NAT is a necessity, not a feature. Things would be so much easier if it wasn't needed.

  29. Re:IPv6 = loss of privacy by amorsen · · Score: 2, Informative

    If you like to keep your MAC there, you can use that. It has a lot of advantages. But if you don't like it, you don't have to use it. It's a free world. You can number your machines in a Fibonacci sequence if you prefer.

    --
    Finally! A year of moderation! Ready for 2019?
  30. Do you work at MIT? by Anonymous Coward · · Score: 2, Informative

    I'll take all the addresses I can. Do you work at MIT?

    From the article: The IANA policies for allocation of IPv4 address blocks to the RIRs are applied fairly and are based purely on the documented need for address space.

    Europe has far fewer IP addresses than North American organizations, which have been assigned 74% of all current IPv4 addresses.
    Both Stanford and MIT have more IP addresses than all of China.

  31. ipv6 rollout held back for what? by Loconut1389 · · Score: 2, Interesting

    the original parent states that this article could spell bad news for the ipv6 rollout. Yet, i see no reason why it should have any bearing on ipv6 at all. Why should the ipv6 rollout wait until we have no ip space left in 20 years. Why not switch over and let the availability of space drive innovation for new ideas to use that address space. Theres nothing saying we can't migrate to ipv7, 8, 9, 10 whatever some day later on. ipv6 should proceed at whatever rate the industry is ready for, not by when we are almost out of time. Much the same with our fossil fuel situation, IMHO.

  32. Not in favor of IPv6 yet by mabu · · Score: 2, Insightful

    I am not in favor of IPv6 being rolled out. I think at the present time, it will amplify all the existing problems we have yet to solve.

    I can appreciate the improved security and anti-spoofing provisions but the cons outweigh the pros. Most of what people are expecting to see with IPv6 will likely not be available to them. It's unlikely that broadband ISPs will give their customers more address space in order to avoid using NAT.

    NATs and VPNs serve very valuable uses within a safe and secure-computing model. If more address space means less people will be using VPNs, that's a bad thing. It will result in more vulnerability of more machines and more headaches for everyone.

    We also have the spamming/DOS issue, which is completely out of hand. There are measures that could be taken with the existing system which would dramatically reduce these problems. Moving to IPv6 will only make things worse until we adopt more regulation of the existing network systems.

    Nowhere is this more obvious than in the area of RBLs. A move to IPv6 would largely wipe out all smtp-based anti-spam blacklisting.

  33. economics by Geno+Z+Heinlein · · Score: 2, Insightful

    In short, the "Death of the Internet" due to lack of IP space is a myth, which doesn't bode well for getting IPv6 rolled out any time soon.

    Perhaps, but IPv6 will make addresses cheap and plentiful. Right now I pay $10 a month for one static IP. I want there to be so many addresses available that providers start advertising "Over 60,000 static IPs free with every account!" (Or the equivalent in name-based routing or any other technology that makes it quick and easy for me to throw another box on the network and connect it to the rest of the world.)

  34. Re:IPv6 will NEVER HAPPEN by Jugalator · · Score: 2, Insightful

    Unless maybe Microsoft 1) puts it on all new Windows OS

    You can already get the IPv6 layer for Windows XP. There's even a basic version for it included in XP, although an improved version with more features are available free to download from Microsoft. I recall it wasn't included for the simple reason it wasn't ready.

    I'd be really surprised if there wasn't decent IPv6 support in Windows Longhorn.

    Now .. let's say you are the next google, amazon, ebay, etc. You want to set a web site, will you choose IPv4 or IPv6? Of *course* you will choose IPv4, because most people are using it.

    What are you talking about? What do you mean with next Google? Just because Google doesn't speak IPv4 doesn't mean they have to redesign the service. LOL. It's almost like you think the users or webmasters will need to care about whether they're connected to IPv6 or not? Users just type w-w-w-.-g-o-o-g-l-e-.-c-o-m as usual. Web masters just upload the content to their host as usual. If the host has a DNS entry, then that's just a matter of typing in the name of the host. :-) Where exactly do you see there's such a major difference that you'll suffer from choosing IPv6?

    Let's say you are an ISP customer, your ISP offers you an IPv6 address, or an IPv4 address. The IPv4 address will access all sites (because we're in the middle of the changeover, remember), and the IPv6 address will access, maybe, a handful of geeky sites.

    No, if an IPv6 transition occurs, all IPv4 addresses will be reachable in the new IPv6 format, since a special address space in IPv6 is allocated for this. After a while, more and more will switch to "real" IPv6 addresses. But the customers will never really have to care about these technicalities. They just get their dot com and is happy. :-)

    I think I'm getting where your key misunderstanding and basis for your post is. You think IPv6 wasn't designed to coexist transparently with IPv4. Well, surprise there, it is.

    This is subtle but I believe the changeover will NEVER happen, and the BSD/Linux, etc, machines that are all rearin' to go with IPv6 will be used only for private networks (behind NAT and/or tunnel boxes, ironically).

    Why not on internet? IPv6 was designed from the ground to coexist with IPv4 after all. Routers only supporting IPv6 routing will be able to wrap IPv4 addresses and transmit data to IPv4 hosts, and fix the addresses back so the IPv4-only supporting host will never even know it's connected to an IPv6 network.

    why do I care if it breaks an obsolete protocol like FTP??

    Maybe you don't, but a world outside your ego bubble does, including both corporations and home users. Wake up.

    NAT is the right solution for IP address shortage. Instead of wasting time with IPv6, they should've been looking at lower-level NAT routing/addressing protocols that are backwards-compatible, if that's possible.

    Ooh, I'm so happy you aren't a network protocol designer. :-O

    You seem to have quite a bit of reading to do to catch up with the latest advancements in the IPv6 area and especially how invisibly it can coexist with IPv4. Of course the designers never thought "let's do this protocol, make it totally incompatible, so no one will ever be able to switch smoothly".

    --
    Beware: In C++, your friends can see your privates!
  35. Internal networks being safer... by adiposity · · Score: 2, Informative

    ...is the biggest fallacy I have ever heard of, especially for people who make extensive use of them. You end up forwarding legions of ports for all the services that must be exposed to the internet, all from one ip address. This means hackers have ONE ip address that effectively has hundreds of services running on it, instead of many different computers with one or two services, which takes much longer to scan.

    It is true that public ip addresses might expose all the *nix computers running sshd, and all the windows computers running smb, but that's what a firewall is for! And one has to have a firewall equivalent (i.e., a machine that all packets must route through) anyway if he's using NAT. Most NAT boxes are firewalls, too.

    The only downside to public ip addresses is that it isn't strictly necessary to have a packet filtering solution to get up and running. But only a fool would set up a corporate network w/o some sort of protection.

    In short, it is actually less work to configure a simple firewall which blocks everything to public ips than it is to configure a simple NAT solution which blocks everything to private ips. And once you start forwarding ports, it's actually the NAT that's less secure, because of the single point of entry. Let's not forget as well that people often "DMZ" one of their internal machines, exposing an entire machine to the outside, which again is far worse than a public, firewalled ip.

    Again, public ips w/o a firewall is an even more insecure situation, but public ips aren't less secure per se. They're less secure in the hands of a fool.

    -Dan

  36. What about the NAT myth? by Merk · · Score: 4, Insightful

    You know the one. It says that "We don't nee IPV6 because we have NAT". It's the same kind of thinking that says that The Internet == The Web. Just because NAT solves a certain subclass of problems that are more naturally solved by extra addresses, doesn't mean that there is no need for IPV6 because there's NAT.

    NAT works great for things like the web, which are initiated behind the NAT machine, and don't make any connections back through the NAT machine. But The Web != The Internet. Even FTP has problems with NAT, but at least those problems are well understood by now. When the original connection is made from the outside world, trying to contact something behind the NAT box, that's when problems start.

    Some people see this difficulty in reaching the machines behind the NAT box as security. It isn't. If you have no other forms of security, it helps a little bit, but it's more like a side effect. Saying that this is security is like saying that a rusty lock is more secure than a new one because it is harder to get the key into it. A stopped analog clock isn't right twice a day, it just appears to be right twice a day, but that doesn't mean it is ever working.

    If a NAT machine were replaced with a simple firewall machine with a closed-down firewall, you'd have the exact same kind of security. No packets get routed to the machines on the other side of the firewall unless the rules permit it. The only difference is that it avoids a lot of hacks. Rather than having to do "ssh -p 10322 mynatbox.mydomain.com" and having to remember that 10322 corresponds to your mail server, you can simply say "ssh mailserver.mydomain.com"

    Doing away with NAT also makes true peer-to-peer networking possible. Currently it doesn't work, you need some kind of a server because you can't initiate connections from the outside world to the NATted boxes. P2P doesn't just mean swapping songs, but also networked gaming.

    This is all just about routable addresses so far, but IPV6 is so much more than that. There are features of IPV6 like security that IPV4 simply doesn't offer.

    So remember kids, The Web != The Internet, and NAT != IPV6, nor can NAT do everything you can do with routable addresses.

  37. Rubbish article. We need IPv6 by njdj · · Score: 3, Insightful

    The article is rubbish for several reasons.

    Even on its own terms, it predicts we run out of IPv4 addresses in about 20 years. That seems like the age of the universe to the 20-something kid who wrote the article. To those of us with a little more experience, it is not a long time at all to do something as major as converting the Internet to a different addressing scheme.

    But the basic assumption of the article, that the present situation is OK and the only reason to migrate is to avoid it worsening, is wrong. In many countries, the IPv4 address shortage is very severe today, not in 20 years from now. IP addresses are expensive in the countries where most people live.

    Finally, NAT is not a solution, it's a workaround. Many peer-to-peer applications simply do not work behind a NAT. Sure it lets machines surf the web, send email, and use clients like ftp, telnet, and ssh, but the Internet is much more than a handful of client/server apps. NAT is strangling it.

  38. This is FUD. We are already out of IP addresses. by Herbmaster · · Score: 2, Insightful

    I am a more-or-less typical internet user. I have a cable modem from RCN for my household which happens to have 4-6 computers. Of course, right now I am using NAT. This is an incredibly lame solution for a number of reasons which have been discussed exhaustively here already.
    RCN provides me with a connection, X bandwidth, and 1 IP.
    My incremental cost of more IPs on the same connection and bandwidth is prohibitively high. (I would consider a penny or two per month per IP to be "reasonable" since each IP should have trivial overhead for the ISP)

    Ergo, we are out of IPs already.

    --
    I'm not a smorgasbord.
  39. DJB Said It Best by scosol · · Score: 3, Insightful

    The *only* (and fatal) flaw with IPv6 is lack of backward-compatibility.

    And it's never, ever going to work without it...

    http://cr.yp.to/djbdns/ipv6mess.html

    (and he really does have the best host/domain/tld combo in existence)

    --
    I browse at +5 Flamebait- moderation for all or moderation for none.
  40. Re:Mac OS 10.3 has IPv6 Support Built in... by j+h+woodyatt · · Score: 2, Informative

    A more cogent point to be made: all of these operating systems that currently support IPv6 do not have the full suite of transition mechanisms that are required to keep the user from having to know whether they are using IPv4 or IPv6 for any given application.

    There's a long list of important transition mechanism protocols that need to be deployed to smooth the transition to IPv6, e.g. 6to4, Teredo, NAPT, etc. And they just aren't there yet.

    Another thing that has to be fixed before IPv6 will start showing up is dual-stack IPv6/IPv4 residential gateway boxes. There are specs for these things floating around, and that implies that there are people planning to build them and roll them out.

    But right now, your average cable-modem system and DSL router are designed to give customers exactly one IPv4 address (and maybe not even a public realm one). Getting IPv6 deployed over the top of this infrastructure is an ongoing process. It's happening now, but it will take years. Maybe even the better part of this decade. Maybe more.

    Most people reading this thread will eventually upgrade to IPv6... without knowing it. A few will upgrade only when they discover how much more they're spending on maintainance of their old IPv4 network compared to what they would have spent if they had upgraded to IPv6 earlier. The rest of you will be killing yourselves, trying to keep from upgrading to IPv6, because you all belong to some kind of sick religious cult.

    --

    --
    jhw