IPv6 is Here

shawn(at)fsu writes "Reuters is running a story that Vinton Cerf of the Internet Corp. for Assigned Names and Numbers (ICANN) says that "IPv6 been added to its root server systems" I like how they said that it will run along side IPv4 for 20 years to get rid of the bugs. A few previous Slashdot stories out of many here, here and here"

Comments

v6 could help solve some net problems

[erick99]

Perhaps we will get to the point where static IP addresses are required. That might help track down spammers and other bad netizens. I'm sure they will find a way around it, but, still, an assigned IP for each user and each piece of hardware would be a good start. And, it would seem that there would be enough to 'round:

Cerf said about two-thirds of the 4.3 billion Internet addresses currently available were used up, adding that IPv6 could magnify capacity by some "25,000 trillion trillion times."

Of course, if v4 runs along side of v6 for 20 years that may mean that it would be harder to implement an IP-per-user scheme. I don't know. But, 20 years should be enough time to work out any bugs:

He said the IPv6 system would run parallel to IPv4 for about 20 years to ensure that any bugs or system errors were weeded out.

Cheers!

Erick

Re:v6 could help solve some net problems

[Anonymous Coward]

...because no one should ever need more than 100,000 trillion trillion billion RA--err, IP addresses.

Re:v6 could help solve some net problems

[tekiegreg]

Static IP's for everyone? Dear god the administration nightmares there trying to document all the IPv6 assignments.

Better still, bring back the old BOOTP protocol? Which if I'm not mistaken just simply keeps a database of MAC addresses to IP Addresses (manually entered), and if a broadcast from a MAC address requests an IP, it looks up the assigned IP for the MAC address. Then all you have to do is punch in MAC addresses for the administrator. Anyone still use BOOTP in their networks? Also I'm not familiar enough with DHCP, can it do the same thing?

Re:v6 could help solve some net problems

[The Darkness]

Also I'm not familiar enough with DHCP, can it do the same thing?

Yes, I have machines on my network that acquire static IPs through DHCP. It uses the MAC Address to determine when one of those machines requests an IP.

Re:v6 could help solve some net problems

[Iphtashu Fitz]

Perhaps we will get to the point where static IP addresses are required.

I doubt that'll ever happen. Who would manage it and who would police it? There are also too many useful situations for using dynamic IP's. True, it's easy to abuse if it's not implemented properly but that doesn't mean it should be gotten rid of. How many companies use DHCP to manage their networks? It's also used in server farms like search engines where there are hundreds or thousands of similar servers in distributed systems. Forcing people to go to static-only configurations would be a major pain in the ass for them.

Re:v6 could help solve some net problems

[mattdm]

Sure, DHCP can do that. And lots of people use it that way. In fact, pretty much all of those Linksys/Dlink/whatever firewall/gateway/router boxes support it...

Re:v6 could help solve some net problems

[tabdelgawad]

Perhaps we will get to the point where static IP addresses are required. That might help track down spammers and other bad netizens.

Let's add "good netizens who want to be anonymous". Maybe I'm not thinking clearly, but I don't see a way of making the net spammer-proof without ending the concept of internet anonymity.

Re:v6 could help solve some net problems

[fishwallop]

Having more IP addresses doesn't mean that they will be statically assigned, nor that they will be assigned on a "per-user" rather than on a "per-device" basis. Even if each individual were assigned a block of addresses for their devices (this packet comes from John's palm pilot, this from his cell phone, and that one from his refrigerator...) you'd still have the problem of multiple users with a single physical device (public library computers, internet cafes, office beer fridges...) so, unless each device includes biometric identification and logging, you'll never be able to attribute every internet communication to a human party, even when one exists. I won't even get into the privacy concerns there.

The vast majority of bad netizenship occurs at protocol levels above IP -- spammers abuse SMTP, advertisers abuse DHTML, hackers abuse various services running on open ports. While some of this bad netizenship can be addressed at lower protocol levels (e.g. by blackholing certian IP ranges) the real solution is in fixing the higher-level protocols.

Re:v6 could help solve some net problems

[Stevyn]

But aren't those for boxes on a local network? I think he's talking about the ip address given to say a household from their ISP.

For example, our cable provider gives us an IP address which I believe changes every time we reconnect (it's one way cable >:0 ) but each computer on the lan gets what is essentially a static ip based on which ethernet jack it's plugged into. Like the computer on port 1 of the router gets 192.168.1.101. It makes it easy to network, however they are the computer looks gets the address assigned to it every time it boots (or ipconfig or dhcpcd is run).

I think the idea of having static ip addresses would make getting on the net a lot more cumbersome. Another bad outcome would be the waste from old ip addresses people wouldn't use anymore. One can argue that IPv6 has so many possibly addresses this wouldn't be a problem, but they thought the same for IPv4.

Re:v6 could help solve some net problems

[Gax]

Of course, if v4 runs along side of v6 for 20 years that may mean that it would be harder to implement an IP-per-user scheme. I don't know. But, 20 years should be enough time to work out any bugs:

The millenium bug* was around for 20-30 years before anyone noticed it. However, I'm glad that they plan to run it alongside the existing system to prevent common problems becoming fatal.

*Yes, I know it wasn't a bug in the traditional sense.

Re:v6 could help solve some net problems

[Matey-O]

IPv6 is big enough to give a class C subnet to every living person on the planet...I don't think static addressing will be necessary. Man, I don't think I'll be albe to rewire my brain to rember ssh 100.100.100.100.100

Re:v6 could help solve some net problems

[Unnngh!]

Wow, for a second there I thought your post title read "vb6 could help solve some net problems".

My head hurts.

At any rate, I don't think this is the proper technology to enforce, er, lack-of-anonymity over the web. It would not be any more secure than the current system--less so, by providing an illusion of security. Internet Cafes, open wifi portals, etc., would still be there.

Re:v6 could help solve some net problems

[Anonymous Coward]

No static IP addr. for everyone. Think of this:

If I move from CA to NY, the routers of the world would have to change their tables to be able to get information to me. That is just for one person. Now think of all the people who move or change ISPs.

So static IPs for everyone is not a good idea.

Re:v6 could help solve some net problems

[Soporific]

What is the actual number "25,000 trillion trillion"? Seems an odd way to put it.

~S

Re:v6 could help solve some net problems

[Malcolm Chan]

Alternatively, the ISP could still dynamically assign IP addresses, but instead of internal addresses (192.168.x.x, 172.16.x.x, etc), externally routable addresses.

This way, no NATing is necessary, but there isn't any administration of IP addresses assignments necessary. The ISP simply has to make sure that he has enough externally routable addresses available for the max number of customers who could ever be simultaneously connected.

Re:v6 could help solve some net problems

[fyonn]

Cerf said about two-thirds of the 4.3 billion Internet addresses currently available were used up, adding that IPv6 could magnify capacity by some "25,000 trillion trillion times."

I think that the above is misleading. sure, there is much more capacity for ip addresses in ipv6, but the protocol is designed for sparse ip useage. there will be massive gaps in useage as each lan gets a /64 network for what, up to 200 computers max?

however, I find ipv6 pretty interesting and I'm waiting to get ipv6 delivered to my home dsl (it's coming, it's coming). I've already got my mailserver configured for ipv6 but of course, no bugger has sent me any mail via that protocol as no-one else supports it. hell, I assume my config works but I don't *know* :)

dave

Re:v6 could help solve some net problems

[jerde]

IPv6 is big enough to give a class C subnet to every living person on the planet

Um. IPv6 is big enough to give a Class A subnet to every living person on the planet.

It's big enough to route an entire IPv4 numberspace to every living person on the planet, and to each of their pets, favorite invisible friends, and pieces of furniture.

2^128 is a big, big number.

The point is, they'll be able to "waste" huge swaths of the that numberspace as they build the routing hierarchy, making the network more scalable.

I'm worried about remembering ssh 2031:0000:130F:0000:0000:09C0:876A:130B

:)

- Peter

Re:v6 could help solve some net problems

[rsidd]

Better still, bring back the old BOOTP protocol? Which if I'm not mistaken just simply keeps a database of MAC addresses to IP Addresses (manually entered),

An IPv6 address includes the 64 bit MAC address.

Re:v6 could help solve some net problems

[Mirk]

Maybe I'm not thinking clearly, but I don't see a way of making the net spammer-proof without ending the concept of internet anonymity.

I don't see a way of making the sending of email spammer-proof without ending the concept of email-sender anonymity. But that is not the same thing as Internet anonymity. Such a scheme need have no effect whatsoever on all the other numerous Internet protocols, including the Web.

Re:v6 could help solve some net problems

[Cramer]

DHCP is a superset of BOOTP. So, DHCP can do everything BOOTP can (and more.) And that means just about everyone is running a bootp server -- most dhcp servers will answer a bootp request.

Re:v6 could help solve some net problems

[Ianoo]

Or, you could just type "ssh pc1.id.isp.com". If IPv6 brings a demand for memorable DNS addresses for everyone, I'm sure the ISPs will provide. Considering you'll most likely be able to put each machine on a static IP within your subsubnet within your ISP's subnet, services like DynDNS will no longer be needed, so you can just register a domain and run your own nameserver.

Re:v6 could help solve some net problems

[argmanah]

I don't see a way of making the sending of email spammer-proof without ending the concept of email-sender anonymity. But that is not the same thing as Internet anonymity. Such a scheme need have no effect whatsoever on all the other numerous Internet protocols, including the Web. You have no idea what you're talking about. John Doe is given static ip x.y. Free porn site logs incoming connection from x.y, immediately knows it's John Doe. So yes, forcing each user to uniquely identify their IP does affect web traffic. I can uniquely identify any user who connects to my webserver. Think what companies like Amazon and E-Bay could do with this information.

Re:v6 could help solve some net problems

[erotic_pie]

it is 25,000,000,000,000,000,000,000,000,000 or in lamens terms, alot

Re:v6 could help solve some net problems

[Pendersempai]

You could always go through some sort of anonymizing proxy, like anonymizer. No doubt the proxy'd limit your bandwidth, though, or you could use them to spam and get them blacklisted.

Re:v6 could help solve some net problems

[spookymonster]

With postal mail, you can send mail anonymously (just don't include your address). When you want to receive mail anonymously, rent a mailbox (either at the post office or at a Mailboxes, etc, for example).

If every IP device gets its own address, but you want to send or receive something anonymously, use a public terminal.

For both snail mail and IP traffic, neither solution is convenient. However, the fact remains that it is still possible.

Re:v6 could help solve some net problems

[Mirk]

... and you have no idea what you're replying to. Read the parent. The point is that spam prevention per se does not make Internet anonymity impossible.

Re:v6 could help solve some net problems

[opello]

the trillion trillion (10^12 * 10^12) notation is a bit easier to concieve than a septillion (10^24) for most people

25 thousand trillion trillion, 25x10e26, or 25 septillion ... my $0.02 :)

Re:v6 could help solve some net problems

[WhiteDragon]

2 ^ 128 = 340282366920938463463374607431768211456

number 340282366920938463463374607431768211456
three hundred forty undecillion.
two hundred eighty-two decillion.
three hundred sixty-six nonillion.
nine hundred twenty octillion.
nine hundred thirty-eight septillion.
four hundred sixty-three sextillion.
four hundred sixty-three quintillion.
three hundred seventy-four quadrillion.
six hundred seven trillion.
four hundred thirty-one billion.
seven hundred sixty-eight million.
two hundred eleven thousand.
four hundred fifty-six.

Re:v6 could help solve some net problems

[Theobon]

Not to be a flame, but is internet anonymity realy all that good? I see very little gain in it. Hell there is piles of things (like pgp sigs) that attempt to remove the anonymity problem.
People have a desire to privacy which doesn't make all that much sense.... seriously, it isn't like you have anything to hide!!

I can't see any problems with directly linking IP's with MAC adresses. Allowing you to know exactly which computer things are coming from. There are still ways to change your MAC adress but I think that those could be stopped.

Using stalkers as an example of problems doesn't work either because the stalker would be easily tracable and blockable as well.

-

Typed during smoke break, forgive typing mistakes.

Re:v6 could help solve some net problems

[dotwaffle]

Don't make me Briticise that... Ok...

number 340282366920938463463374607431768211456
three hundred forty billion trillion.
two hundred eighty-two thousand million trillian.
three hundred sixty-six million trillion.
nine hundred twenty thousand trillion.
nine hundred thirty-eight trillion.
four hundred sixty-three thousand million billion.
four hundred sixty-three million billion.
three hundred seventy-four thousand billion.
six hundred seven billion.
four hundred thirty-one thousand million.
seven hundred sixty-eight million.
two hundred eleven thousand.
four hundred fifty-six.

Now let that be a lesson. Lesser-cousins of ours.

Re:v6 could help solve some net problems

[Just Some Guy]

Sometimes, although your source doesn't list that as as requirement. From the page you linked:

It is recommended that it be used as 16 bit internal network number and 48 bit MAC address, although sites can do what they liked.

For example, I get a /64 netblock from my IPv6 provider, but I split that out locally to three /80 subnets (LAN, DMZ, and WLAN). Everything I've read indicates that using the MAC address to autoconfig prefixes longer than /64 is impossible, so I have to manually specify the last 48 bits of the IPv6 address on each machine. Fortunately, that means that one host on the LAN is ::2, another is ::3, and so on.

Re:v6 could help solve some net problems

[fyonn]

An IPv6 address includes the 64 bit MAC address.

and to quote the page you linked to:

The last 64 bits are reserved for the site use. It is recommended that it be used as 16 bit internal network number and 48 bit MAC address, although sites can do what they liked.

so it is recommended to include the 48bit mac address but it's pretty arbitrary

dave

Re:v6 could help solve some net problems

[Have Blue]

Maybe that wouldn't be a bad thing. Right now, the Internet is a textbook case of the tragedy of the commons.

Re:v6 could help solve some net problems

[gilmour14]

One of the points is that we're getting away from static IPs. Ipv6 addresses will be autoconfigured using router prefixes and your MAC address.

Re:v6 could help solve some net problems

[Anonymous Coward]

Not to be a flame, but is internet anonymity realy all that good? I see very little gain in it. Hell there is piles of things (like pgp sigs) that attempt to remove the anonymity problem. People have a desire to privacy which doesn't make all that much sense.... seriously, it isn't like you have anything to hide!!

I can't see any problems with directly linking IP's with MAC adresses. Allowing you to know exactly which computer things are coming from. There are still ways to change your MAC adress but I think that those could be stopped.

Using stalkers as an example of problems doesn't work either because the stalker would be easily tracable and blockable as well.

Jesus H. Christ! I am SO sick of the "if you have nothing to hide" argument.

You know what, I had a nice long rant typed out about how fucking stupid that argument is. I then realized that you probably wouldn't understand it anyway.

Have you been sheared lately?

Re:v6 could help solve some net problems

[Marxist Hacker 42]

Think of the positive as well- no more stupid cookies needed to track session information!

Re:v6 could help solve some net problems

[ckaminski]

Think what companies like Amazon and E-Bay could do with this information.
</quote>

Yeah, they could *gasp* mail more more and more kruft and advertisements that *gasp* get deleted or circular filed...

I'm still surprised my credit-card email account hasn't been spammed yet, considering the amount of physical credit card offer spam I get in the post.

Re:v6 could help solve some net problems

[argmanah]

The originally proposed scheme was unique static IP's for everyone. You referred to it in your reply as "such a scheme" saying it wouldn't affect internet anonymity. He didn't respond to spam prevention in general, he responded to that scheme specifically. Either you're changing the intent of that post now, or you had no idea what you were talking about to begin with. Either way, my reply stands.

Re:v6 could help solve some net problems

[lokedhs]

There is no need for such things as BOOTP or DHCP when using IPv6. The MAC address is embedded in the IP-address.

Re:v6 could help solve some net problems

[JPriest]

I got bored one day and figured out there are over a million IPv6 addresses for every square inch of the earth suface (counting water). Also it is not difficult to track somwone down just becasue they have a DHCP assigned IP address. Without DHCP we would have to hire 1 administrator for every person becasue they will have 15 or 20 IP connected devices.

Re:v6 could help solve some net problems

[Marxist Hacker 42]

two hundred eighty-two thousand million trillian.

I wouldn't mind that many Trillians...oh wait, I'm married. (Ob Ref, Trillian, aka Trica McMillian, was a character in HHGTG).

Re:v6 could help solve some net problems

[bar-agent]

The IPv6 numbers could be divided into "public" and "personal" numbers. "Personal" numbers would include your computer, cell-phone, etc., and "public" numbers would include kiosks, public access computers, etc.

Re:v6 could help solve some net problems

[ckaminski]

Hypothetical:

How about the Saudi citizen who has information about possible terrorist activities who manages to upload his data to his CIA contact via steganography in digital photos as posts to his family blog site?

Or the CIA operative in some foreign country who learns that 200 pounds of plutonium has gone on sale on the black market and emails this to president@whitehouse.gov?

Or the Presidential aide who rats out a double agent in the Whitehouse?

There are reasons for anonymity. Mostly not, but in many cases, there are. Peoples lives could be on the line.

With the way you argue, you'd want to turn off anonymous police tip lines, too?

Re:v6 could help solve some net problems

[pherthyl]

Uhhh.. So instead of making an intelligent argument you'll just randomly throw insults around.. Great.

Re:v6 could help solve some net problems

[OverlordQ]

Urm, you know there is a such thing as DNS for IPv6, there are AAAA records to name one.

mybox.mydomain.com. IN AAAA 2031:0000:130F:0000:0000:09C0:876A:130B

Re:v6 could help solve some net problems

[donnyspi]

layman's terms

Re:v6 could help solve some net problems

[JPriest]

But someone has to manually add that entry to the dhcpd.conf file, and someone has to manually add the static route for the /30 on the router you connect to. If a network change is made, all these /30's have to be relocated to the other device.

We don't bother adding the /30's to DHCP becasue it is easier to let users do it with tech support than it is to pay UNIX admins to make the changes.

Re:v6 could help solve some net problems

[GigsVT]

Static IPs aren't about a shortage of numbers, it's about ISPs trying to control the actions of their users, so they can claim to sell 10Mbit service for $50 a month, when in reality they sell you only a fraction of that.

Re:v6 could help solve some net problems

[devkM]

Lets look at some numbers here....

6.4 E+09 - the number of humans on this planet
7 x 10E+27 - the number of atoms in a 70kg human body
4.48 x 10E+39 - the number of atoms in all of the humans in the world combined

--- and finally ---
4.46 x 10 E+88 - the number of IPv6 addresses that can be allocated to each atom in each man, woman, and child currently living on this planet. (approx.)


...someone check my math....

Re:v6 could help solve some net problems

[Scott Wood]

Wouldn't DHCP still be useful for retrieving the rest of the IP address, as well as such information as nameservers and default router? It's just the address leasing aspect that you wouldn't need.

Re:v6 could help solve some net problems

[Basje]

I disagree. Making the net spammer-proof would not neccessarily end anonymity. You can always upload your stuff somewhere, and hope people look at it.

However, it would be the end of anonymous mailing. But I think that the receiver should be allowed to require people sending him mail to identify themselves. It's the classical debate of one's freedom ending where another one's begins.

Re:v6 could help solve some net problems

[dotwaffle]

Not only H2G2, but also a rather nice IM client ;)

Re:v6 could help solve some net problems

[AuMatar]

Of course, that would also mean no way to refuse the cookies either.

Re:v6 could help solve some net problems

[AuMatar]

There's always a reason for anonymity. Here's a simple one: I want it. According to the 10th ammendment, as the Constitution does not grant the right to take it away to the government, I have the right to be anonymous.

Re:v6 could help solve some net problems

[TRACK-YOUR-POSITION]

Good netizens who want to be anonymous do not use IP spoofing to achieve that end. They could use tools like freenet, or anonymous proxies, or lots of things I'm not thinking of. Heck, even freeloading from some business's insecured wireless internet seems less unscrupulous than IP spoofing.

Re:v6 could help solve some net problems

[Loconut1389]

DHCP is an extended version of BOOTP. The underlying protocol is the same, DHCP has some extensions.. a lot more now than used to be -ala Sun.

Re:v6 could help solve some net problems

[yerfatma]

But isn't NATing a Good Thing as far as the average user is concerned? It's got to be the most popular "firewalling" defense used in homes. Wouldn't a bunch of externally addressable IPs cause more problems than they'd solve in terms of machines being taken over?

Re:v6 could help solve some net problems

[Marxist Hacker 42]

My main problem with cookies isn't the actual tracking- it's the excess hard drive space taken up by tons of little tiny files that are essentially useless to me. Want to track my online activity from a certain machine? Use YOUR hard drive space to do it, not mine.

Re:v6 could help solve some net problems

[jrockway]

My ISP recently decided to NAT everyone. Now I can't log into my machine remotely. Now I can't receive email to me@rockway.gotdns.org. Now I can't use BitTorrent.

So no, NAT isn't a good idea. It BREAKS the internet. If I wasn't going back to school in a few weeks I would change ISPs. This is borderline unacceptable :)

Re:v6 could help solve some net problems

[AuMatar]

Maybe thats your problem, but mine is the tracking. Which is why cookies are disabled on my browser except for a very few websites.

Re:v6 could help solve some net problems

[M1FCJ]

Wait until "smart dust" concept really kicks in. A mole of (6.22x10^23) nanorobots will eat into your IPv6 numberspace pretty easily.

Re:v6 could help solve some net problems

[Soul-Burn666]

don't get all techy about that, he's a layman.

Re:v6 could help solve some net problems

[Anonymous Coward]

"Tricia"

Re:v6 could help solve some net problems

[Anonymous Coward]

shhh!!! You'll blow our cover!
A.C.

Re:v6 could help solve some net problems

[Anonymous Coward]

Static != Permanent

Re:v6 could help solve some net problems

[jonadab]

> "good netizens who want to be anonymous"

Being able to trace who owns the connection doesn't imply being able to
trace who is using it. They can always go to the library and be anonymous.
Most small public libraries don't even contemplate the possibility of asking
to see ID when you use the internet.

Re:v6 could help solve some net problems

[Short Circuit]

How much more? Additional curvature of the surface (like mountain ranges) increases the total surface area beyond what you'd get if you treated Earth as a sphere.

Just a little spontaneous food for thought.

Re:v6 could help solve some net problems

[sjames]

Bignumber doesn't begin to cover the v6 address space. Consider that a V4 address is just 32 bits while a V6 baddress is 128 bits. Consider also that all MAC addresses are globally unique and have only 48 bits.

This means that if everyone on earth wanted to connect their own personal (v4) internet sized lan globally, they could do so 2**63 times over with a little room to spare.

Re:v6 could help solve some net problems

[drinkypoo]

Your phone number doesn't prevent telephone anonymity because there are telephones outside your house which you can use for a small cash payment. Similarly, an IP address registry will not prevent internet anonymity, because there are computers outside your house to which you can gain access by the use of a cash payment.

There's also plenty of room for anonymizers which keep no logs and which take your communications to a cluster and then send the outward channel from a different system entirely. Of course, that comes down to how much you trust the anonymizer.

Re:v6 could help solve some net problems

[drinkypoo]

If cookies were entries in a database instead of a bunch of little flat files, then you wouldn't be having this problem. Oh wait, you mean there are browsers that do this already? Well shit wilbur, I guess this is a non-argument.

AFAIK only IE stores cookies in their own files any more. Mozilla (at least thunderbird) sticks them all in a single flat file, which is a database of sorts (if a simple one.) It's only a few bytes, and each cookie doesn't use up an entire allocation unit. I have about 290 cookies and they all use up only 28kB on disk. I can afford 28kB, I use probably use more ram than that by having a bunch of icons on my desktop.

Re:v6 could help solve some net problems

[the chao goes mu]

Except the shortage of valid domain names (which are ven vaguely memorable or pronounceable) would then come into play.

Re:v6 could help solve some net problems

[sjames]

Everything I've read indicates that using the MAC address to autoconfig prefixes longer than /64 is impossible, so I have to manually specify the last 48 bits of the IPv6 address on each machine.

Not at all impossible, just not covered by a standard. There's no reason not to cobble together a little script to do that for you. The /64 prefix gets the packet routed to your net. How you choose to route it from there is up to you.

Re:v6 could help solve some net problems

[Anonymous Coward]

10^38 < 2^128 < 10^39

2^128 = 10^log(2^128)

Re:v6 could help solve some net problems

[Marxist Hacker 42]

Yes, agreed- the problem can be rendered less important with smarter browsers. But this still leaves two problems, one for the end user and one for the web programmer, that cookies introduce but that simply does not apply using an IPV6 database:

1. From the web programmer standpoint, what do we do with users who have cookies turned off, or who delete out cookies regularly?

2. From the end user standpoint, the company is still using MY computer to store THEIR data; there's a philosophical point there. Sure, it's a small amount of space (on a modern hard drive do we even have allocation units measured in kB anymore?) Far better to have your stats for your webpage stored on YOUR server.

Re:v6 could help solve some net problems

[spektr]

Now I can't use BitTorrent.

BitTorrent still works (suboptimal) if you're NATed, because your client still connects to other clients (that aren't NATed) and uploads data to them (and thus receives data in return). You just won't get optimal download rates, because nodes that aren't NATed hold several times more concurrent connections. That's because everyone in the network can establish a connection to them, while a NATed node has only the connections it establishes itself (to clients that aren't NATed).

Re:v6 could help solve some net problems

[mreed911]

So make it easy, just remember: ssh 2031:0:130F::9c0:876A:130B Mike :)

Re:v6 could help solve some net problems

[Brand X]

They can always go to the library and be anonymous.

For now, until someone gets wise. See the Patriot Act, for why this is a dubious option for the U.S. over the long term, at least if Bush stays in office. And some internet cafes and similar shops are requiring IDs...

If you argue ad hominem, I get to argue ad quidquid latine dictum sit altum videtur!

Wow! Someone who can conjugate "video" instead of copying and pasting the incorrect "viditur" bit... but you still used a lowercase for "Latine". (Shades of my college Latin prof here.)

Re:v6 could help solve some net problems

[Woody77]

Well, if you're going to get picky about it like that, then it's infinite (ie, fractal).

Re:v6 could help solve some net problems

[Anonymous Coward]

NAT is not firewalling. If you're in the same broadcast domain as the NAT device and the NAT device does not perform firewalling as well, then you can directly address "private" nodes. The component which users really want is the firewall, not the address translation. Firewalls are just as effective without NAT. NAT only causes problems.

Re:v6 could help solve some net problems

[dgatwood]

If I move from CA to NY, the routers of the world would have to change their tables to be able to get information to me. That is just for one person. Now think of all the people who move or change ISPs.

Easily solved. How about something like this:

• 128 bits of addressing....
• lower 48 bits for the host ID
• next 40 bits for your internet number provider
• top 40 bits for current network routing info

The client could try to send a packet to the static IP number as-is. If it came back with a network unreachable ICMP response, the client would assume that the server moved. Thus, it could use a variation of the existing DNS mechanism to ask who routes for a given host ID part. The root server throws away the top 40 bits and looks at the second 40 bits (the number provider part). It then says "mybigisp.com knows the answer for those 40 bits". You ask dns.mybigisp.com, which might subdivide those 40 bits into a multi-tiered namespace according to where you lived when you joined the network, for example.

Now at that point, you have a regional host in your original home region which says "the last time I heard from myHostID, it was coming from mycurrentisp.com's routing space."

Next, you ask mycurrentisp for the current IP number for myHostID. It does the same multi-tier lookup based on some division of the 48 bit host id part and hands you back the current IP number with a new top 40 bits glued on. Routing then occurs using only the top 40 bits. This still gives you 256 times the current total IPv4 namespace to use for routing, and unlike IPv4, it can be allocated dynamically.

Now from your server's side, your machine thinks it has a static IP. The first router it encounters speaks some IPv6 routing protocol and says "I'm suddenly seeing packets from a device whose number provider ID is (insert 40 bits here). I'll notify my upstream, which eventually would get to your ISP's name server, which would propagate it across to the number provider's name server.

In a scheme like that, you could have a static IP and not have a static IP at the same time. :-) Or maybe I'm just nuts. Hard to say.

Re:v6 could help solve some net problems

[Danathar]

That's NOT going to happen. IN IPv6 you are not allowed to take your address with you to another ISP. All address blocks assigned by almighty on high are only to be given to tier 1 and possibly tier 2 providers. These Tier 1 and Tier 2 providers then subnet the v6 address space to their customers.

DNS becomes MUCH more important. Since that is the only thing you will be able to take with you if you move ISP's.

This was done to keep the internet backbone routers clean of having to deal with huge routing tables.

Re:v6 could help solve some net problems

[puddpunk]

Easy, you can just create more TLD's.

Or, become a company that just gives subdomains (no point in everyone having a secondry level domain).

i.e. james.rememberme.com
bob.accessmybox.net

etc..

Re:v6 could help solve some net problems

[erotic_pie]

I sure am :P

Re:v6 could help solve some net problems

[Xoder]

The curvature isn't much. Well known factoid: if we shrunk Earth to the size of a brand-new cue ball, the mini-Earth would be significantly smoother than the cue ball.

Re:v6 could help solve some net problems

[Anonymous Coward]

The truth is that the bandwidth is always supplied by ISPs to home or business, I agree with you, static is always the way to go. But we should make the ISP make rules like having a router or a gateway
assigned to each user, that way the ip will be static to those devices mac address
no mac, no ip, no bandwidth.
Allready in use by www.surewest.com, is fiber to home, but guess what, it has a fiber to ethernet conversion at the side of the home, there is a little device made by lucenttech. with its own mac address, any ip giving to end user cmputers or routers can easly be tracked to the little black box. HHHMMMM!
It may not be your computer, maybe it wasnt you, but it defentily came from your network. LOL

Re:v6 could help solve some net problems

[Webmoth]

BZZT! A mole is 6.02 x 10^23 items.

Re:v6 could help solve some net problems

[IncohereD]

In a scheme like that, you could have a static IP and not have a static IP at the same time. :-) Or maybe I'm just nuts. Hard to say.

You're not nuts, that's just absolutely not how IPv6 could ever work. Try talking to people about v7 or v8 and some of what you mention may be feasible.

Re:v6 could help solve some net problems

[Orgazmus]

The address is made up of a 64-bit network adress, and a 64-bit host adress that is exactly the same as the hosts mac-adress
Hope that clears some of it out

Re:v6 could help solve some net problems

[lokedhs]

No. There are different protocols for that. (I donät know the lames of them off hand, but it's certainly not DHCP nor BOOTP. that much I remember from the training course :-) )

Re:v6 could help solve some net problems

[Anonymous Coward]

ipv6 address space = 2**128

mass of atmosphere = 5.1 * 10^18 kg

weight of cubic meter of air at sea level = 1.2 kg

atmosphere volume = mass of atmosphere / weight of cubic meter of air at sea level

high level of bacteria in cubic meter = 5000

bacteria in atmosphere = atmosphere volume * high level of bacteria in cubic meter

amount of atmospheres of smart dust you could address with ipv6 = ipv6 address space / bacteria in atmosphere

(~1.6e+16)

Re:v6 could help solve some net problems

[Anonymous Coward]

the first 64 bits are by definition the network part: you can't subnet any further. A usual allocation would be a /48 which of course gives you 65K networks to play with, thought to be enough for most organizations.

Re:v6 could help solve some net problems

[Anonymous Coward]

... and then DoS kiddies will have no problems keeping you under continuous attack, since you won't be able to change your IP anymore. great idea.

Re:v6 could help solve some net problems

[Thing 1]

To pick nits, you're not receiving mail anonymously at Mailboxes Etc. I can send mail to you and then post a guard watching to see who picks the mail up that way, and follow you home.

I have served people that way in the past. ("Served" in the legal sense, that is.)

Re:v6 could help solve some net problems

[NuclearDog]

"on a modern hard drive do we even have allocation units measured in kB anymore?"

Who says everyone has a modern hard-drive? I have one hard-drive around here that (just to prove it could be done) has a fresh install of Windows 98 on it, plus Firefox and Thunderbird. The hard-drive is approx. 540 MB. Not everyone has even 28KB to spare for cookies :)

ND

Re:v6 could help solve some net problems

[jrockway]

Okay, thanks for clarifying it. I haven't tried it yet since I haven't found anything worth getting (mostly anime, sadly). But now I'll go looking knowing that I'm not leeching the network :)

Re:v6 could help solve some net problems

[tunah]

Huh? No they won't. Unless you're talking on the order of five hundred million tonnes of robots...

Re:v6 could help solve some net problems

[SenseiLeNoir]

This is already happening in IPv6 applicatgions outside the internet. All Bluetooth devices have an ID that is in effect its personal IPv6 Address. same with GPRS connections on mobiles.

Re:v6 could help solve some net problems

[hcdejong]

And port forwarding wouldn't solve this?

Re:v6 could help solve some net problems

[evilviper]

I'm worried about remembering ssh 2031:0000:130F:0000:0000:09C0:876A:130B

Which you could simply shorten to:

ssh 2031::130F:::09C0:876A:130B

But more importantly, you could just put it in your ~/.ssh/config file, and assign it whatever name you like:

ssh MERCURY

Maybe it's time for individual hosts files? eg. ~/.hosts

Re:v6 could help solve some net problems

[evilviper]

My ISP recently decided to NAT everyone. Now I can't log into my machine remotely.

All you need is access on another machine, that will let you use a single open port (any port at all).

Using SSH forwarding, you can make your machine connect to the non-NATed machine, and forward any arbitrary port number to the SSH port on your home machine.

Then, you just ssh to that port on the non-NATed machine. eg ssh yahoo.com:20001 will connect you to port 22 on your home machine.

It sounds complex, but it's really quit easy to do. Just make sure you enable keepalive in your config file, or it won't re-connect when it gets disconnected.

But yes, having a decent ISP, that doesn't screw you over, is a much better option.

Re:v6 could help solve some net problems

[gsgiles]

By the time we have nano robots that communicate the sun will have long gone cold, thus no one will care

Re:v6 could help solve some net problems

[yerfatma]

I understand that NAT isn't firewalling. What I mean is it's probably the one thing keeping most people's PCs, X-Boxes, whatever from being open to anyone who wants to break in.

Re:v6 could help solve some net problems

[M1FCJ]

What's 2x10^22 between friends?

Damn, has it been so long since I graduated?

Re:v6 could help solve some net problems

[M1FCJ]

In order of magnitutes, ipv6 will address approx 10^15 moles assuming perfect usage of the address space and routing, if I haven't calculated it incorrectly. (10^(38-23)=10^15), which is not that bad.

it's a sad day when no one can understand a simple joke. Well, this is slashdot. :)

20 years to work out the bugs?

[Michael Dorfman]

That's optimistic.

Re:20 years to work out the bugs?

[Anonymous Coward]

That won't leave much time after that for fixing all the Y2.032K bugs.

Re:20 years to work out the bugs?

[thegrassyknowl]

It must be Microsoft IPV6!

Perfect!

[mfh]

FTA: Cerf said about two-thirds of the 4.3 billion Internet addresses currently available were used up, adding that IPv6 could magnify capacity by some "25,000 trillion trillion times."

Perfect for colonization of other planets. If each human being has their own IP, then we would need to pack a whole bunch of planets to require more than that! They aren't kidding when they say they'll run IPv4 with IPv6 for twenty years. In that time, we won't have used even a fraction of a couple percent of available IPs, even if we assign every human being on the planet with one, and every company with a giant block.

Re:Perfect!

[ultrabot]

If each human being has their own IP, then we would need to pack a whole bunch of planets to require more than that!

Binding IP's to humans is arbitrary - it's more realistic to expect that every human with money is going to have several IP addresses (appliances, toasters, whatever), while most of the people in the world will have none.

Also, for some reason, I don't really like the idea of persistent per-human IP addresses. The idea has an Orwellian feel to it.

Re:Perfect!

[Anonymous Coward]

What does the percentage of used IPv6 addresses have to do with the duration of the coexistence of IPv4 and IPv6?

We will run out of IPv4 addresses within that timeframe, even if we don't colonize Mars and China stays mostly offline or uses its funny IPv4 translation.

IPv6 addresses are assigned differently to conserve router capacity and to avoid ugly hacks like NAT. It is recommended that end users are assigned blocks of /48 (2^80 addresses) or /64 (2^64 addresses) when there is only one subnet at the customer's site or /128 (1 address) when it is absolutely certain that just one device will be connected. This way of assigning addresses facilitates local auto-configuration and end-to-end connections.

Re:Perfect!

[TykeClone]

Also, for some reason, I don't really like the idea of persistent per-human IP addresses. The idea has an Orwellian feel to it.

You already have it (assuming your an American) - it's called your Social Security Number.

Re:Perfect!

[Eddy_D]

It's more likely that every persone on the planet would get a subnet, so they can assign their own IP adress to their appliance. Children could get temporary IP addresses until they become adults. - I dunno ...

Re:Perfect!

[yecrom2]

If each human being has their own IP, then we would need to pack a whole bunch of planets to require more than that!

I'm trying to find the link, but I read an article a couple of years ago that showed that with IPv6, every atom (may have been subatomic particle) in the known universe could have it's own address and we still wouldn't be anywhere near running out of addresses.

Matt

Re:Perfect!

[caluml]

I went to an interesting seminar where Vint Cerf was speaking, and one of his passions is the Interplanetary Network. There are some big problems to overcome when you're thinking that packets will take years to arrive.
Anyway, lots of the nameservers and mailservers that I use are already running v6. When will Slashdot do it, being the pioneering geek site that it is?

Re:Perfect!

[DreadSpoon]

You don't have to worry about that, though, because it isn't possible. How would the routers handle those (theoretical) 6 billion addresses? The routing tables could never handle it.

At best, you'd continue to have a dynamic address, and then have a static address that resolves to some sort of forwarding service. So some agency would own a big chunk of 6 billion addresses (and routers would only then need that one routing entry), and then that agency's network would reroute packets to those addresses to your current dynamic IP assigned by your ISP for whichever device you want the IP to relate to.

Which is pretty pointless and stupid, because you'll have many different devices and thus many different IP addresses, so what purpose would there be in having a single static IP just to refer to you personally?

(And no, conspiracy theorists, I'm not going to assume that we all have chips implanted in our heads; trust me, we'd have another Revolution before that happened.)

Re:Perfect!

[Anonymous Coward]

Did you know?

goatse.cx was IPV6 ready before the root servers, and will have been before slashdot ever will?

Re:Perfect!

[castlec]

It may be Orwellian, but we need some number to replace our beloved Social Security Numbers when it finally cannot be saved. It would make me feel better if there was some geek aspect to it. Wouldn't it make you feel better if you could calculate your mask :o)

Re:Perfect!

[Smidge204]

I don't need my SSN to make a phone call.

In fact, there are a lot of daily activities I don't need my SSN for, and I've never needed it online. It's hard to imagine any online activity that doesn't require an IP though.
=Smidge=

Re:Perfect!

[ultrabot]

And no, conspiracy theorists, I'm not going to assume that we all have chips implanted in our heads; trust me, we'd have another Revolution before that happened.

Stranger things have happened. "Important" people are already being fitted with chips via which they can be tracked in case of kidnapping. After 5% of people have something like this, it's not going to be a big step to start offering them for a cheap price, then free, then making them mandatory.

Re:Perfect!

[Anonymous Coward]

Imagine all of the new pro-life arguments!

Re:Perfect!

[pthisis]

Perfect for colonization of other planets. If each human being has their own IP, then we would need to pack a whole bunch of planets to require more than that!

IPv6 might work, but remember the comment from the Linux kernel about TCP:

Note that 120 sec is defined in the protocol as the maximum possible RTT. I guess we'll have to use something other than TCP to talk to the University of Mars.

Re:Perfect!

[skaffen42]

Actually, in some ways you do.

Buy a cellphone and they will do a credit check on you before they hand over the phone. To do the credit check they need a SSN. So somewhere in the phone company's database your SSN is tied to your phone number.

Draw your own conclusions from there...

Re:Perfect!

[stevey]

When will Slashdot do it, being the pioneering geek site that it is?

Probably just after the GIFs are dropped, and the table layout is converted to CSS.

Re:Perfect!

[quantum bit]

There are some big problems to overcome when you're thinking that packets will take years to arrive.

Bring back FIDOnet?

Re:Perfect!

[Smidge204]

Being the owner of a cellphone, I can attest that I was never asked for my SSN. I don't recal a credit check being necessary, either. It wouldn't surprise me if the phone company had my SSN, but they probably got it from somewhere else since at no point do I recall giving it to them.

=Smidge=

Re:Perfect!

[Anonymous Coward]

Nope. 2^10 is about the same as 10^3, so 2^128 is about the same as 10^38.

14 grams of carbon equals 6.0221367*10^23 carbon atoms. So 2^128 addresses could identify each atom in just (14/6)*10^38/10^23 = 2.3*10^12 kg of carbon. That's not much compared to the mass you're standing on: 1 earth mass = 5.9742 × 10^24 kg.

Re:Perfect!

[mark-t]

Many personal IP addresses that do not sit on what we would conventionally call a programmable computer, such as those for appliances, toasters, etc, could just as easily simply be behind a NAT, as there is no general need for systems outside to access what is inside. Holes could be punched into the NAT as required when outside access is needed, without polluting global IPv6 address space.

Re:Perfect!

[phineasx]

On the topic of routing tables, IIRC, the way its supposed to work is that your ISP gets one ginormous block of IPs, which is then broken up for each end subscriber. That way, a certain netblock represents an entire ISP, so routing wise you end up with a bunch of really large networks in your routing tables, not a large number of entries. It's route summarization as it should've worked, until people started moving around with subnets and scattered stuff all over the internet.

Re:Perfect!

[cmdr_beeftaco]

never need SSN online
Citibank is always emailing me asking me to enter my SSN and account number for a routine security check. It got really tiresome so I wrote a really nifty macro in Outlook to navigate to the security check link and enter my SSN and account number everytime the email arrives.

Re:Perfect!

[Anonymous Coward]

You don't have to worry about that, though, because it isn't possible. How would the routers handle those (theoretical) 6 billion addresses? The routing tables could never handle it.

Not yet Bill Gates.

A brief and redundant article

[Bold Marauder]

Really doesn't say much that slashdotters don't already know (it's a very

short article). There is one descrepcy that I'm sure I won't be the first

to notice it, either:

Rapid growth in the use of the World Wide Web has in recent times

prompted concerns about future scarcity of domain addresses, with

demand threatening to overload the existing system, the IPv4.

Now, I could be wrong; but my understanding was that the need for IPv6 comes from the scarcity of IP addresses (eg 12.34.56.78) not the scarcity of domain names (eg slashdot.org, slashdot.net, slashdot.jp).

Re:A brief and redundant article

[double-oh three]

Which brings up the point, what are we going to do when domain names get scarcer and scarecer? More top-level domains? Change it so that there's a www2., www3. ?

Re:A brief and redundant article

[bheerssen]

The term domain addresses refers to IP addresses, not domain names.

Re:A brief and redundant article

[networkBoy]

www2 / www3 / etc is already being done *(virtual hosting for example) Likely will be more TLDs.
-nB

Re:A brief and redundant article

[TopShelf]

Change it so that there's a www2., www3. ?

No, it would be www, wwww, wwwww, wwwwww, etc...

Re:A brief and redundant article

[BagOBones]

Top level domains are .org .net .com ....

www2., www3 are just subdomains

Re:A brief and redundant article

[AndroidCat]

A modest proposal: Add mark-up to domain names. Then you could have slashdot.org, slashdot.org and slashdot.org as different domains. Add in fonts and colour, and the numbers are huge! (I'd want to register microsoft.com in green Barf-Bold, but their lawyers might object.)

Re:A brief and redundant article

[FinestLittleSpace]

That already exists. It's called a SUBDOMAIN...... 'www' isnt an obligatory subdomain to have on a web address in theory, it just happens to have become standard. There'll never really be any solution for lack of domain names... you just have to be more and more imaginative.

Re:A brief and redundant article

[0racle]

host.domain.tld

www, www2, and www3 are host names, slashdot is a domain, com is a top level domain. Well often www is just a common name for another host, but it has nothing to do with the domain the site is in, or the service it provides.

Re:A brief and redundant article

[Jahf]

Actually:

www.com

and

www2.com

both are valid domain names ... I'm sure others are too. While I get the spirit of your post, it is not necessarily accurate.

Re:A brief and redundant article

[joeljkp]

That doesn't make his post invalid. In your example, "www" is just the domain name. You don't need a hostname to have a valid domain name. See slashdot.org (instead of www.slashdot.org).

Those sites could just as easily be written as www.www.com (host.domain.com).

Re:A brief and redundant article

[Jahf]

No, really?

My point was that saying "www2", etc out of context do not canonically prove that they are hostnames.

I didn't say his post was blatantly invalid, only that it wasn't specific enough to always be true.

Remember those wonderful "true or false, if some mammals are people, and all slashdot readers are people, then all mammals read slashdot" exercises? This was one of those.

Re:A brief and redundant article

[glitch23]

Now, I could be wrong; but my understanding was that the need for IPv6 comes from the scarcity of IP addresses (eg 12.34.56.78) not the scarcity of domain names (eg slashdot.org, slashdot.net, slashdot.jp).

Realize that what you put in italics from the article says "domain addresses" so I think they meant IP addreses, not domain names. You could stretch "domain addresses" to mean IP addresses.

I do wish

[tekiegreg]

I could get something equivalent to my own Class A block of IPv6 addresses for my home. I'd give every object in my apartment an assigned IP Address. How the pieces of toilet paper get access to the Internet would remain to be seen, but at least on paper (heh) it would have an IP Address. And why not? So many IP addresses possible I could have my own class A block (or IPv6 equivalent) and hardly put a dent in the amount of available IPv6 addresses...but until an ISP offering DSL in my area supports IPv6 I'm outta luck...

Re:I do wish

[Anonymous Coward]

You can't just give objects IP addresses like you are handing out cookies to homeless people. Your object must have a network interface to start with, or do you put microchips in your pieces of toilet paper?

Re:I do wish

[dotwaffle]

Maybe there is a market in this... You have an ISP to sell you bandwidth and actual access, while another company either sells or leases you IP's... No, wait, that's a crap idea. But it already happens...

Re:I do wish

[Vancorps]

I would suggest you check this out.

You can have a whole octet to yourself right now. That's a lot of IP addresses and you're ISP doesn't have to support IPv6, it can be encapsulated in IPv4. There are plenty of gateways out there that will translate the request for you so that only your router will need both IPv4 and IPv6.

It's all up on FreeNet.

Re:I do wish

[Unnngh!]

do you put microchips in your pieces of toilet paper?

Well, with hardware being free in the future and all, sure, why not! Imagine a beowolf cluster of those;)

Re:I do wish

[operagost]

How the pieces of toilet paper get access to the Internet would remain to be seen

NOW I will finally know who is leaving the roll empty!

Re:I do wish

[zhenlin]

Class A... Mmm, do you mean a whole /56 (-8)?

What would you do with 7.2057594 × 10^16 (72 quintillion) addresses?

It's too bad that one mole of hydrogen gas (a measly 2g of hydrogen gas, approx. 24 litres at s.t.p.) has approx 8,357,400.87 times more molecules than you have IPv6 addresses in a Class A block.

Interesting factoid: There are roughly enough IPv6 addresses (assuming all the 2^64 addresses are used) to address one 2^-15 of a mole...

I wonder how long before we reach one Googol addresses (~2**333). And after that, realise that variable-length addresses are most forward compatible.

Re:I do wish

[Mr Smidge]

I would also love a block of live IPv6 addresses for my home. I currently have an old P200 doing NAT for the network, and it's bloody great. I run Smoothwall linux on it, which is designed to be run on machines acting as a firewall/router.

Do any similar distros do this for IPv6?
Is it easy to migrate an IPv4 NAT network like mine to IPv6 (assuming all the clients are IPv6-capable)?
Oh, and what do people mean by "/48"?

Have any people successfully set up something like this, maybe using services like freenet6?

Thanks people.

Re:I do wish

[Anonymous Coward]

Well the problem is, in that future all the free hardware is running Windows(c)(r) 2010(c)(r) Special(c)(r) Reloaded(c)(r) HPC(c)(r) ME(c)(r) Hornylongtime(c)(r) Edition(c)(r).

So not only will it cost $250 a sheet, but the heat coming off the CPUs and gigabytes of memory to run each bit of paper will probably give you third degree burns on your anus.

Oh, and you wouldn't want to know about the possible viruses your toilet paper can get.

Love that free hardware though.

Re:I do wish

[MacGod]

I wish I could get something equivalent to my own Class A block of IPv6 addresses for my home. I'd give every object in my apartment an assigned IP Address. How the pieces of toilet paper get access to the Internet would remain to be seen, but at least on paper (heh) it would have an IP Address. And why not? So many IP addresses possible I could have my own class A block (or IPv6 equivalent) and hardly put a dent in the amount of available IPv6 addresses...but until an ISP offering DSL in my area supports IPv6 I'm outta luck...

See, to me, this is the exact thinking that got us in trouble in the first place! I realise that IPv6 has a hojillion (the technical term) times more addresses than v4, but if we start doling them out on a whim, we're going to hit the same problem again. Remember, there was a time when we though v4 addresses were all but infinite... hence Apple, Ford and Halliburton each were granted 16 million adresses (which they don't realistically need)

Human nature seems to tend towards excess whenever possible. Fresh water, trees, the ozone etc were all once abundant and we thought we'd never be able to make a dent in any of them

Even with the truly massive number of available addresses in IPv6, I'd still like to see some careful thought put into their assignment.

Re:I do wish

[Jhan]

...your ISP doesn't have to support IPv6, it can be encapsulated in IPv4. There are plenty of gateways out there...

I keep hearing this claim. Let me get this straight, once and for all. I have a 16/16Mb connection, and I use it. How could a free, underpowered relay in Farawayistan ever handle that?!

Also, what about my el-cheapo Zyxel POS firewall, what will it think about IPv6?

Re:I do wish

[Anonymous Coward]

How the pieces of toilet paper get access to the Internet would remain to be seen, but at least on paper (heh) it would have an IP Address...

For your proposed toilet paper application, won't you need IPoop addresses rather than IP's?

Re:I do wish

[tekiegreg]

Well yeah but...

Total IP Addresses in a Class A Block (approx, depending on subnetting): 4,000,000

Total IP Addresses possible in IP v6 (approx): 300,000,000,000,000,000,000,000,000,000,000,000,00 0 (Googled that number)

Class A Block / IP adds possible in Ipv6 = 1.3 * 10^24 or approximately %0.000000000000000000000013 of the total IP space. Disclaimer: I'm not the best at math even with a calculator I screw up :-/

However I can take 4 million IP addresses and leave plenty for the 8 billion other people on this planet with room left for any extra-terrestrials that choose to adapt to TCP/IP in the future.

Re:I do wish

[Jahf]

Welcome to 1992.

Re:I do wish

[gunpowder]

I would also love a block of live IPv6 addresses for my home. I currently have an old P200 doing NAT for the network, and it's bloody great. I run Smoothwall linux on it, which is designed to be run on machines acting as a firewall/router.

I do not fully understand your question. There is no NAT for IPv6 (at least Linux doesn't support it, there is no need for it, and AFAIK it doesn't even exist). If you referring to a IPv6 router/tunnel gateway, then yes, Linux can do that easily.


Do any similar distros do this for IPv6?

I haven't come across a all-in-one IPv6 capable firewall Linux distribution. However it is not to difficult to enhance an existing with IPv6 support (usually you just need ip6tables, radvd and a IPv6-enabled kernel).


Is it easy to migrate an IPv4 NAT network like mine to IPv6 (assuming all the clients are IPv6-capable)?

Yes, it is rather easy. The only thing you'll need in most setups is running 'radvd' on the IPv6 router.


Oh, and what do people mean by "/48"?

Let's assume you have the IPv4 class-A network 45.x.x.x. Its netmask is therefore 255.255.255.0. This is often abbreviated with the suffix /8 (like in 45.0.0.0/24).
The /8 means that the first 8 bit of the IP address specify the network (and are fixed), and the rest (32bit - 8bit = 24bit) specify the host (and can be used by you). In our example this means you can have/choose IP addresses from between 45.0.0.0 - 45.255.255.255.

If you have a IPv6 network with a /48 prefix, it is quite similar; however a IPv6 address has 128bit. instead of 32bit (for IPv4).
For example, let's assume you have the following IPv6 network 2001:1:1::/48.
This means the first 48 bit are fixed (2001:1:1:) and you can use (128bit - 48bit =) 80bit to address any host in your subnet. Just a remark: the numbers between two colons ':' of an IPv6 address are 16bit wide. So the range would be from
2001:0001:0001:0000:0000:0000:0000:0000 to
2001:0001:0001:FFFF:FFFF:FFFF:FFFF:FFFF.

That's a big number: 1,208,925,819,614,629,174,706,176 addresses just for you!

Re:I do wish

[gunpowder]

Oh, I forgot to answer your last question:

Have any people successfully set up something like this, maybe using services like freenet6?

Yes, quite some have, including me. I was using freenet6 (with a /48 subnet) before I discovered www.sixxs.net (which I can really recommend to european users). Sixxs.net just announced it's 1000th subnet (and has a little more than 2000 users).
There are many more IPv6 tunnel ISPs, just google for "IPv6 tunnel broker". Choose the ones which are closest to your location (low pings) and offer the good service/support (no filtering, good forums).

Re:I do wish

[joeljkp]

How does that work with a D-Link NAT router?

Re:I do wish

[Anonymous Coward]

With 6to4 you are the gateway on your side of the connection and the gateway on the other side of the connection is as close to the destination as possible. There is no slowdown (except for the encapsulation overhead) to other 6to4 nodes, because they are their own gateway, just like you. Pure IPv6 nodes need an external gateway which does the encapsulation for them, but it's safe to assume that progressive networks have a gateway nearby, probably right in the normal path.

Depending on its location on your network, your mini firewall will either see the encapsulated packets (of which it will only inspect the outer layer), or it will see and probably drop the IPv6 packets. Either way it is useless and should be replaced by something more modern, like a Linksys WRT54g with OpenWRT and IPv6 support (either available now or coming soon).

Re:I do wish

[Anonymous Coward]

There is no NAT for IPv6 (at least Linux doesn't support it, there is no need for it, and AFAIK it doesn't even exist).

Sure there's a need. Increased LAN security.

Re:I do wish

[Vancorps]

That is what the client is for, you can either put the client on your end machine or put it on a router that supports IPv6 and IPv4. Otherwise you're stuck with just using the client on your computer which isn't that bad, you still get access to all the services that run on IPv6 only currently.

Re:I do wish

[Vancorps]

I don't think you understand what is gained by using the gateway. First off, only IPv6 traffic goes to the gateway, all the IPv4 data is sent as it currently is. Second, you gain access to an entire network of very useful resources which you obviously didn't know existed. Last but not least, FreeNet is hosted out of the U.S. and throughout Europe; it represents the combined effort of many organizations over the last 10 years.

You're el cheapo firewall is irrelevent since the IPv6 traffic is encapsulated in your IPv4 traffic. So as long as you don't do content filtering it works fine, although I'm not sure it even supports content filtering so odds are it works fine.

Totally no idea how that was modded as insightful.

Re:I do wish

[Anonymous Coward]

Damn! That would be the shit!

*har har har*

Re:I do wish

[Mr Smidge]

I do not fully understand your question. There is no NAT for IPv6

I was indeed referring to an IPv6 router with no NAT involved, which is what I meant by "live" IP addresses. Sorry about the confusion.

Thank you for the very informative reply.. I'll be looking into this quite soon then!

Re:I do wish

[sjames]

6to4 is a distributed system. 'The' Address of 'the' 6to4 tunnel is 192.88.99.1. That address is announced by many various networks that are on the v6 net and the v4 net. Which one you get will be based on the route to the closest available tunnel. Your 6to4 prefix is based on your v4 address. So, any 6to4 tunnel can know how to get encapsulated v6 packets to you.

The load for the tunnel server consists almost entirely of the bandwidth. The 6to4 protocol is nothing but pre-pending v4 headers to v6 packets.

Your cheapo firewall will (at worst) see the 6to4 traffic as an 'unknown' protocol over IP.

Re:I do wish

[gunpowder]

I was indeed referring to an IPv6 router with no NAT involved, which is what I meant by "live" IP addresses. Sorry about the confusion.

Well, there are global scope IPv6 addresses (like official 'live' IPv6 addresses), site local (internal lan addresses, like 192.168.x.x for IPv4, but its use is deprecated) and link-local (used for IPv6 autoconfiguration). If you want to have a working IPv6 connection to the rest of the world, you will need (a) global scope IPv6 address(es). Thats what the IPv6 providers (native ISPs, tunnel broker) will assign to you.

Most IPv6 tunnel brokers (freenet6, sixxs, ...) will give you one (single) IPv6 address for your end of the IPv6 tunnel, and if you requested e.g. a /48 subnet, they'll additionally give you the 48bit-prefix you have to use within your subnet. So you can use a whole (128 - 48 =) 80bit address range for your subnet, just the first 48bits are fixed.

Usually the IPv6 addresses are derived from your (48bit)-MAC address to automatically create a (64bit)-EUI-64 IPv6 address. For this to work you have set up a router advertizing service (e.g. radvd under Linux), which will broadcast - within your lan - the prefix to use, and the PCs in your lan will use this info and automatically create proper IPv6 addresses by themselves.
However if the IPv6 'privacy extensions/temporary addresses' are enabled on a PC (by default enabled on Windows, disabled on Linux), it won't create a EUI-64 IPv6 address (from which you can easily figure out their MAC), but it will use a randomized IPv6 address instead.

You can also avoid using 'radvd' entirely and just setup your PCs to use statically assigned IPv6 addresses (e.g. in the PC's boot scripts), and thus you can make full use of the 80 bit address range.

N.B. there is also a DHCPv6, so you can assign to each MAC address a unique IPv6 address YOU specify, but the DHCPv6 protocol is work-in-progress and I haven't seen a working implementation yet.


I suppose your current network setup is something like this:

Internet ------ NAT box ------ Hub ====== PCs

In this setup you can either use the NAT box itself as a IPv6 tunnel endpoint/router, which will provide your subnet with IPv6 connectivity.
Another way would be to port-forward the IPv6 tunnel traffic to any of the PCs behind the NAT box, and do the IPv6 routing from there.

Anyway, when the PCs in your lan want to connect to a host on the internet via IPv6, they will connect to the IPv6 router, and the router will forward the packets though the IPv6 tunnel to your IPv6 tunnel broker.
Since the tunnel broker need to know that you are entitled to use their service and where they should forward the IPv6 tunnel traffic, you might also have to 'login' or use a special software to initiate/enable the IPv6 tunnel. How this works exaclty depends on your IPv6 tunnel provider.

Re:I do wish

[gunpowder]

One more thing:


Usually the IPv6 addresses are derived from your (48bit)-MAC address to automatically create a (64bit)-EUI-64 IPv6 address.

Of course this means that you still have (128bit - 48prefix - 64bit-EUI =) 16bit you can use for subnetting.

An example:
You have been assigned the following /46 subnet prefix: "2001:1234:5678::/48".

Then you will be able to use the following /64 subnets: from "2001:1234:5678:0001::/64" to "2001:1234:5678:FFFF::/64".
Note that one /64 subnet is usually more than enough for most people.

If you then use radvd to broadcast the prefix "2001:1234:5678:0001::/64" on a network interface, all the PCs which receive the broadcasts will automatically setup their IPv6 addresses accordingly and can connect to the (IPv6) internet.

Re:I do wish

[evilviper]

Better yet, make a patch to the IPv6 stack, that allows every single packet to use a completely different IP address from the pool of the millions you have...

Crazy though it may sound, I certainly would like to have a random IP for every different server I visit.

20 years of Bug Testing?

[Anonymous Coward]

Sounds like an open source project to me. I'm surprised they didn't just rename it to IPv0.4 so they could use the fact that it's pre-1.0 as a safety net for bugs, etc.

Re:20 years of Bug Testing?

[RicochetRita]

20 Years? Years?
Assuming we'll still be using 1990's technology then. But, Twenty Fscking Years? I'm envisioning their "IPv13 beta.006" systems will still be supporting backwards campatability with our IPv6, just so it can become officially "phased in."

Say, didn't the US plan to phase in the Metric system over a similar timespan? And we all know how well that turned out...

R

Re:20 years of Bug Testing?

[reflective recursion]

Considering IP (v4) is over 20 years old and we still have issues with it, I don't see the problem o f keeping it around. And you are forgetting that people still use COBOL. You really think all those programs using IPv4 can just be switched over? It's the same problem as Y2K, though I think this one can't be considered a "bug" and that is exactly why they are giving it 20 years. So people *aren't* forced into upgrades.

You can quote me on this too.. there will be nothing after IPv6. Every neuron in every single *creature's* brain on the entire face of the earth can be addressed with IPv6. I'm sure the singularity event will occur and other freaky shit long before we run out...

Re:20 years of Bug Testing?

[syousef]

20 years of Bug Testing? Sounds like an open source project to me. I'm surprised they didn't just rename it to IPv0.4 so they could use the fact that it's pre-1.0 as a safety net for bugs, etc.

Isn't the standard approach for open source no bug fixing and if someone complains point out that its free, they paid nothing for it, no one owes them anything, and btw RTFM :-)

I'm kidding of course. I know there are lots of open source projects that are very good about quality control. I'm using Firefox right now.

Re:20 years of Bug Testing?

[evilviper]

on the entire face of the earth

Which means we're screwed when the internet gets popular on Mars... And you know it will, because they won't have anything better to do.

Feeling Old

[Prince Vegeta SSJ4]

It seems like just yesterday, I was surfing the Web, telnetting ports and Cracking warez with little old IPv1, strange - we are on v6 now and I dont even remember 5. guess I'm suffering from geezer syndrome.

Re:Feeling Old

[Paladine97]

Gee that's amazing considering how the web was invented during the time of IPv4. See here for information about IPv5. IPv1 is probably lost to antiquity by now.

Re:Feeling Old

[wonkamaster]

Not too many people remember v5. The IP version is a reference to the IP header "version" field, and 5 was reserved for ST2: See RFC 1819 Sesion 1.2, 2nd paragraph.

So what do you call the next IP version? Version 6, of course!

Re:Feeling Old

[Anonymous Coward]

gee that Bill Oreilly knows everything, amazing

Re:Feeling Old

[Tarpan]

Slashcode needs a "-1, Boring and pointless correction to an attempt at humor"

Re:Feeling Old

[Nefarious Wheel]

Any relation to Caspar O'Rillian?

idiot

[Anonymous Coward]

it's called RFC 1918 - use 10.x.x.x. Your very own class A address range!

Re:idiot

[Anonymous Coward]

I'd like to have port 80 open and accessable via the internet on every host in that address space. Please advise.

Re:idiot

[Anonymous Coward]

Please advise.

My advice is "get a life." There has GOT to be something you can do that is more worthwhile than browsing your toilet-paper remotely.

Re:First Post!!!!

[Anonymous Coward]

Someday, I hope you will have the opportunity to explain to your grandchildren how YOU FAIL IT!

IANA request

[dmeranda]

The IANA request that ICANN support IPv6 on its root servers is found here. And the timeline given then was:

"...the first of the IPv6 glue records will be added to the root zone on 28 June [2004]."

This is just the first step to real world-wide IPv6 deployment (replacing the mbone experimental setup). You still need to get all the intermediaries like ISPs up to speed.

Re:IANA request

[Eslyjah]

Why would I think you are a request? Of course you're not!

much better than the HDTV transition

[Anonymous Coward]

I'd say that 20-year IP 4-to-6 transition
estimate more realistic than the NTSC-to-HDTV plan,
not to mention the relatively elegant solution for
IPv4 and IPv6 to coexist as they do now.

Re:much better than the HDTV transition

[Anonymous Coward]

I still think poetry is much better when it rhymes.

policy problems

[Feyr]

an ip address for every human being... and they're non portable great!

i've said it before, and i'll say it again: ipv6 looks good on paper, but their current policy of not assigning IPs to anyone but big isps who will in turn sub delegate them to others is hindering the usefulness to small and medium ISPs

basicly you'll be locked into one isp, or face a major renumbering burden due to the non-portability of the addresses (and no it does NOT involve simply switching the network part)

Re:policy problems

[Anonymous Coward]

Addresses have never been portable: subnets are. And they still will be under IPv6.

Re:policy problems

[ViolentGreen]

Sounds like a personal ID number to me. A worldwide SSN.

Re:policy problems

[paskie]

Thanks to the autoconfiguration etc, IPv6 makes the renumbering much easier.

And what does it involve except simply switching the network part, then?

Also, if you discover a good scalable way to assign IP ranges directly to the end sites instead of ISPs, please tell us - (AFAIK) noone before you did.

Re:policy problems

[brufleth]

Just to restate. IP address are not portable. You can not be assigned a number that will follow you. "Device specific" IP addresses only make sense on small networks. In general IP addresses are tied to geographic location and/or ISP/company networks. If I have one IP in Boston and then I go to Tampa it would not "work" for my IP address to follow me. Thing of a branching tree. If you make a series of choices you get to the end of a branch without having to look at the end of every other branch. That's the way IP works...roughly.

Re:policy problems

[Feyr]

what about changing the domain names pointers for the thousands of domains pointing to the previous ip addresses? often in name servers not controlled by you? going through customers who, most of the time, dont even have a clue as to what a nameserver is?

i didn't say i had a solution, in fact i don't think there is one. on one side you have bloating of routing tables, on the other huge pains for anyone whose name is not MCI (or any big ISP)

Re:policy problems

[Anonymous Coward]

That's what the A6 record in DNS (RFC 2874) is for.

An autoconfiguration actually works with IPv6 (contrary to IPv4), making it easy to renumber.

Running out of IPv6

[rdspider]

I cant help but wonder when we will run out of these because: every person with an ip, every computer shipping from the factory with an ip, every rfid tag with an ip *tin foil hat time* its odd how quickly we can mess up a good thing..

Re:Running out of IPv6

[randomencounter]

Well, since there are enough addresses in IPv6 to give every grain of sand in the solar system a unique IP address with plenty to spare, I look forward to trying to exhaust the address space.

Re:Running out of IPv6

[Precipitous]

I decided to speculate on wasteful uses of IPv6 addresses, and run some calculations on how long it would take to expend them.

Method #126: Mote technology matures. Intel is working on them. Berkely is working on them.

Each mote gets an IPV6 address. Maybe you drop a few hundred into each automobile to test everything from tire pressure to CO2 content in exhaust. I don't think this comes close to exhausting the IPv6 addresses.

Method #127: RFID tags for consumer goods. Give each and every consumer product an IPV6 address to track it from manufacturing to purchase.

Reasonable uses of IP addresses? Maybe not. But with 2^128 addresses, it would still take a very long time to use all of the address even with blatent misuse of them.

2^128 is 10^14 moles. A chemist could give you precise estimates, but a 300 milliter can of distilled water contains about 15 mole molecules of water. So, lets say that you could put an RFID tag on every water molecule in every can of pop sold. Maybe water rationing is getting very serious. You'd still have to drink 10^13 cans of pop. Coca cola sells about 4.3 * 10^9 bottles of pop a year. We could go about 23,000 years without needing to recycle IPv6 address on the water molecules. On the one hand, if we can figure out how to attach wireless TCPIP enabled RFID tags to water molecules, we can probably upgrade our IP protocols. On the other hand, who wants to update the hardware attached to 10^14 moles of water?

My urls

[vivekg]

Ah! Now I will have: www.me.com - Web site mobile.me.com - To contact me watch.me.com - My wristwatch mykids.me.com - My kid home page foo.mykids.me.com - Foo (my kid) home page home.me.com - My home network and other home appliance can be control from here (authentication require) router.home.me.com - My DSL err LL connection via LINUX :-)

My coffee grinder needs an IP...

[Saeed al-Sahaf]

Excellent. My shoe polisher needs an IP address. So does my bottle of shampoo.

Re:My coffee grinder needs an IP...

[ch-chuck]

dont be too suprised to see an IPv6 / RFID convergence - in The Future® those little tags will not only tell who they are, but where they've been and what you've done with them.

Re:My coffee grinder needs an IP...

[TobiasSodergren]

Bad idea.. Some mischevieous person might unleash a Denial Of Schampoo attach when you're in the shower.

Re:My coffee grinder needs an IP...

[Anonymous Coward]

Move ahead 30 or 50 years, and it WILL. When EVERYTHING by law will have to have RFID v2 and Wifi is everythere, everything will be tracked for the sake of tracking it. So your not wrong. Go get some IP's and you have a head start.

Re:My coffee grinder needs an IP...

[Just Some Guy]

And that would affect the average Slashdot reader how?

Is it just me

[oO0OoO0Oo]

or does "virtually unlimited" seem like a very silly and shortsighted estimate of the number of possible addresses? Especially because the uses/monopolization of these addresses will probably grow in unforeseeable ways.

Re:Is it just me

[imsabbel]

2^128 IS virtually unlimited. Even enough for every braincell in every human that has ever lived to get an IP.

Re:Is it just me

[Planesdragon]

I once heard IPv6 as being enough to give every atom on the planet its own address.

25,000 trillion trillion times IPv4 -- we won't run out of IPv6 anytime soon.

Re:Is it just me

[DAldredge]

128 bit addresses allow for 2^128=340,282,366,920,938,463,463,374,607,431,768, 211,456 total theoretically assignable addresses.

THAT is a virtually unlimited number. ;->

Re:Is it just me

[Ianoo]

Even if humankind puts 5 billion people on a planet around every star in the galaxy, that's still 680564733841876925 IP addresses per person.

Re:Is it just me

[Anonymous Coward]

IF we can figure out a way to assign 1,000,000,000 a second, it will take us aprox 10790283070806014188970.52915499 YEARS to use up all of the IPs, which is about 899190255900.5 times longer than the universe has been around. I think we'll be safe from not using them up.

Re:Is it just me

[drinkypoo]

The only thing that could make IPv6 insufficient is if we developed faster than light communications and travel and tried to develop a universal internet, and then reproduced at the maximum rate for a long, long, LONG time. I'll get back to you with IPv7 specifications for 512 bit addresses when someone develops FTL travel - until then, sit tight, it's a non-issue.

Re:Is it just me

[shird]

But what if a few people want to reserve a range for doing their own 'universe simulation project' which requires mapping random particles to IP addresses. Even if they dont use them all, there may be a number of people that need to reserve ridiculous size ranges, or want to map the addresses in strange ways. For example they may require 48bits for mapping MAC addresses, 56bits for mapping DES keys, or a huge amount for mapping hashes etc

IP's for everyone!

[Banner]

This reminds me of the movie 'The President's Analyst' only now we're talking IP addresses instead of phone numbers, and ICANN has superseded TPC (The Phone Company) :-)

Wonder who'll play Coburn's part in the new movie?

Duke Nukem Forever

[awhelan]

Sweet! All the bugs will be worked out just in time to play Duke Nukem Forever online!

other companies should consider

[fonzer]

like maybe microsoft builds a actually decent operating system and has it run along side 3.0 for twenty years

Re:other companies should consider

[drinkypoo]

First they have to come up with an operating system that can run for 20 days.

IP? IP??? Heck, I'm still using DECNET!

[Anonymous Coward]

IPv6? I was going to upgrade to IPv4 this fall.
Geesh, my VAX collection in my basement is gonna have to be upgraded now. DECNET's still good enough for me.
(yeah, yeah, I do have a translation gateway just so I can post on Slashdot)

TDz.

Personally...

[aznxk3vi17]

I, personally, am looking forward to accessing the internet from the toilet paper I'm about to use to wipe my ass, while the toilet sends data about my fecal matter to the health department website, where they analyze to see if my poopy is healthy. Then, after the flush, the water pipes measure the amount of water going through them and access my water bill through the internet, telling me how much I've spent.

What, can you think of better uses for a mole of IPs per square foot?

Re:Personally...

[BillyBlaze]

Actually, I just figured it - you get 407 moles of IP addresses per square foot of earth (including oceans).

Re:Personally...

[Anonymous Coward]

I, for one, welcome our new internet accessing toilet paper overlords

There, not here

[Anonymous Coward]

I can't get a native IPv6 address (block), and I'm on a university network. Neither can I get a IPv6 address from T-Online at home. To me this means that IPv6 is there, but not here.

Re:There, not here

[Anonymous Coward]

Use 6to4 with anycast. No tunnel brooker. No need for addresses from your ISP.

Re:There, not here

[Anonymous Coward]

That gives me unicast. What if I want to use multicast without encapsulating a copy of the packet for each recipient?

Will arrive soon!

[novakane007]

"I like how they said that it will run along side IPv4 for 20 years to get rid of the bugs"
Fantatstic! This means it will only be another 20 years before we get a mass roll out of IPv6. *grin*

My IPv6 Rant

[GeorgeH]

I posted How the Internet is broken, how to fix it, and why that's not going to happen, a rant about IPv6 adoption, to my personal site.

Basic idea - include IPv6 over IPv4 tunneling software in Linksys routers. This would allow people to run IPv6 networks in their houses and talk to IPv6 networks elsewhere. This would fix a lot of problems that NAT introduces, and would sidestep the wait for IPv6 ISPs. It would also provide enough of a user base to encourage application developers to include IPv6 support.

Of course, this would kill Linksys' NAT router sales, so they have no incentive to do so, but I like to think it's a good idea.

Re:My IPv6 Rant

[Anonymous Coward]

Oh dear oh dear!!

I think CISCO sell routers as well.
Maybe they're in on it to.

Re:My IPv6 Rant

[whollychao]

I don't know about killing NAT router sales... I don't want to have to spend all day and night staying on top of the latest patches to my toaster's TCP/IP stack software to prevent a hacker from ruining my morning breakfest by crisping my bread remotely. I like the idea of there being a single, relatively simple, machine between my LAN and the rest of the world.
NAT is useful for allowing many computers to have net access without using a valid internet IP address for each one, but it's also nice for restircting remote access to only those machines that should have it.

Re:My IPv6 Rant

[GeorgeH]

I don't think it's a conspiracy, but I also don't think Linksys is actively researching ways to cannibalize their home business market, much in the way Microsoft isn't contributing a lot of code to Wine. However, as I've said elsewhere I'd love for Linksys to prove me wrong :)

And I'm pretty sure IOS supports IPv6, but then again Cisco isn't known for their strong consumer market.

Re:My IPv6 Rant

[pediddle]

Who cares about NAT if the router could tunnel IPv6? I'd gladly pay for that (assuming by that time there are other IPv6 networks worth talking to). What they would kill in NAT sales they'd more than gain in tunnel sales... except they'd be the same product anyway.

Re:My IPv6 Rant

[paskie]

That's called "firewall". NAT acts as a bad firewall, but you can run a firewall even without a NAT. And it makes sense to replace NAT with a simple firewall because you can then choose to firewall only some of the nodes, you do not have problem with overloading the NAT with too many TCP connections, it is easier to allow P2P stuff through a firewall than through a NAT. And you lose no security.

Re:My IPv6 Rant

[Anonymous Coward]

why does linksys care weather they sell routers pre-configured to do NAT or routers preconfigured to push out a range ipv6 address for a dhcp scope and tunnel those addys over ipv4. Its not a hard thing to implement and probably has no additional hardware requirements. I bet they could use all their existing models with new firmware. No need to make that availble though just change the packaging and sell people a new router. Linksys should love this oppertunity.

Re:My IPv6 Rant

[GeorgeH]

It would spur IPv6 adoption, which in turn would make NAT useless once ISPs started providing enough IPs for everyone, instead of their current 1 IP per customer (and sometimes less thanks to DHCP) allotment.

Of course, since public companies are focused on short term sales they might see the IPv6 tunnel sales increase as worth cannibalizing IPv4 NAT router sales.

Re:My IPv6 Rant

[Anonymous Coward]

From the article: IPv6 doesn't have backwards compatibility built in, so people on IPv6 networks can't talk to the IPv4 Internet.

This is factually incorrect. Research "IPv4-compatible IPv6 addresses" and especially "IPv4-mapped IPv6 addresses". Two chunks of the IPv6 address space, both the size of the IPv4 address space, are reserved for pseudo-IPs which map to IPv4 addresses. The end result is that an IPv6 host can connect to an IPv4 host without even knowing that it's an IPv4 host. The reverse is also true: if an IPv6 host also has an IPv4 allocated, then an IPv4 host can connect to the IPv6 host without the IPv6 host needing an IPv4 stack.

This exists as part of the IPv6 standard.

Re:My IPv6 Rant

[sploxx]

That's easy. DIY. Just take one of the linux ports to the Linksys (wireless )router series and add the IPv6 module in!

Re:My IPv6 Rant

[Hard_Code]

I'm with George on this one. While you potentially COULD spend MASSIVE man hours inventing rube-goldberg schemes to do all sorts of reverse proxying, I think security-through-brokenness is not a wise direction. Once the internet is fixed, THEN proper security can be again placed on it (there is nothing preventing people from running firewalls on IPv6 after all).

If my car doors are stuck, I don't recline in comfort and muse on how "secure" my car is. I get it fixed and then install a security system.

Re:Running out of IPv6 (not)

[dmeranda]

IPv6 uses 128-bit addresses. For those who can't count that high, let's see, thats:

340,282,366,920,938,463,463,374,607,431,768,211, 45 6

in decimal. Just try to use all those up! Well, as long as you don't let the spammers onboard first.

New Standard

[Comatosis]

At least it's finally a standard and is becoming more and more user friendly. There are still alot of problems right now though, and those being a user has a hard time configuring a tunnel on his own if hes new. But overall, the new addressing space is a big plus.

Re:Running out of IPv6 (not)

[rdspider]

doubting human potential for misuse is the number one mistake.. just wait until each segment of your dna has its own ip address..

the protection of NAT

[rdspider]

of course, if we all have ip addresses and are directly on the internet, dont we loose the nat protection for all our windows os ! i depend on my linksys to save me from the internet!!

Re:the protection of NAT

[pHDNgell]

of course, if we all have ip addresses and are directly on the internet, dont we loose the nat protection for all our windows os ! i depend on my linksys to save me from the internet!!

It just amazes me that so many people think that NAT provides some kind of protection. Your firewall provides protection. An egress-only firewall filter provides the same ``protection'' that people think they get from NAT, but makes it far easier to get all of your P2P type services working when you have more than one computer.

Quick review:

NAT (PAT) just causes communication problems, many of which seem convenient from a security point of view. Its benefit is that it provides an easy way to work around not having enough IP addresses.

Your firewall keeps stuff you don't want to pass into or out of your network in or out of your network.

Re:the protection of NAT

[leerpm]

You could achieve the same level of protection with a box that did ipv6 routing, and had a built-in firewall to block incoming connections (or at least just those connections with destination port 1024).

Re:the protection of NAT

[sploxx]

Ahh the common misconception about NAT.
NAT is not meant as a security tool. It is there to extend your address space (virtually). You probably knew that already.
One of the _side-effects_ of NAT (often unwanted) is that no connections from outside to your computers are possible.

But you don't need NAT to do that. A decent firewall (i.e. one you could build/buy which uses BSD/linux netfilter) should be able to do that as well.

Use the right tool for the job. A firewall. Put an end to the ugly fragmentation of the internet.

Re:the protection of NAT

[evilviper]

An egress-only firewall filter provides the same ``protection'' that people think they get from NAT,

And let's be clear that it's rather easy to get around the 'protection' of a NAT router. If you aren't using a stateful firewall, you have no security, only a small bit of obsecurity that would just barely slow down an attacker.

Re:the protection of NAT

[evilviper]

One of the _side-effects_ of NAT (often unwanted) is that no connections from outside to your computers are possible.

On the contrary. NAT provides no security at all. It is really quite easy to address hosts behind a NAT box, it just isn't as trivial as pinging the public address... You need to take another step or two. It doesn't even slow down those with an ounce of networking knowledge.

If you want even the slightest security, you NEED to be using a stateful firewall/packet filter.

Still the anonymity problem

[redelm]

With 128 bit addresses, even DHCP will contain personal identifiers (MAC?).

The current IPv4 net has de-facto weak anonymity via DHCP, proxying, etc. It is effectively anonymous unless police authorities get very interested and are willing to wade through logs. And these logs get quickly lost/deleted.

IPv6 is the end of the 'net as we know it. Whether it will be an improvement is hard to say. I'm sure it will have a chilling effect. This might be good at stopping some undesireable activities (spam, etc. if enforced) but will also inhibit free speech, particularly in less-free countries.

Re:Still the anonymity problem

[Junta]

Huh? That didn't make much sense.

I assume you mean DHCP-Assigned IP addresses, which well, works significantly different in IPv6. Well, for now, I acknowledge that yes, the dynamic addressing scheme by *default* uses the system mac address in a very deterministic fashion to get an IPv6 address. However, IPv6 'privacy extension' does not, and thus your IP to MAC relationship to hosts not on your network becomes as undeterminable in IPv6 as it is in IPv4. Even if the outside world did have your MAC address, they have no way of knowing *where* that MAC address is. It is still a meaningless identifier until they actual get your machine physically, at which point they've already gone well beyond the point of getting into ISP logs, or have access to the current DHCP leases and physical network segment, which isn't too much more trouble than ISP logs. Hell, you can even set your own MAC address dynamically if you want your tin foil hat to be more fully engaged.

Proxying will persist, it is more about performance and conservation of bandwidth than, say, NAT, which almost certainly goes by the wayside in IPv6 by and large. However, few ISPs have resorted to NATing customers wholesale anyway, so that isn't the case today. I have not seen an implementation, but NAT could certainly be used in IPv6 if you *really* wanted, but it still traces to the nearest routable address, which, as in IPv4 networks, is typically still you.

Ultimately, relying on the 'anonymity' of dynamic IP addresses is really ridiculous if you are really doing something requiring anonymity. IPv6 is in no way the "end of the 'net as we know it".

Re:Still the anonymity problem

[freality]

Geographical anonymity what? See:

http://www.digitalenvoy.net/solutions/netacuity. sh tml

This isn't your lat-long, but it's not anonymity either.

--

* Proven Accuracy

NetAcuity is the only technology to be independently verified as the most accurate IP intelligence technology on the market today, with accuracy rates well over 99% at a country level and 94% at a city-level worldwide

* Unsurpassed Coverage

NetAcuity provides coverage for 99.999% of the Internet and collects over one million Internet-points-of-view daily from different vantage points on the Internet, making it the most comprehensive technology available

Re:The bottom line

[Lord Bitman]

yeah, linksys sure would hate for that to happen to its router sales. No company would want to sell four personal firewalls to every home instead of one whole router.
Try again.

Uhh...

[piecewise]

Great re-hash of the article and summary. Well done I say, well done!

I'm waiting for IPV7:

[Anonymous Coward]

Attack of the Root Servers.

HL2/DoomIII

[wowbagger]

Yes, but do HalfLife 2 and DoomIII support IPv6?

Until these two critical applications support it, I ain't agonna go!

RFID here we come.

[Prince Vegeta SSJ4]

How the pieces of toilet paper get access to the Internet would remain to be seen

Easy, RFID chips implanted in every sheet. Then when you visit the store

• Greetings Mr. Cornholio, your last sheet of toilet paper indicated that you ate too much cheese and not enough fiber, visit aisle 9 we are having a sale on Ex-Lax.

Do you Really Wish?

[Mad Bad Rabbit]

No doubt in 20 years, each roll of toilet paper will
already have a pre-assigned IP address at the factory,
and a little microchip inside the cardboard core, so
it can track itself through the supply chain and the
grocery store and your bathroom cabinets; so that when
it finally sees it's been installed on the holder, it
can start displaying targetted ads on the digital-ink
layer of the exposed outer sheets.

Oh...My....GOD

[imthatguy]

I'll be in my forties then! aaaaaaaaaahhhhhhhhhhhh! pre"id-life crisis" crisis!!
on the other hand at least by then my websites will load correctly....and maybe I'll have enough bandwidth to handle all the ad-crap

where are the IPv6 native ISPs?

[dgp]

I live in Portland Oregon and every once in a while I survey the local DSL ISPs about IPv6. The answer has been consistenly "We have no plans to deploy IPv6." and "No customers have been asking for it."

Can someone point out ISPs that offer native IPv6 service to home users?

Re:where are the IPv6 native ISPs?

[jbb999]

The ISP I use, Andrews & Arnold do. Although they are in the UK so probably no use to you.

Re:where are the IPv6 native ISPs?

[addaon]

Do dorms count as homes? /perpetual student //with ipv6

Re:where are the IPv6 native ISPs?

[schmiddy]

It's the classic chicken-and-egg problem. ISPs know that it will take quite a bit of up-front cash to convert their routers to IPv6. I don't even know to what extent v6 backbone routers exist, but I'd bet their pricey.

Right now.. really the only people that can use v6 are the BSD/Linux folks, as well as (I think) OSX. That's like 5% of the entire Internet desktop users, according to Google's Zeitgeist.

It's a scary thought.. but really, I think critical-mass v6 adoption rests solely on the shoulders of Microsoft at this point. We had better pray that Longhorn comes with it enabled (and that's like 2-3 years from now, at the earliest). If that happens though, it's a sure bet that Linksys et al. as well as lots of ISPs will be on board. I think we'll be waiting a while yet myself, though.

Re:where are the IPv6 native ISPs?

[Anonymous Coward]

Chello does this (in Europe, that is), native ipv6 over the cable (no tunnels involved).

Re:where are the IPv6 native ISPs?

[ckaminski]

Convert? Geez, any of these ISP geniuses who have been paying attention would know that every version of Cisco IOS since 10.0 (at least) has had IPv6 support. There's no need to pay to upgrade to anything.

All of the Tier-1 ISPs definitely have IPv6 capable hardware.

Re:where are the IPv6 native ISPs?

[IvyKing]

Speakeasy has been making noises about rolling out IPv6 support and apparently have done experimenting with it. Right now it still looks to be in the "near future".

A possible compromise would be for the ISP's to offer IPv6 tunneling hosts.

Re:where are the IPv6 native ISPs?

[dgp]

i believe the win XP implementation of IPv6 is complete and stable. I agree that Microsoft is a big piece of getting IPv6 adopted.

Re:where are the IPv6 native ISPs?

[Anonymous Coward]

Not for dgp, but perhaps some of the Dutch users might be interested. XS4ALL offers IPv6 for ADSL connections since october 2002. http://www.xs4all.nl/nieuws/overzicht/IPv6.html (in dutch)

Re:where are the IPv6 native ISPs?

[Anonymous Coward]

I had IPv6 with dialup through Level3 a few years ago.

Re:where are the IPv6 native ISPs?

[dmiller]

Ditto Melbourne, Australia - No ISP I have asked has plans to offer even experimental native access to consumers. Most didn't even understand the question. Fortunately there are some nearby migration brokers, but they all use the awful TSP client - no public static 6over4 or IPsec tunnel brokers :(

Re:where are the IPv6 native ISPs?

[anticypher]

Move to Europe.

The AMSix is a major IPv6 peering point, where many of their clients offer IPv6 to customers.

Nerim is a major provider in France. They offer IPv6 natively to all their home users, just enable it on your router/firewall.

The UK has any number of IPv6 capable ISPs (blech, puke), you just have to keep an eye on their internal support groups for help from those who have managed to make it work. Tunnels are always a way around broken providers, but are not an answer to your question.

There are a number of other transit and peering providers all over Europe who provide IPv6, and the ISPs are all starting to follow along. Demand only started when a handful of providers realised their was a large enough market for extra added services, even though very few customers made it an important item. The problem with IPv6 is that there is no WOW! factor, it just works as well as IPv4, transparently, and currently doesn't bring any new features to the internet that users can see.

Completely off topic...
I had a great time at CeBit this year, talking to the chinese ADSL modem makers. After asking if thier boxes supported IPv6, I then told them I needed 20,000 boxes right away for a small scale test, but only with a product with IPv6 enabled right out of the box, no upgrades allowed. Once I started talking about the 20-40 million unit market over the next year, you could see their eyes light up. But if they offered an upgrade within a few weeks (in other words, they'd have their coders pull some all-nighters), I'd walk off to find another with IPv6 already built in. I have a feeling that next year there will be dozens of small ADSL routers with IPv6 capability. Once we can get cheap ADSL routers with IPv6 as a checklist item, ISPs will start offering it.

In the U.S., the term for your situation is TSOL.

the AC

Re:where are the IPv6 native ISPs?

[msi]

Windows XP and 2003 Server support IP v6. I cant find a direct link to this information but here is a link to a fix for Gigabit v6 jumboframes http://support.microsoft.com/default.aspx?scid=kb; en-us;328892 All right its MS and its a problem but the support is there. So while I agree with your inital comment about chickens and eggs your added MS bashing is off base.

Totaly unrelated but does anyone else have problems posting whilst running Kerio personal firewall?

It is out of date already in China due to IPv9

[Anonymous Coward]

China is already testing IPv9, something which promises to consume IPv6.

Link to article - China's New Generation Of IPv9 Network Technology Ready

;)

Re:It is out of date already in China due to IPv9

[Anonymous Coward]

shhh...

Re:It is out of date already in China due to IPv9

[Anonymous Coward]

Nope. Mostly a semi-hoax

http://www.theregister.co.uk/2004/07/06/ipv9_hyp e_ dismissed/

How is it implemened?

[Florian Weimer]

I wonder how this has been implemented. I can't find an AAAA record for f.root-servers.net (the server operated by ISC).

Re:How is it implemened?

[dotwaffle]

You know what would make the uptake of IPV6 relly huge? If they set aside an entire TLD, say .6, and marketed it as the future. I mean, look how many companies bought .tv and... ok, just .tv. I think .6 could really kick off...

Re:How is it implemened?

[leerpm]

How about a .six TLD, and make it mandatory for hosts to have native Ipv6 connectivity. And then purposely screw up the spelling, so that it's named .sex!

If you ever wanted to see the modern day version of a gold rush, you would have a pretty good chance with the launch of a .sex TLD.

Re:How is it implemened?

[TheSpunkyEnigma]

This took 2 seconds.
nslookup
>set q=any
>f.root-servers.org

f.root-servers.org nameserver = ns-int.isc.org.
f.root-servers.org nameserver = slave.sth.netnod.se.
f.root-servers.org nameserver = ns-ext.isc.org.
f.root-servers.org nameserver = ns-ext.vix.com.
ns-ext.vix.com internet address = 204.152.184.64
ns-ext.vix.com has AAAA address 2001:4f8:0:2::13

Re:How is it implemened?

[Anonymous Coward]

You might want to try f.root-servers.net
f.root-server.org isn't one of the root DNS servers, it is a webserver telling you about one of the root servers.

Re:How is it implemened?

[dotwaffle]

They said that about .xxx (I've never seen a .xxx domain...)

But also, think, you can't have .six - it's not international enough. You can have .com/net/org because in French, Communications is... Communications! Yes, it's those bleedin' Frenchmen again! Seriously, a .6 would be a good idea!

Re:How is it implemened?

[Just Some Guy]

s/org/net/ and using dig, there are still no AAAA records for that server:

$ dig -t aaaa f.root-servers.net

; <<>> DiG 9.2.4rc5 <<>> -t aaaa f.root-servers.net
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50833
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;f.root-servers.net. IN AAAA

;; AUTHORITY SECTION:
root-servers.net. 10532 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2004012900 14400 7200 1209600 3600000

;; Query time: 2 msec
;; SERVER: 192.168.0.71#53(192.168.0.71)
;; WHEN: Tue Jul 20 13:49:05 2004
;; MSG SIZE rcvd: 96

Re:How is it implemened?

[Captain_Jackass]

Check here: http://www.root-servers.org/

Currently B, F, H, and M-roots have IPv6 addresses.

Re:How is it implemened?

[pe1chl]

Ok so what is the French word for 6 ?

Re:How is it implemened?

[Florian Weimer]

You are listing the name servers for the f.root-servers.org zone. These name servers aren't root name servers.

Re:How is it implemened?

[dotwaffle]

ok, technically, yeah, French 6 is six, but in German it's Sechs. In Latin it's sex. And worst of all, in Hillbillie, it's two lots of three.

Re:How is it implemened?

[Florian Weimer]

Currently B, F, H, and M-roots have IPv6 addresses.

I still don't see them over here. Maybe you have to query them over IPv6 (how boring), or it depends on the anycast server you are being routed too.

Re:The bottom line

[GeorgeH]

I think you over-estimate the general public's interest in security. I know a bunch of people who never go to Windows Update and never update the anti-virus software that come with their computer.

The reason they buy NAT routers isn't for the security they bring, that's a happy side effect. The reason they buy NAT routers is because they have 2 computers they want to get on one cable modem and the guy at Best Buy said they needed one. They won't even be asking the question once IPv6 rolls out, except for wireless base stations.

I think getting these people to turn on the software firewall in Windows or OS X would be a challenge, convincing them to spend $50 - $100 on a piece of hardware that does more or less the same thing would be a losing proposition.

Of course, I would love to be proven wrong by Linksys :)

Hello Navi.

[Negative9]

One step closer to v7 ^_^

I, for one, welcome our new IPv6 overlords

[pilsen]

I, for one, welcome our new IPv6 overlords.

ping6 slashdot.org

[caluml]

When will Slashdot get an IPv6 address. Everything supports it - DNS, Apache, etc, nd all they need is to either get an IPv6 tunnel from a broker (the cheap option), or get their ISP to let them have it natively.

Re:ping6 slashdot.org

[tbaggy]

Ya I want this too..
As a side note, you can get to Slashdot (and google, and CNN etc) via sixxs.net with IPv6 by going here:
http://www.slashdot.org.sixxs.org

Re:ping6 slashdot.org

[FrostedWheat]

They'll start using IPv6 about the same time they start using PNG.

No Joke

[kippy]

Anyone remember this from a few months back? And it's been how long since TCP has been out?

20 years might not be enough.

Re:No Joke

[gmack]

That's another variation of old design flaw in ipv4 so they can patch around it for another 50 years and still not fully fix it. The best they can hope for is to make it harder to exploit.

It's one of the problems that IPv6 was designed to fix from the start.

Abbreviated number of the beast

[BigGar']

ipv6 or ipv666

Take the following:
Rev 13:16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads:
Rev 13:17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.
Rev 13:18 Here is wisdom. Let him that hath understanding count the number of the beast: for it is the number of a man; and his number is Six hundred threescore and six.

With no ipv6 number you will not be able to buy or sell and it's long so you'll have to write it down somewhere where you'll always have it, say on the back of your hand. ipv6 is simply ipv666 shortended up a bit to hit the true meaning.

There you have it, conclusive proof.
We are in the end of day's.

repent, Repent, REPENT!!!!

Re:Abbreviated number of the beast

[rleibman]

Seriously, the 6bone (the current first pass at an IPv6 network, mostly consisting of tunnels through IPv4) is slated for decommissioning on June 6th, 2006 (6/6/6)... coincidence?

Re:Abbreviated number of the beast

[balbeir]

But I haven't pented yet !

Re:Abbreviated number of the beast

[DMUTPeregrine]

Sorry, wrong religion. Only people who believe in all your junk need to repent. Anyone else is home free. (and since repenting often just means converting to the "true" faith, that means no one needs to repent)

Hmph! Whippersnappers!

[operagost]

What do you young'uns need with all those IP addresses? In my day, we only had eight, and they were big and bulky. We didn't have any fancy network address translation, you had to put your 80 pound IP address in your wheelbarrow and roll it across town so Joe Billy Bob Joe Bob could use it! And ol' Joe Bob sure would give you a sound whuppin' if you was late with his IP address!

Re:Hmph! Whippersnappers!

[Anonymous Coward]

Yeah, in the good ol day, we have to haul our IP up the hill (both ways) with stack of 8" floppies in our backpack through the cold rainy snow.

No good IPv6 firewalls..

[meff]

Speaking of IPv6, where are (if there are any) good firewall setups for it?

I've tried ip6wall, but its kinda shoddy and their homepage is even down right now. I use FireHOL for my IPv4 stuff, but I can't seem to find a nice IPv6 firewall suite.

Remember, NEVER leave your system wide open, and always use a firewall, unless you're sure of the consequences.

Re:No good IPv6 firewalls..

[rleibman]

I believe IPTables fully support IPv6.

Re:No good IPv6 firewalls..

[Just Some Guy]

ipfw and ipf on FreeBSD systems both have excellent IPv6 support. OpenBSD's pf, which is a Theo-ized BSD-licensed version of ipf, should also be solid choice.

Re:No good IPv6 firewalls..

[evilviper]

OpenBSD's pf, which is a Theo-ized BSD-licensed version of ipf, should also be solid choice.

Not sure what you mean by "Theo-ized". It was written by Daniel Hartmeier after all, not Theo.

Also, pf is such a "solid choice" that NetBSD and FreeBSD have made own ports of it! Yes, it's a very good packet filter, and far faster than ipf ever was.

Re:No good IPv6 firewalls..

[Just Some Guy]

Not sure what you mean by "Theo-ized". It was written by Daniel Hartmeier after all, not Theo.

I kind of see OpenBSD and Theo as synonymous. :)

Also, pf is such a "solid choice" that NetBSD and FreeBSD have made own ports of it! Yes, it's a very good packet filter, and far faster than ipf ever was.

I get the impression that you're reading something into my words that I didn't intend. I've heard nothing but good things about pf but have not personally used it, so I can't give it a direct recommendation. I know that it's available as a FreeBSD port (and take your word about its availability on NetBSD), but I can't vouch that it's as well-integrated as ipf or ipfw in FreeBSD, or performs as well as on OpenBSD. I'm not saying that it's not as good, only that I have no first-hand experience with it.

Might not be a bad thing.

[Gordonjcp]

After all, registration numbers ended the concept of motor car anonymity, and most people would agree that the advantages far outweigh the disadvantages.

Re:Might not be a bad thing.

[Anonymous Coward]

After all, registration numbers ended the concept of motor car anonymity, and most people would agree that the advantages far outweigh the disadvantages.

Then again there are very little marketing departments and advertisement agencies in bed with organized crime and working hard to install cameras at every ten meters of highway to track lincense plates to provide customized advertising at every five meters... Also the amount of people who want to steal your car so they can pretend to be you tends to be lower then the amount of online identity thiefs. (ever since people can hire limo`s...) Stolen cars get noticed faster then "stolen" ips as well..

Static ip numbers don`t provide any authentication (ask everyone who used to run those r-services). They are nice for tracking peoples browsing though. If you want to stop anonymity online you will want digital signatures, strong ones. When signed though a web of trust these have the added bonus of offering "pseudonimity" for those worried about their tinfoil hat, job or life. Once people start signing mails spammers will need to either spam fast before their signature end up on a blacklist, or have the computing power to create identities for almost every single mail.

Re:Might not be a bad thing.

[DeepHurtn!]

Ideally, at least, I would like to think that Internet anonymity is more comparable to that we enjoy while voting.

Re:Might not be a bad thing.

[owlstead]

That is not really the case in Europe. Sure you could read the license plate, but you still can't get to the personal data unless you are in the law enforcement business. I understood that in several US states this information is public. In the Netherlands just the land-owners are publicly listed as far as I know.

IP is international, so you will have to thread very carefully by saying that (little) privacy is lost. Processor ID's were not accepted by the general public either.

Re:Might not be a bad thing.

[the grace of R'hllor]

I can't stuff a potato up your tailpipe from here in the Netherlands, knowing your car's registration number. Doing the equivalent online would be pretty much trivial.

It's a difficult thing. On the one hand, I deeply value this casual anonomity (where it is not quite trivial to get at me, though not impossible). On the other hand, many people are boneheaded dipsticks who should be taken out and clubbed to death with baby seals. Getting at these people might be worth it.

Re:Might not be a bad thing.

[glitch23]

Only law enforcement and gov't officials can track your car using its registration number. As for IP addresses, there are publicly available tools that anyone could use to start mapping out the Internet into a lot more detail that it is now especially if anyone ever breaks into the database that houses this information and sees any pattern as to how they assign IP addresses to geographic regions.

Re:Might not be a bad thing.

[Gordonjcp]

Well, I can get full details of all the previous owners of any car I have for a very small fee. It's pretty standard to check back on all previous owners when you buy a second-hand car in the UK.

How about if you had a group of "registered" and a group of "anonymous" IPv6 addresses? That way you could decide not to let all the spam and viruses come in from the "anonymous" ones, and if you got hassle from someone with a "registered" IPv6 address you could clobber them quite hard...

Re:Might not be a bad thing.

[Anonymous Coward]

egistration numbers ended the concept of motor car anonymity, and most people would agree that the advantages far outweigh the disadvantages

I don't know about you, but I don't buy used PC's that often.

Besides, knowing that the IP of the box I just bought from a Chinese ebay customer is banned in 95% of the known world for SPAM doesn't help if I can just get another number on reboot.

Re:Might not be a bad thing.

[Anonymous Coward]

You can get personal information from the license plate in the Netherlands. It will cost you something like 10 euros though.

Re:Might not be a bad thing.

[evilviper]

registration numbers ended the concept of motor car anonymity

But the difference is that it's not an easy number to find.

There aren't huge databases, with interfaces in every shopping mall parking lot, that are gathering your car's registration number, and correlating it to your shopping habits, the other sites you visit, etc.

I'd be perfectly happy with a unique identifier etched inot my computer, but I don't want it being tatooed on my forehead, as IPs essentially are.

Re:Might not be a bad thing.

[mewphobia]

I'm sorry but no.

Motor car registrations don't limit your freedom of speech. That's just stupid.

Internet registrations quite well could.

The internet is a means of communication. The motor vehicle is not.

Tunnel where?

[Dr. Evil]

Where will the thousands of home routers tunnel to?

Re:Tunnel where?

[Wesley Felter]

To each other, of course. 6to4 sets up the tunnels automatically.

Slightly OT: Reserved IP adresses in IPv6

[mcsmurf]

Someone knows what ip adresses in IPv6 are reserved for private use? In IPv4, it's 10.0.0.0 -10.255.255.255, 172.16.0.0 - 172.31.255.255, 192.168.0.0 - 192.168.255.255. Are these the same just translated in IPv6 or have these IP adress ranges been extended (would be logical, since there are more adresses available)? Or are there just no private ip adresses anymore, i don't hope so *g*?

Re:Slightly OT: Reserved IP adresses in IPv6

[Anonymous Coward]

Private addresses are indicated by the address having 1111 1110 1 for the first nine bits. Thus, private addresses have a first octet value of FE in hexadecimal, with the next hex digit being from 8 to F. And it gets even more complex.

Re:Slightly OT: Reserved IP adresses in IPv6

[Dahan]

FEC0::/10 is supposed to be for site-local addresses, but there's talk of deprecating it.

Re:Slightly OT: Reserved IP adresses in IPv6

[rleibman]

IPv6 works in a very different way from IPv4, there is no need for private use networks. Each device on a network gets not one, but a few addresses, you have your loopback (::1), but you also have your link local (FE80::/32 an address that's unique in your network but doesn't get routed outside of it) and you can use this for many of the same things you use private addresses in IPv4. Oh, yeah, you also get a multicast address (FF02:/32 that other nodes and the router can use to find your MAC address). That's on top of a bunch of other addresses you may be listening to depending on what you are on the network (dhcp, router, etc)

Re:Slightly OT: Reserved IP adresses in IPv6

[leerpm]

There is an address range prefix reserved for private use. I don't have the information in front of me, but I believe the prefix used is fe80:.

But the whole point of IPv6 is that you don't need to use private addresses. You can use real ones so that all your devices are accessible from anywhere (and use firewalls to block those that you want to limit access to).

Re:Slightly OT: Reserved IP adresses in IPv6

[mcsmurf]

Yes, i think if all Windows boxen would be available from public, this would be very worse. So yes, a firewall is definitely needed then :).

Re:Slightly OT: Reserved IP adresses in IPv6

[tbaggy]

FEC0::/10 is used (currently) as an equivalent to 10.x.x.x/8, 172.16.x.x/16 and 192.168.x.x/24.

Unfortunately, its in the process of being deprecated. So don't expect it to last long.

Re:Slightly OT: Reserved IP adresses in IPv6

[rleibman]

Kinda, FEC0::/10 is defined as site local (where a site is an administrator defined boundary. You can still use FE80::/10 to refer to link local (which is defined as 0 router hops from me), FEC0::/10 is indeed deprecated, you can still use FE80::/10, actually it is prefered for many uses instead of global addresses because it is likely to be more stable (most of the time it is made up of the Interface Identifier, i.e. the MAC address in ethernet).

Man, this IPv6 course I took last week is making me tons of karma :)

Re:Slightly OT: Reserved IP adresses in IPv6

[Nurgled]

What about if I have two private networks and I want to route between them? What IPv6 range should I use for the addresses that both networks can see?

Re:Slightly OT: Reserved IP adresses in IPv6

[tbaggy]

FEC0::/10 for now.

Re:Slightly OT: Reserved IP adresses in IPv6

[Anonymous Coward]

You're thinking in old IPv4 ways. Private addresses are no substitute for firewalls and other security measures. There are plenty public addresses in IPv6, use them.

Re:Slightly OT: Reserved IP adresses in IPv6

[Nurgled]

Not all networks are on the Internet.

Sure, I know if they're not on the Internet then technically they can use any IP range and probably don't need the overhead of IPv6, but it's nice to play by the rules so you don't get headaches if the network ever does somehow get an Internet connection.

Even with everyone connected to the Internet, there's never going to be just one network. We're always going to have to deal with weird situations where there's some kind of bridge between an odd special network and the Internet, whether due to logistical or simply administrative reasons.

Re:Slightly OT: Reserved IP adresses in IPv6

[j h woodyatt]

The IETF is in the process of deprecating the IPv6 site-local addresses, which are the moral equivalent of the IPv4 "private" addresses defined in RFC 1918. See the working group charter and the latest draft for more details.

You're thinking of the link-local prefix, which is fe80::/16. These are not the same, and are morally equivalent to the 169.254/16 IPv4 prefix used in zeroconf addressing.

--

Re:Slightly OT: Reserved IP adresses in IPv6

[Anonymous Coward]

If the network ever does get an internet connection you'll have to renumber anyway. Don't you dare thinking about about NAT with IPv6.

Where private IPv4 addresses are used, IPv6 will have public addresses. If you bridge between an odd special network (whatever that is) and the Internet, you use public addresses. There are enough of them and since there is a connection between the two networks, you'll have to use them to avoid collisions. No goddamn NAT, thankyouverymuch.

Re:Slightly OT: Reserved IP adresses in IPv6

[Nurgled]

Hosts can have more than one address. My private LAN here currently has link-local IPv6 addresses because I'm not in a situation where it is feasible to be on the IPv6 Internet. If, in the future, I do have the need and the ability to use public IPv6 I will assign second global-scope addresses to each host and keep the local addresses.

Now take this situation and place it in my original scenario where there are two physical networks and a router between them, currently using some kind of private address range. Later they get "real" Internet access, so rather than renumbering all of my hosts I simply give them two addresses so that the private addresses go on working and each host also has public addresses. No NAT, just a different internal idea of addresses.

Of course, if there's no private address range available this isn't an option, and so I would have to renumber. That would be annoying. This is why I'm curious as to why the private address range in IPv6 is being deprecated.

Re:Slightly OT: Reserved IP adresses in IPv6

[rleibman]

Just use global addresses. I guess you could use site-local (or the even more obscure administratively defined local), it's a mindset kind of thing, you still can have all the firewalls you want while keeping your addressing space global. In IPv6 privacy is not about having your own address space.

Re:Slightly OT: Reserved IP adresses in IPv6

[Nurgled]

Using global addresses when you aren't on the global network seems like a mistake to me.

Retaining the local addresses when joining the Internet makes for much easier migration than a flat-out complete renumbering. My concern is flexibility and convenience, not security.

Re:Slightly OT: Reserved IP adresses in IPv6

[rleibman]

Your host will indeed keep its local addresses, in IPv6 (as in IPv4, though it's not as common there) you can have many addresses attached to a particular interface. But that local address does not get routed between networks, so you can't use those outside your network (I guess you could configure your routers otherwise, but it's not a wise thing to do).
There are so many global addresses available that it doesn't matter, and using them is what you ARE supposed to do (by the specs). Renumbering is almost a non-issue in IPv6 since most hosts get autoconfigured by the unmanaged protocol (or by DHCPv6, which is much enhanced).
Believe me, it all works out. Local addresses for local use, global addresses when going outside of your link (network).

Microsoft agrees with you

[Wesley Felter]

Microsoft wrote a similar rant; hopefully the equipment vendors will get with the program.

Re:Microsoft agrees with you

[leerpm]

Yeah, it would be nice though if they took the incentive to introduce this in their own products first. They do make consumer level routers / home gateways themselves..

Freenet6 is obsolete

[Wesley Felter]

6to4 is simpler and more efficient.

Not a problem

[Wesley Felter]

This was solved years ago: Privacy Extensions for Stateless Address Autoconfiguration in IPv6.

Re:Running out of IPv6 (not)

[rleibman]

Well, you do have to discount all of the reserved ranges, among them 2001::/32, ::/128, F::/120, etc.

nooo nooo noooooooo!

[mabu]

IPv6 needs to stay in the can until we can figure out a way to solve the spam problem. Right now, RBLs are the most effective method of stopping spam. If IPv6 rolls out, spammers will have exponentially more address space from which to operate and the ensuing spam problem will make what we have now look trivial.

A prerequisite for the rollout of IPv6 must be law enforcement getting off their asses and demonstrating that spammers will get busted for their illegal activities. Otherwise it will take 20+ years to ID and block IPv6 rogue IP space.

Re:nooo nooo noooooooo!

[Wesley Felter]

Blocking a /48 under IPv6 is no harder than blocking a /24 under IPv4.

Re:nooo nooo noooooooo!

[mabu]

You have to find and ID the block first, and that means starting all over documenting the source of rogue relays. Not something any of us would be looking forward to.

When will IPv6 run out of numbers?

[Anonymous Coward]

I'll tell you when IPv6 will be in trouble of running out of addresses. When every lame post on slashdot has an IP address.

you could'a had a v8!

[Anonymous Coward]

aw come on guys! IPV6 has been *DEAD* since the day it was created!

y'know you coulda had a v8! IPV8 that is...

so lets get with the problem and stop using useless junk like ipv6, and start using something that works, seemlessly, like ipv8.

yep, could'a had a v8! www.ipv8.org (obligatory link!)

heh

Re: IANA has no lack of IPv4 addresses

[Anonymous Coward]

Its not the lack of addresses, IANA still has 2/3rds of IPv4 addresses reserved.

See here

I'm told the reason is problems routing those addresses, i.e. that to assign them would increase the size of the routing tables on the backbone routers with the associated slow-down of processing.

I don't get why we can't just use the AS system to handle this though, the routers don't all need to know the entire routing table, just a CIDR route for a bunch of associated classes.

Addresses are chosen with routing in mind

[juancn]

You may have more addresses, but addresses are chosen based on how efficient you can route packets to those addresses (more local information, less global knowledge about routes).

IPv6 (as IPv4) is also designed with the idea that addresses are somewhat related to physical location, you cannot choose arbitrary addresses, there isn't an easy way to provide the IP equivalent of "number portability" among providers.

Spam is a side-effect of the origins of the internet, when it was a network of peers, where everyone was the same (universities, mostly).

Trust was the primary asset, and email was designed without concerns about anonymity nor security (in the beggining, they all knew each other)

Now the network has become global, millions of people use it everyday, and we lost the trust, we have firewalls, spam checkers, complex authentication mechanisms, etc.

We have to find a way to re-establish the trust (maybe through better protocolos and infrastructure), but until then, all sorts of abuse will continue to be commonplace.

Re:Addresses are chosen with routing in mind

[perlchild]

We can never rebuild the trust. The original trust was built on a select clientele, a sort of private club, if you will. Now the internet is a commodity, and for a lot of people, a facet of the right to expression. You will build protocols that handle mistrust better, and that will work, but you will not be able to go back to trusting everyone.

Re:Addresses are chosen with routing in mind

[juancn]

I completely agree with you. I just couldn't find the right words to express it at the time I made the post (since I'm not a native english speaker, sometimes words elude me ;).

and once Mr. V. Cerf passes away ...

[porky_pig_jr]

they would quietly pull out IPv6 as well. Seems like he's the only major IPv6 proponent at this point.

come on mods

[Anonymous Coward]

have a sense of humor, that was pretty funny

Re:come on mods

[Anonymous Coward]

No, there really wasn't anything funny about it at all.

2^128 is a big, big number.

[ecalkin]

I've heard it expressed as 100,000,000 (one hundred million) addresses per square *meter* of land area.
My favorate expression is ip addressing for carpet fibers.

eric

Re:2^128 is a big, big number.

[fikx]

Yeah, but what happens when you stack carpets? Hmmm? THEN what do you do? Ha!
Actually, with high rises/urban development, we might be able to push the boundry even with IPv6 eventually. Not to mention wanting every device talking and making more and smaller devices (like RFID 'n stuff). Not to mention all the people living on Mars, the moon, space stations, etc. They all need IP numbers! It'll take a while, but I think we can still use 'em all up. It's human nature :) Register sub-nets now before they run out!

IPv6 for a small WISP, yes/no?

[rawg]

I have a small ISP and I'm thinking about switching to IPv6.

I'm running FreeBSD servers, Linux access points, D-Link bridges (CPE), and most of my customers are using MS Windows 98/XP. I assign IP's via DHCP. I'm using NoCatAuth for logins. I'm thinking about installing IPSec, PPTP, and PPPoE at some point.

How much work is it to switch to IPv6? Will all my hardware support it? Will it work on WiFi? Any problems with NoCat? Any problems with MS Windows?

Re:IPv6 for a small WISP, yes/no?

[rleibman]

What do you mean by switchincg to IPv6? you'll still need to provide some sort of IPv4 connectivity because your users will ask for it. XP is pretty much IPv6 ready, but you'll have to make some investment in equipment and training, it isn't as simple as it sounds.
IPSec is part of IPv6 anything that supports IPv6 MUST support IPSec. You don't need DHCP for most cases (though you can still use it for "managed" situations) IPv6 pretty much takes care of autoconfiguration.
The world of IPv6 will be much simpler than that of IPv4, but getting there will be a total pain in the neck.

good netizens who want to be anonymous

[oliverthered]

Perhaps we will get to the point where the want to be anonymous is no longer required.

Only if implemented

[redelm]

Yes, PE can work! But the real question is whether they will be implemented, or whether various authorities will pressure ISPs to not implement, citing such bogeymen as "national security", spam and kiddie-porn.

Re:Only if implemented

[Wesley Felter]

Privacy extensions are implemented in hosts, not in ISPs. If you want it, you implement it.

Re:Only if implemented

[redelm]

Sure, you can implement it and twiddle some bits, but it won't be successful if your ISP can't route packets back to you!

It will depend on whether the ISP's router is sufficiently stateful (and lax about MAC) and/or willing to do broadcasts.

This is were a few quiet conversations between security authorities and the larger router manufacturers (Cisco) can have large impacts. "Our routing/auth tables key off MAC for speed and efficiency. We don't do broadcasts to avoid congestion and security concerns." Plausible deniability.

Re:Only if implemented

[Wesley Felter]

No. If a router implements neighbor discovery correctly, then privacy extensions will work. If the router doesn't implement ND, then it is really broken.

typo

[gunpowder]

Let's assume you have the IPv4 class-A network 45.x.x.x. Its netmask is therefore 255.255.255.0.

I meant 255.0.0.0 of course ...

Max

MAC is published via nonymous communications

[redelm]

MACs become very public because everyone has a combination of public & private personnae.

You might send email to your professor, employer or other potential adversary. They then scan USENET or SlashDot for your MAC substring. Searches run both ways.

Resetting MAC might not help if your ISP adds a UID string or grants access by MAC.

bugs

[aminorex]

> I like how they said that it will run along side
> IPv4 for 20 years to get rid of the bugs

Those bugs being the bugs in IPv4. One would hope
to be rid of IPv4 sooner than that, but some

coffee makers might last that long, especially
the (ahem) homebrew models.

just in time

[smatt-man]

20 years to get rid of the bugs.

It should be working by time Duke Nukem Forever Online is released.

NAT's would still be needed with IPv6...

[mark-t]

Just not for the same reason.

Specifically, we'd be looking at giving every electronic device in an entire household its own IP address... no problem there, but there is the simple fact that by and large there is no compelling need to access a vast majority of those systems from outside your own home.

The solution? Use private IP addresses for many of the appliances within your home and put them behind a NAT that holes can be punched in as required for access from the outside, should such access be needed.

Doing this simultaneously ensures that NAT sales don't have to suffer as a result of IPv6 implementation and also prevents the rapid polution of global IPv6 address space. It's win-win for everybody.

toilets will have IPs too

[Anonymous Coward]

im more scared of the Denial of Poo attack

IPv6 address per-connection?

[jncook]

I remember reading somewhere a proposal that IPv6 had a sufficiently large address space that you could allocate yourself an address to use just during the duration of a single connection, then throw it away when you were done. Depending on how this is done, it could add some anonymity to the connection process. Does anyone have a link to this information?

On the other hand, some of the docs I've read say the IPv6 address is based on your MAC. Doesn't that limit actual address space to the number of available MAC addresses (2^48?), rather than 2^128?

Re:IPv6 address per-connection?

[j h woodyatt]

Does anyone have a link to this information?

Look at the latest draft of RFC 2462. Nodes are allowed to use a EUI-64 address for the host number, but the recommendation for stateless autoconfiguration is to generate a unique number and test for duplicates with neighbor solicitation. You don't have to use a MAC address with stateless autoconfiguration, and furthermore you don't have to use stateless autoconfiguration if you use a DHCP server on your IPv6 network.

On the other hand, some of the docs I've read say the IPv6 address is based on your MAC.

You haven't read the docs in a long time...

--

Wrong wrong wrong, brimming with wrongability!

[mark-t]

Private IP addresses will always be useful, simply as a natural consequence of the principle of locality.

There is no pressing need to give every single appliance in your house its own global IPv6 address... simply use private ones, and put them behind a NAT that holes can be punched into to access them from outside, where required. Since you are the person that configures the NAT, you can control exactly what devices can be controlled from outside and how.

Re:Wrong wrong wrong, brimming with wrongability!

[Anonymous Coward]

There is no pressing need to give every single appliance in your house its own global IPv6 address... simply use private ones, and put them behind a NAT

No, that is stupid. With IPv6 you know you get a range of adresses. You group those into 2: internet or local. You can (sub)group them many times because you have will have lots of IPs. (for example: this group is allowed local WiFi, this group is behind the garage hub).

Then you get an IPv6 provider who gives you the internet access and assigns the front part of your IP (see your lan setup is portable across providers)

Now your internet router only routes to the ranges you allowed internet access on your router. And you can easily turn groups off if you want.
--
Dennis SCP

No, no, no

[Wesley Felter]

The solution to this problem is to give every device a real, global IPv6 address and use a firewall to block traffic to devices that shouldn't talk to the outside world.

Re:No, no, no

[mark-t]

Why bother? Just us a NAT. Same end result, with the added bonus that you don't pollute global address space with garbage that nobody else is interested in.

Re:No, no, no

[Anonymous Coward]

NAT is a horrible hack. If you can't think of some (mostly negative) side effects of NAT besides blocking incoming connections, then you haven't looked close enough. NAT is also not secure when an attacker is in the same broadcast domain as the NAT device. NAT (masquerading to be precise) WILL die with IPv6.

Re:No, no, no

[AK Marc]

Just us a NAT. Same end result,

You are using NAT for security. It is not secure. It has absolutely no security on it. NAT is security through complexity. It is no better than leaving your keys in your Saab because no thief would look at the floorboard for the ignition switch.

If you want security, get a firewall. A NAT box is not a firewall. Oh, and IPv6 is designed to let people "pollute" the IP space. There will be enough IP addresses for everyone to have billions of addresses. Why does it matter if they use 1 of those billion or 100 of those billion?

Re:No, no, no

[mark-t]

First of all, 2^128 is a big number, but it is still finite, and should be respected as such. If we are as careless with IPv6 addresses as many people suggest, we will be out of them before the end of the 21st century. It is much more prudent to allocate them as if they were a limited resource in the first place... at least then IPv6 might stand a chance of lasting long enough until we start to colonize other planets.

I realize relying solely on a NAT for security can be dangerous... someone on the outside can get in through the same holes you might leave for yourself. But in at least one sense a NAT is more secure than a firewall because if a firewall were to fail, and packets get through unfiltered, then potentially unauthorized people could be poking around in your systems, whereas with a NAT, if the NAT fails, then since the IP addresses on the inside were private anyways, they would simply fail to resolve to anything outside. Your network would remain secure. The downside to the NAT, of course, is that if it fails, you lose access to those systems that were behind the NAT. A NAT may not be a silver bullet for security but it still offers all the security that _MOST PEOPLE_ would ever need (Note, "Most People" aren't interested in stuff like slashdot).

Anyways, I am not suggesting that all home computers should be behind NAT's (although it may be possible by using IPv6 extension headers creatively, to do routing even across and through multiple NAT's... but I digress). I am merely saying that there is no practical reason why a single person would actually need a billion IP addresses. Your toaster, clock, dishwasher, and every other appliance in your house each might have its own IP too, but there's no reason why they can't just be private IP's... and if you need to access them from outside your home for some reason (which is entirely possible and potentially useful) you can put them behind a NAT that you configure.

This also has the upshot of IPv6 not necessarily spelling the end of NAT, which may influence companies that build NAT devices (and may have had a motivation in postponing the adoption of IPv6 as long as possible) to be more willing to make their hardware IPv6 ready, as the need for their devices doesn't really diminish, but rather simply shifts focus.

Re:No, no, no

[Anonymous Coward]

NAT is also why the Internet doesn't work properly anymore. Suppose you actually wanted to connect to a machine behind your NAT, or even worse someone else's NAT. Without configuring the NAT to translate IP addresses, you can't. The whole point of the Internet is that it's a universal communications network without stupid bridges that have to translate for other networks. Fix security problems, don't break networks.

What happens when you want to configure your toaster to talk to someone elses toaster across the road? What if they have two toasters? If they use NAT, you have lost the ability to easily and uniformly access both devices. The same situation exists now if you want to run multiple servers of the same type behind NAT. You can't, without running some on non-standard ports, which also happens to Break The Internet(tm). A device on a communication network needs two things: An address, and a type. The address is so information can travel to that device. The type specifies how to communicate with it. If either (or both, heaven forbid) are mangled in any way, communication becomes more difficult and less universal

Please, for the love of the Internet, do not continue to segment it into little, incompatible pieces. That's what we had before the Internet was widespread; and while AOL and CompuServe loved it, not everyone else did.

Re:No, no, no

[Anonymous Coward]

NAT is a security risk, first and foremost because of its complexity. It is barely understood even by people with a casual interest in networking technology, much less by ordinary home users. Just read the comments under this topic and count the people, including you, who advocate NAT as a sort of firewall, which it clearly is not, not even in the sense which you attempt to make us believe. Every perceived (but not real) security enhancement which is a result of NAT can be obtained more securely and with a much less work by using a firewall (and that includes the safe failure mode). Homework: Configure a Linux system with two ethernet cards for masquerading. Connect one system to the external port and one (with a private IP address) to the internal port. Find out if you can connect from the external machine to the internal machine. Hint: "No" is the wrong answer. Interesting fact: Many NAT appliances are Linux based.

There is at least one practical reason for assigning billions of IP addresses to a single person: autoconfiguration of a globally unique address without the help of a server.

IPv6 ends NAT, period. No sane person who understands the crude hack that is IP masquerading will attempt to do something similar for IPv6. Do you have any idea how much extra work needs to be done to make NAT compatible with FTP/H.323/SIP? I bet the people who wrote the IPv6 address assignment guidelines wanted to make absolutely certain that no customer ever runs out of addresses for his devices, so there will never be an incentive to resort to NAT again.

Companies which build IPv4 NAT appliances today will simply build IPv6 firewall routers tomorrow. It's how the standard is designed and it's the only way it makes sense.

Oh, and 2^128 is an insanely huge number of addresses. Even if every user got a /48 (2^80 addresses for each and every one of us), there could still be 2^48 users: about 40000 times the current population of this planet. We'd have to colonize some big rocks and do a lot of reproduicing to run out of addresses. And then we could still use NAT, couldn't we?

Re:No, no, no

[mark-t]

May I ask why you feel compelled to have an FTP server running on your toaster or refrigerator?

There are many types of devices for which there is little to no practical reason to have as "global" systems, and if connections to them are really required from outside, then NAT can be used. Meanwhile, we can stick to private IP's for devices like your microwave oven or your alarm clock.

By no means do I suggest that actual servers be running behind NAT's... only devices that nobody else would normally have any business accessing. When computers are truly ubiquitous, the average home could easily have several hundred million computers within it, but not all of them have any need to have their own unique global IP.

Re:No, no, no

[NuclearDog]

Maybe he doesn't have a server on his toaster, but maybe on his air conditioner. So he's sitting at work and decides, "You know what. I'm going to turn the air conditioner on so it is nice and cool when I get come.". Well, if that air conditioner is behind some sort of NAT device, he can't.

ND

Re:No, no, no

[Anonymous Coward]

*sigh* Go ahead and do it. You'll be the only one, but if it makes you happy, just do it. Some people need to make all mistakes by themselves before they learn. If you're one of them, start making them. The sooner the better.

FTP is a troublesome protocol for NAT because in active mode (which is the normal mode and some servers refuse passive FTP clients for security reasons), each client is also a server, and also because it embeds ip and port addresses in the data stream. So, if your refrigerator updates its firmware via FTP, it will have trouble with your household NAT device, because you never intended it to receive connections from the outside. I'll grant you that FTP is a broken protocol and that the fridge would probably update via HTTP, but there are other similarly broken protocols and you never know where they're used.

Here's what I don't understand: You could simply assign public addresses and replace the NAT with a conceptually and technically simpler firewall with *higher* security and less configuration problems. You have all the addresses you need. Honestly. If you run out, they'll give you some more. Why do you insist on making your life miserable with NAT?

BTW, did you do your homework?

Re:No, no, no

[AK Marc]

May I ask why you feel compelled to have an FTP server running on your toaster or refrigerator?

So I can remotely upgrade the firmware. Why, if addressing is available and proper security is in place, would you want to restrict things from Internet access that had a need for Internet access?

NAT is crap. There have been multiple protocols rewritten in order to account for the broken nature of NAT. Ever try to use a video conference over NAT? If you did it 5 years ago, it probably didn't work. The packet gets stamped with a "from" address, and the TCP handshake passes off a "from" address based on the hardware configuration. If they don't match (read as: you are using NAT), then it didn't work. Of course, they ended up rewriting the protocol to change this behavior.

NAT was never designed for security. It should never be used for such. It was implimented for one reason only, to reduce the rate of IP depletion. With abundant IPs and the lack of security in NAT, there is absolutely no reason to use it. And no, I don't accept "because it doesn't need a global IP" as a reason to create and use a protocol when global IPs allow every person on the planet to have billions of billions of addresses.

Re:No, no, no

[mark-t]

Actually, if the AC is behind a NAT that he configured, he could configure the NAT to port forward for a particular range of ports to access the AC remotely... if there was no need for remote access at all, then a NAT wouldn't be needed in the first place.

Re:No, no, no

[mark-t]

Right... so _YOU_ can remotely upgrade the firmware... not anyone else.

So you put it behind a NAT with port forwarding in place. Since you configured the NAT in the first place, you know the way through it.

Now again, I am not saying that everything should be behind NAT's... but by the time we have ubiquitous computing, and there could be vast numbers of individual computers running even the tiniest aspects of our households, and computers would be effectively everywhere... there is absolutely _NO_ practical need to have every single computer having its own globally addressable IP. Security is only a part of it... it's wasteful, at the very least.

Think about it for a minute here... 2^128 addresses is *NOT* infinite, and if we go around handing out billion global IP addresses to absolutely everyone (and multiple orders of magnitude more to large organizations), we _will_ run out of them, with well over 80% of them actually being entirely unused. We are practically out of IPv4 space already, yet there are many millions of them are completely unused, even though they already belong to some organization or another. The reason for the premature shortage is because of the way IPv4 addresses were allocated - organizations were handed out _MUCH_ larger blocks of IP addresses than they truly needed, and so many of the IP's go unused. With the larger address space of IPv6, the problem could be exponentially worse. By being dilligent with IP allocation from the beginning, we could make the address space last us over a hundred thousand or even a _million_ times longer than we would otherwise. If we do not learn from mistakes we made in the past, we are only condemning ourselves to repeat them.

Re:No, no, no

[NuclearDog]

The point is, though, why put it behind the NAT at all if you can just connect it directly to the internet (well, through a firewall)?

ND

Re:No, no, no

[AK Marc]

Right... so _YOU_ can remotely upgrade the firmware... not anyone else.

Maybe the manufacturer, with my permission.

So you put it behind a NAT with port forwarding in place. Since you configured the NAT in the first place, you know the way through it.

That is stupid. It is not secure (a port sniffer will find it). It saves one IP from a scheme where everyone has billions of billions of addresses to use. There is absolutely no reason whatsoever to waste time an effort obfuscating a system designed to let every device on the planet have billions of IP addresses.

Yes, you could. You could also have a perfectly healthy bladder, yet cathater yourself every time you went to the bathroom. But then, why would you go out of your way to make your life more complicated and painful? I don't know, but apparently you do.

Think about it for a minute here... 2^128 addresses is *NOT* infinite, and if we go around handing out billion global IP addresses to absolutely everyone (and multiple orders of magnitude more to large organizations), we _will_ run out of them, with well over 80% of them actually being entirely unused.

Nope. Not even close. If we hand out a billion to everyone that asks for a single address (and make them show that they have used at least 100,000,000 to use their next billion), how many times could we hand out an IPv6 block of a billion before the address space was 1% exhausted?

Come on, the math isn't that hard. I'll give you a hint. It's more than 30,000,000,000,000,000,000,000,000. Now, how many organizations will be able to demonstate a need for more than 100,000,000 addresses? Maybe a few hundred who need a couple trillion? Fine. We still have a few left.

For all concievable near futures, 2^128 addresses *is* unlimited. Not because the number is infinite, as it isn't. But the number of devices that can be conceived of that use IPs can't approach the number of addresses.

Re:No, no, no

[mark-t]

That is stupid. It is not secure (a port sniffer will find it).

Not if you use port knocking.

My primary reason for suggesting this wasn't security anyways, it was in the interests of conservation. As I said before, did we learn absolutely nothing when we were wastefully allocating IPv4 space? There are literally millions of IPv4 addresses that are not used by anyone, yet they are allocated to a specific company and can't be handed out to someone else without subnetting (and thereby having to further make a deal with the organization to which they were orginally assigned rather than simply with a central authority).

Now I concede that you are right about one thing... it will be a very long time before we actually do exhaust IPv6 space, but my point is that it _CAN_ be exhausted, and to treat it wastefully just because we won't run out in _OUR_ lifetimes is to be highly inconsiderate of the generations to come... Just because we expect them to be so much more advanced than we are doesn't mean that we should just blindly thrust any problems we have in their direction.

Re:No, no, no

[mark-t]

Ultimately you are advocating making the same mistake that was originally made with IPv4. We wouldn't be facing the IPv4 shortage that we are now if more reasonable allocation systems were used originally. While we certainly would have eventually run out of IPv4 addresses anyways, the fact that we have come to that point as soon as we have is categorical proof of the implications of that mistake. Why repeat it?

In less than 40 years we essentially exhausted a 32 bit address space. Given that the internet has exhibited exponential growth and shows no signs of diminishing, with the same careless allocation, in less than 200 years, we will have run out of IPv6 addresses.

Just because a problem won't happen in our lifetime isn't a particularly good excuse to ignore it.

Re:No, no, no

[AK Marc]

Not if you use port knocking.

You, dear sir, are a moron. You are taking a series of non-secure steps to complicate a connection to the point where you hope others can't connect to it. Why not buy a firewall and protect it with something designed to provide security? Because you will take the most convoluted and difficult path in order to not have to admit that there is a better way to do it than you first conceived. You are myopic and hard headed. You demonstrate a lack of logic in finding the proper way to secure a network in the best manner. Instead, you pick something that is extremely complicated *and* less secure than the proper implimentation of a firewall.

my point is that it _CAN_ be exhausted

No one disagreed with that point. However, assigning a single address to a person or a number of addresses equal to the number of IP enabled devices in their home will, in the grand scheme of things, make *no* difference in the time that IPv6 takes to run out of IP addresses. NAT is now and has always been a poor hack done solely because IP addresses weren't designed with a global scale in mind and are running out. With that one problem fixed, continuing to use the problematic hack is stupid. NAT isn't secure. IPv6 has no shortage (now or in the forseeable future) of addresses. As such, there is *no* reason for NAT to exist, let alone be in common use.

It wasn't just the lack of addresses that lead to the downfall of IPv4. It lasted only one generation. Do you really think that IPv6 will last 10 times as long as IPv4? It would take at least that long with the worst possible IP management in order to come anywhere near exhausting IPv6 space.

Re:No, no, no

[mark-t]

You, dear sir, are a moron.

And namecalling proves your point how?

Most people don't give 2 shits about security anyways, so the primary advantage of NATs isn't security. As a side effect of using NAT, it accomplishes all the security that most people need or want.

The main advantage is in the interests of conservation. As you said... IPv6 will eventually be exhausted, and by my calculations, if the internet grows exponentially as it did before IPv4 address space started becoming a concern, we will be facing the same problem sometime before the end of the 22nd century. That it won't happen in your lifetime or mine is no more of an excuse to ignore it than that they ignored the Y2K issue back in the 60's.

I concede the distinct possibility that my concerns are premature, but using the past as a guideline, inertia tends to keep certain technologies and systems from changing until necessity actually forces them to (it can be reasoned that the only reason Internet growth actually started to slow down recently was simply _because_ of the limited IP space).

Finally, I would only propose the use of NAT to the extent that otherwise private devices might require access from the outside. Rather than a few million or few billion IP's per person, I'd rather see that scaled down to a few hundred for a private individual, and they can use private and local IP's for anything more than that.

Re:No, no, no

[Anonymous Coward]

You're being silly. Let's assume that each and every end user gets a /48, from single computer home users to megacorporations with millions of computers. Nobody would need more than a /48 (yeah, famous last words, but you do the math and tell me with a straight face that you need more than 2^80 addresses).

Now where does that leave us? 2^48 assignments. Let's assume 0.8% prefix efficiency, that means we lose another 7 bits. 2^41 real, usable assignments, roughly 2200 trillion or more than 300 times the current population of this planet. So after you've given every human being 2^80 addresses, you've exhausted just 0.3% of the usable address space, prefix inefficiencies included.

At every point in this calculation I have grossly overestimated the wastefulness of the assigning authority, and we still come out with a ridiculous reserve of addresses. You really don't need to have a bad conscience over assigning a public IPv6 address to your toaster.

Re:No, no, no

[AK Marc]

You, dear sir, are a moron.

And namecalling proves your point how?

The name calling didn't do it. The long explanation of *why* you are a moron that followed the name calling did it.

if the internet grows exponentially as it did before IPv4 address space started becoming a concern, we will be facing the same problem sometime before the end of the 22nd century. That it won't happen in your lifetime or mine is no more of an excuse to ignore it than that they ignored the Y2K issue back in the 60's.

And I will assert that IPv6 will not be in widespread use at the end of the 22nd century, regardless of the use of the addresses.

I'd rather see that scaled down to a few hundred for a private individual, and they can use private and local IP's for anything more than that.

Yes. A few hundred per person would be easy to manage, and wouldn't risk stripping the IPv6 space too quickly. It will also let everyone put their toaster on the Internet with a public IP address, as was mentioned early on in this thread. I remember that you were complaining when people implied that it would be OK to have a small pile of addresses to put all their appliances on the Internet (I don't know about you, but I certainly have less than 100 electronic devices in my home). So I really don't see a problem with every toaster having its own public IP address.

(it can be reasoned that the only reason Internet growth actually started to slow down recently was simply _because_ of the limited IP space)

Sure, and it can be reasoned that it was alien intervention as well, but that doesn't make it any more true. Let's see, the economy grows, Internet growth increases. The economy sucks, Internet growth decreases. Yes, it must be because of those damn IP addresses.

Geographical Allocation

[mindhaze]

I'm sure it's far too late for this now, but what would it take for IPv6 addresses to be assigned geographically? Then, by extension, it'd be amazing if we could just reference an IP Address by the bits that are different. IE: if we're geographically close to the piece of equipment we want to reach, we would only have to reference the last few segments.

That would rock, for sure!

Must not be at a Kansas University

[wrong_fuel]

The network that Kansas Universities connect to for service (KanREN Inc.) fully implemented v6 months back. Native IPv6 services are provided to each University and throughout the statewide backbone, although I admit I don't know how the Universities handle it once you cross the border router and look at the campus network. This move by ICANN will make it easier for us to implement DNS for the v6 space.

who?

[zogger]

"Who would manage it and who would police it? "

The who part for managing it is whomever the various governments order and/or authorize to do it. The who part for "policing" is in the quote, the "police". Netcops in some fashion already exist, it will be just a furtherance of those efforts in different directions, all towards government=more control, you as joe surfer=less control. Just the way it's gonna shake out.

All governments are dictatorial/despotic to varying degrees(gasp, indignant protests, oh no MY government XYZ isn't...), and the trend is for this to continue, and for there to be transnational cooperation. All governments have a vested interest in command/control/surveillence of their serfs and subjects, so this will eventually happen.

We are still in a semi wild wild west version of the net, but it isn't going to last very long and you can see it daily. P2P will be the next major stifling efforts, you can smell that coming.

It will be heavily regulated in the semi near future, because all governments want it, and most of big business wants it, and it's incresingly clear there is less and less distinction between big buisnes and big government, so it's gonna happen.

well, I'll ask the lame question....

[zogger]

..not shy about it neither. OK, so we have this new addressing system. How does joe casual computer user go about using this new system then? Is it automagical, or what? Does it depend on your ISP and all the websites out there that are IPv4 now, or what? what do we have to do now, what's the next step?

I admit, I do not "get it" on this other than there's potentially enough addresses out there for most things now..

Wouldn't necessarily kill router sales

[MemRaven]

You're assuming that the devices that LinkSys, et. al., are primarily seen as "routers" over the longer term. Even today, that isn't strictly true for a lot of them: they include printer servers, firewalls, wireless gateways, etc. I think you're going to start to see a much more generous definition of what those things are.

Linksys is already on this to some extent, since they (and NetGear and others) also sell other, similar products, which do things like add network storage to the home network (in the form of a hard drive with a really simple embedded file server), and stand-alone print servers. What you're probably looking at is a situation where Linksys isn't in the business of selling "routers" per se, but where they're in the business of selling "consumer networking appliances," where those do other things than just a simple NAT router.

For example, to expand on your idea, imagine an appliance (which would look suspiciously like what you're suggesting Linksys do) which would allow users to connect to their home machines, no matter where they are in the world, and would block other people. A lot of people would be seriously interested in that, and it's not a very far stretch from what you're suggesting; just an IPv6 connection for the home machines and a firewall with some form of authentication, with something like DynDNS to do the IPv6 lookup.

Then start thinking of things that you can do with a world-wide lookupable machine (the extension of the previous idea). Why not allow your DVR access from the rest of the world? Why not sell a box which will just stream TV so that you can watch whatever's on at home? What about nanny-cams? Once you sell people on the concept that you can safely have something on your home network accessible from the rest of the world, Joe Consumer will start to buy a lot more of those things, many of which are made by the same people whose router sales would be limited.

I find it ironic...

[T3kno]

That there is an IPv6 Article right after a Doom 3 article. All we need now is a Duke Nukem article and the trifecta will be complete.

A6 is dead

[Anonymous Coward]

A6 is dead. For many good reasons.

IPv6 is here: is that "again" or "still" ?

[cardpuncher]

Can't quite recall which! Roll on 1990.

New technology

[owlstead]

They have added "new technology"? What about? Storing IPv6 in DNS records? I thought that was already available. Not from ICANN mind you. We'll put it down to scrappy journalism. The reporter probably would not know an IP address if he stepped on it. Um.

When is /. going to get IPv6 and xhtml/css2? I wonder.

Re:New technology

[Anonymous Coward]

/. using CSS2 might be a little tough since most users here use netscape/mozilla-based-browsers and neither supports CSS2 properly. Let's not attack IE here for leaving out a couple implementations, but the way netscape/mozilla leave out bunch of things blatantly and instead add their new gimmicky tags/properties, I am surprised that the protocol/specs loving community hasn't dumped the two products.

Sure it's great to have a product that allegedly "doesn't crash" but what good is it when you can't depend on it to implement a standard as specified?

OK OK the truth is that I am a little ticked because I was trying to use some CSS2 in netscape and it just simply wouldn't render it properly.

I am admittedly ignorant about the following but I am suspecting that the netscape developers just come in in the morning and download the latest mozilla code and just run with it. Both have the exact same CSS2 problems. And who knows what else?

Commence the slash backlash....

IPv6 Problems

[man_ls]

I can't even make two IPv6 hosts with statically configured addresses talk to each other on my home network...and I'm by no means a new person to networking.

I've got an IPv6 tunnel and a /48 from freenet6.net running to a Windows 2003 server. But that's where it ends..........I have no connectivity other than an address.

The 2K3 box won't route IPv6 for the rest of my network...it can't even find a route to the host whose last digit is only one digit higher, on the same subnet.

I'm not a happy camper.

Unfortunately, your provider is being stingy

[anti-NAT]

The recommendation, for all users of IPv6, including home users, is a /48. Fortunately, they've given you enough address space to get around their stingyness. You'd be stuck if they'd given you a /128.

RFC 3177 - IAB/IESG Recommendations on IPv6 Address Allocations to Sites

Re:Unfortunately, your provider is being stingy

[Just Some Guy]

Actually, my provider doesn't offer IPv6. I'm using a tunnel to Hurricane Electric. I did some research when I moved off of Freenet6 and they had the best service offering at that time (and I imagine that they still do).

Identified/Verified IPs = Stupid

[korthof]

If Mac or IP was bound to a card and required identity it would be easier then spoofing addresses.

I could see it now, racks with tons of NICs and the spammers randomly registering the MAC or IP with EEPROM.

Would make anonimity more prevelant, and in direct hands on control no?

*carrys boxes of nics home from the swapmeet*

Re:The bottom line

[Lord Bitman]

my real point is that getting them to turn on windows' built-in NAT routing is enough of a challenge (especially noteable now that wireless is so popular- no need for extra cards), they already go out and buy seperate NAT routers. I find it extraordinarily odd that Linksys and the like havent been buying up millions in ads telling people that they need to install firewalls NOW after the more recent nasties. With enough initial advertising, the fear would never go away.

No loss of anonymity

[Anonymous Coward]

All we'll do is start up another network.

Has anybody here actually read anything about IPv6

[fetta]

There is more ignorant speculation on this IPv6 discussion thread than I've seen in a long time. It seems like everybody is just saying "well, if the IPv6 addresses are 128 bits, then that would mean . . . " Stop speculating and start reading up on the subject.

IPv6 addresses some real specific needs beyond just giving us more addresses:

• Simplified routing tables through Route Sggregation
• Integrated IPSec and QoS
• Finding mobile devices
• 
  An nobody here seems to even be talking about how the addressing scheme actually works (the 3 address types (Local Link, Site Local, and Aggregatable Global addresses) for example), how MAC addresses are actually used, or how the option for anonymous addressing (which isn't perfect, but does exist) can partially address some of the privacy concerns.
  
  Come on, folks - let google be your friend!

Re:Has anybody here actually read anything about I

[fetta]

"Simplified routing tables through Route Sggregation"

oops! I meant "Route Aggregation" - apologies, I seem to have a caffeine deficiency in my diet this morning.

Neighbor Discovery vs Theft-of-Service

[redelm]

Sure, an open peered ethernet will work just fine.

But what of the residential-service routers (especially cable) that have to worry about Theft-of-Service?

Re:Neighbor Discovery vs Theft-of-Service

[Wesley Felter]

IPv4 cable modem networks still use ARP, and IPv6 cable modem networks will use ND. The authentication is (and should be) done at a lower level.

Re:Neighbor Discovery vs Theft-of-Service

[redelm]

I thought ARP was dependant on MAC, and that some cable modems used DHCP.