An Introduction to IPv6

Playboy writes "Here is a great introduction to IPv6 in general, the technological background, the reasons for the move and the effects this will have on networks. Understandable for network novices like me but still includes many details on the technological side of things."

Comments

yet another worthless article about IPv6

[garcia]

Introduction to IPv6 #1004040... This has been brought up every six months or so for quite some time and I usually post the same shit about how it's not practical at this time period for much other than reverse DNS on IRC. But this "article" is yet another worthless explanation of the same old shit.

Take for example the following IPv6 address: 43FB:0000:0000:0000:0000:BB3F:A0A0:0000 This could be shortened to 43FB::BB3F:A0A0:0 instead. Now you might ask: "What's up with the double colon?" If you thought that, good for you. You've seen something many people would not have seen on their first try. The double colon (aka "::") signifies that we have removed a series of hexadecimal blocks from the address. These will always be contiguous zeros. AKA "0000:0000:0000:0000" can be shortened to just "::". Therefore when you see the double colon in an IPv6 address, it can be automatically assumed that they are all zeros.

Ahh yes, "simplifying IPv6 addresses". No, there is nothing simple about remembering those addresses (haven't there been studies that say 7-10 numbers in a row is about all we can remember?) So here we have 10+ numbers and letters that don't make much sense (yeah some people have gotten vanity IPv6 addresses like ABCD::BEEF::). Nothing is simplified there until you get the DNS up and running for it (not that this is hard or anything but it isn't exactly easy)

It is true that IPv6 is not human friendly; however, in the long run, it will help solve a lot of issues with the current shortage of available IPv4 addresses on the internet.

Yeah, the "shortages"... Just tell the people hoarding all the damn addresses to hand them over. Sorry but MIT, Apple, etc, as much as I respect their contributions to the human race, do not need a Class A. Allow for the redistribution of the IPs and we should be good to go for quite some time.

Be thankful people don't have unlimited IPs in their house. Most people that want to have multiple computers connected to the Internet use a NAT router and at least protect themselves SOMEWHAT from the outside threats. Can you imagine what would happen if all the Comcast retards were straight to the Net with their own IP on each computer?

ISPs make some good money (hell mine gets $5/mo more out of me for an additional IP) selling off static/dynamic IP space. You think Comcast is going to move for a switch when they make $10/mo per extra IP?

Re:yet another worthless article about IPv6

[Anonymous Coward]

The :: rule really pisses me off, making it much harder for me to remember IPv6 addresses than just a simple 32 char hex number would be. Yes, _I_ can expand my own in all cases - but that doesn't help me when reading other people's. Bit like perl - I can read my perl, but other people's styles are almost guaranteed to confuse me. (note: it might be telling that I like lisp, apl and forth in programming languages, the less syntax the better, really - people are different).

Re:yet another worthless article about IPv6

[stratjakt]

Studies show that monkeys can be trained to remember 10 numbers.

You're not dumber than a monkey are you? /simpsons

Re:yet another worthless article about IPv6

[smclean]

I think you are being just a liiitle overly pessemistic here.

Who cares if its card to remember an IPv6 address? Do you really memorize multiple IPs from multiple subnets that often? I can personally only think of 2 subnets I have memorized right now, and I work as a system admin full time.

As for the shortages, you think that it's a good idea to have scarcity in the IP market just so people will be encouraged to run NAT? I think its presumptious of you to force conditions on me, personally I'd love to have IPs for each machine in my house, but I can't because IP addresses are hard to come by.

And your last point, yes, ISPs are scumbags, but it seems that the fact that they price gouge for IPs would make you for IPv6, not against it.

Re:yet another worthless article about IPv6

[garcia]

As for the shortages, you think that it's a good idea to have scarcity in the IP market just so people will be encouraged to run NAT? I think its presumptious of you to force conditions on me, personally I'd love to have IPs for each machine in my house, but I can't because IP addresses are hard to come by.

Sysadmins and regular Slashdot readers are in the minority. Personally I'd rather have the Comcast weenies behind a single firewall... Then I wouldn't have to block entire /16's to stop their worms from hammering me.

Re:yet another worthless article about IPv6

[tuffy]

Be thankful people don't have unlimited IPs in their house. Most people that want to have multiple computers connected to the Internet use a NAT router and at least protect themselves SOMEWHAT from the outside threats. Can you imagine what would happen if all the Comcast retards were straight to the Net with their own IP on each computer?

People are going to buy some sort of all-in-one switch to connect their home computers to the internet as well as to each other, and that device will undoubtedly have a built-in firewall. That'll help secure the consumer-built home networks while unfucking the internet by removing NAT and its port-forwarding hacks.

Re:yet another worthless article about IPv6

[Enigma_Man]

As a Comcast customer, I resemble that remark! :) Anyway, there aren't any other options in this area for something reasonably cost effective, for the bandwidth that I get. There's a large wireless network in the nearby area, but they won't deal with individuals, and barely offer better than 56k dialup speeds.

As someone who wishes they weren't supporting Comcast, and is reasonably technically-oriented, what alternatives could anybody suggest?

-Jesse

Re:yet another worthless article about IPv6

[smclean]

That's fine, but they shouldn't be forced into that position because of a actual limit of IP addresses, they should be forced into that position because that's how Comcast sets them up, and they don't know how to change it.

Again, if Comcast customers are required to run NAT in order to have multiple machines online, and if I am a Comcast customer, then I am requried to run NAT due to other peoples' ignorance, and I don't like that.

Re:yet another worthless article about IPv6

[attam]

Sorry but MIT, Apple, etc, as much as I respect their contributions to the human race, do not need a Class A. Allow for the redistribution of the IPs and we should be good to go for quite some time
last time i checked, there were only 4 class A's left (stanford was the fifth, but they gave theirs up a few years ago i believe)... so thats ~70mil addresses to give back. i dont believe that would makes us "good to go for quite some time"

Re:yet another worthless article about IPv6

[Have Blue]

Be thankful people don't have unlimited IPs in their house. Most people that want to have multiple computers connected to the Internet use a NAT router and at least protect themselves SOMEWHAT from the outside threats. Can you imagine what would happen if all the Comcast retards were straight to the Net with their own IP on each computer?

Not all that much different from today, for 2 reasons:

• 0wned PCs getting abused tend to max out the connections they are attached to. Once that happens, it doesn't matter if the traffic is coming from 1 PC or a hundred- only 1 upstreams' worth of bad packets are getting onto the net.
• I would wager that the vast majority of people who tend to get 0wned have only 1 computer. Any house with 2, 3, or more probably has at least one person in it who knows about security.

ISPs make some good money (hell mine gets $5/mo more out of me for an additional IP) selling off static/dynamic IP space. You think Comcast is going to move for a switch when they make $10/mo per extra IP?

If anything, they would take this chance to wage a renewed campaign of "you don't really need that router, please buy multiple IPv6 addresses".

Re:yet another worthless article about IPv6

[JAgostoni]

Can you imagine what would happen if all the Comcast retards were straight to the Net with their own IP on each computer?

I thought "Comcast Retard" and "Public IP address open to the world" were synonyms.

But seriously, I would assume that the "retards" that have more than one computer did not setup the router themselves or have used one of them there Linksys dohickeys. Which means they are using NAT without even knowing it but I get your point regardless. Aside from those blank admin passwords we're safe for now.

Re:yet another worthless article about IPv6

[airConditionedGypsy]

I would wager that the vast majority of people who tend to get 0wned have only 1 computer. Any house with 2, 3, or more probably has at least one person in it who knows about security.

I'll take that wager. It would be interesting to see the distribution of security experts to households with computers. Sure, some households may have folks that know enough to go to windowsupdate every couple of weeks, but I'll bet you that qualified security professionals are quite scarce, and there certainly isn't any proof that a household with 3 or 4 computers is different than a household with 1 computer in terms of the number of persons familiar with security.

Mom's machine, Dad's workstation, Billy's gaming machine, Suzie's laptop ...

Re:yet another worthless article about IPv6

[shawn(at)fsu]

and that device will undoubtedly have a built-in firewall

And that device will undoubtedly have a defult password of admin.

Oh just think of the phone were going to have ;)

Re:yet another worthless article about IPv6

[da_fiend]

"Sorry but MIT, Apple, etc, as much as I respect their contributions to the human race, do not need a Class A. Allow for the redistribution of the IPs and we should be good to go for quite some time."

I didn't realise these guys were sitting on so many damn IPs. At least they are probably using a chunk of them. I can't imagine what El Lilly and dastardly megacorp Halliburton are doing with a class As.

I've heard of the evil bit before but not the evil network...

Re:yet another worthless article about IPv6

[falzer]

Well, how big of a monkey?

Re:yet another worthless article about IPv6

[bunnyman]

ISPs make some good money (hell mine gets $5/mo more out of me for an additional IP) selling off static/dynamic IP space. You think Comcast is going to move for a switch when they make $10/mo per extra IP?

Don't worry, they will still charge $5/mo for an additional IP, no matter what kind of IP it is. They don't charge because of the lack of addresses, it's because you're willing to pay and they're willing to take that money.

Re:yet another worthless article about IPv6

[Bishop]

Any house with 2, 3, or more probably has at least one person in it who knows about security.

I'll take that wager too.

Unfortunately I know of more then a few households with multiple computers that were no better off then houses with single computers. In some cases it was worst because they were useing WiFi without so much as wep enabled. In most cases the computer salesmen had sold them on the idea that "They didn't have to worry because of the firewall." As a result I was there to remove the spam bots and spyware.

I don't see how IPv6 will affect the zoombie computer problem one way or the other.

Re:yet another worthless article about IPv6

[pHDNgell]

Most people that want to have multiple computers connected to the Internet use a NAT router and at least protect themselves SOMEWHAT from the outside threats.

Again, NAT does not enhance security. It just doesn't. I don't understand why people think it does. The thing that enhances security is your firewall. So instead of pretending like you get security because connections aren't mapped in, you ship home routers with a rule that says no connections may be established from the ``outside'' to the ``inside.'' Done. Then when someone wants an incoming connection, they tell the firewall to allow it.

It works exactly like doing a new NAT mapping and allowing the traffic, except you don't have to do a NAT mapping and allow the traffic, you just allow it. Oh, and if you have two computers you want to do the same kind of thing, you allow it to two computers rather than trying to decide which one of your web servers gets port 80.

NAT does nothing good for the internet. It causes confusion, it breaks protocols, it prevents certain types of connectivity from being possible.

Re:yet another worthless article about IPv6

[iabervon]

IPv6 is presently useful for routing most of the traffic on the internet. The backbones are tunnelling IPv4 over IPv6 these days, because IPv6 routes better.

IPv4 addresses are mostly around 8 or 9 digits, and hard to remember. That's why people generally don't memorize them. DNS works almost exactly the same for IPv6 and IPv4.

It's trivial to get the firewalling benefits of NAT without actually doing NAT; people using NAT now will stop just translating the addresses and leave things the same as far as not passing unrequested inbound connections.

Re:yet another worthless article about IPv6

[whome]

Too bad we're not monkeys. I suppose that when this becomes generally known, monkeys will be the only ones able to get hired as sysadmins.

Re:yet another worthless article about IPv6

[Poeir]

How big of a monkey?

Re:yet another worthless article about IPv6

[ergo98]

Huh? You claim that NAT "does nothing for security", but then go on to claim that it's the same as a firewall that disallows incoming connections : No shit. That's precisely why NAT does "something" for security -- it's like a limited firewall that only allows outgoing connections, or replies to those connections.

Evangelize firewalls, but don't make up nonsensical FUD about NAT to support your argument (especially when you're refuting your own blanket statement).

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

No, there is nothing simple about remembering those addresses (haven't there been studies that say 7-10 numbers in a row is about all we can remember?)

And IPv4 addresses can be up to 12 digits long.

So here we have 10+ numbers and letters that don't make much sense

As opposed to 4-12 digits that don't make much sense?

Nothing is simplified there until you get the DNS up and running for it

Nothing is simplified for IPv4 until you get DNS up and running. And I would argue that IPv4 is more complicated if you have NAT to deal with.

(not that this is hard or anything but it isn't exactly easy)

What is hard about it, exactly, that isn't hard with IPv4? Aside from the fact that the addresses are harder to remember?

Most people that want to have multiple computers connected to the Internet use a NAT router and at least protect themselves SOMEWHAT from the outside threats

NAT does not protect anyone from outside threats. A firewall does. If you have NAT without a firewall, your network is quite insecure. If you have a firewall without NAT, your network is no less secure. NAT has nothing to do with security.

Can you imagine what would happen if all the Comcast retards were straight to the Net with their own IP on each computer?

It probably wouldn't be much different than if they were straight onto the Net under IPv4 without a firewall.

You think Comcast is going to move for a switch when they make $10/mo per extra IP?

They won't have a choice if demand goes up sufficiently.

Re:yet another worthless article about IPv6

[misleb]

Again, NAT does not enhance security. It just doesn't. I don't understand why people think it does. The thing that enhances security is your firewall. So instead of pretending like you get security because connections aren't mapped in, you ship home routers with a rule that says no connections may be established from the ``outside'' to the ``inside.'' Done.

Explain to me why a person with NAT is only "prentending" to have security and a person with a router blocking incoming connections has real security. It amounts to the same thing. Nobody can connect to your PC from the internet... hence "enahanced security." Just because you don't like NAT doesn't mean it doesn't offer some level of protection for your average user. It might not be ideal. But it works.

NAT does nothing good for the internet. It causes confusion, it breaks protocols, it prevents certain types of connectivity from being possible.

NAT makes it incredibly easy for companies who don't own their own IP block to move to differerent ISPs at will. For businesses, NAT is great. Few businesses use protocols that are broken by NAT. It alows nearly unlimited internal network growth without worrying about getting a new public subnet when you outgrow your old one. Or say you want to reroute web traffic to a different server, just change the NAT mapping. I work with MANY businesses and NAT is great. The only problem I have with NAT in a business environment is dealing with the difference between internal and external DNS. That can be a pain.

-matthew

Re:yet another worthless article about IPv6

[slamb]

Again, NAT does not enhance security. It just doesn't. I don't understand why people think it does.

(Hey, Dustin.)

Sure, you're right that it is the stateful firewall that provides the protection.

BUT: Home firewalls are so widespread only because NAT requires one. The shortage of IPs has created a situation in which it simply does not work to have more than one machine behind a connection unless there is a firewall there. If not for this, they'd just build a switch into cable modems and be done with it. And virtually all broadband-connected Windows PCs would be zombies.

Furthermore, NAT a stateful firewall. Most of the software firewall packages for Windows are not stateful. In fact, they're horribly confusing in that their dialogs for manipulating rules say "connections" when they mean "packets". You're never going to tell from the packaging or help files if a software firewall is stateful or not. With NAT, you know it is, because it wouldn't work otherwise.

I don't agree with what the original poster seemed to be saying - that it's a net benefit that we have this IP address shortage. But I do recognize that it has improved security in this way.

Re:yet another worthless article about IPv6

[jadavis]

That's another "restrict their freedom for their own good" argument.

The internet is successful because there is little central control (aside from DNS). When you start trying to solve other people's problems by mandating network policy, you end up with the "smart network, dumb terminal" philosphy of the phone network.

The internet doesn't work when Joe can't connect to Jane because they're both behind NAT. By discouraging IPv6, and therefore forcing NAT upon large parts of the internet, you drastically limit the number of possible connections that users can make.

Just because browsing and email work fine behind NAT doesn't mean NAT isn't limiting other new applications of the internet. And just because you can't think of new applications doesn't mean that the millions of people trapped behind NAT can't.

In fact, people already have, and they get stuck behind NAT all the time. Game servers, P2P apps, etc.

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

Huh? You claim that NAT "does nothing for security", but then go on to claim that it's the same as a firewall that disallows incoming connections : No shit. That's precisely why NAT does "something" for security -- it's like a limited firewall that only allows outgoing connections, or replies to those connections.

That's totally wrong. NAT does not prevent any kind of packets from moving in either direction. It just modifies packets moving in a certain direction. If you have NAT without any firewall rules to actually disallow incomign connections, your network is quite vulnerable.

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

Explain to me why a person with NAT is only "prentending" to have security and a person with a router blocking incoming connections has real security. It amounts to the same thing. Nobody can connect to your PC from the internet...

Ok, I'll explain it: The person whose router is doing only NAT is not blocking any incoming connections at all. If the connection in question is broadband, people on the same subnet can set up routes to the vunlerable party's RFC1918 address block with that person's public address as the gateway. Anyone with sufficient access to the ISP's routers can set up these routes to pass traffic into your network from anywhere in the ISP. So if you're using NAT without a firewall, your network is wide open to nearby people on the same ISP or anyone with sufficient access to the ISP's systems. For starters.

NAT makes it incredibly easy for companies who don't own their own IP block to move to differerent ISPs at will.

As do properly set up DNS and DHCP.

For businesses, NAT is great. Few businesses use protocols that are broken by NAT.

SSH? PPTP? IPSec? These protocols are all broken by NAT. Many businesses use them.

It alows nearly unlimited internal network growth without worrying about getting a new public subnet when you outgrow your old one.

As does IPv6. Or does this hypothetical business have more than 2^64 computers?

I work with MANY businesses and NAT is great. The only problem I have with NAT in a business environment is dealing with the difference between internal and external DNS. That can be a pain.

I also work with MANY businesses and NAT is a pain in the ass, especially for those with all but the simplest of needs.

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

Home firewalls are so widespread only because NAT requires one.

NAT doesn't require a firewall:

iptables -t filter -F
iptables -t nat -F
iptables -t nat -I POSTROUTING -o iface0 -j MASQUERADE

Re:yet another worthless article about IPv6

[misleb]

That's totally wrong. NAT does not prevent any kind of packets from moving in either direction. It just modifies packets moving in a certain direction. If you have NAT without any firewall rules to actually disallow incomign connections, your network is quite vulnerable.

I'm pretty sure we are actually talking about PAT (Port Address Translation) and not one-to-one IP translations. PAT is stateful by nature and disallows any inbound traffic that isn't associated with an outbound connection. Whether you like it or not, it does offer protection that would otherwise require a firewall.

I doubt anyone would suggest that if you map a public IP to your internal web server, it is protected. You might want to pay attention to context next time you proclaim that someone is "totally wrong."

-matthew

Re:yet another worthless article about IPv6

[egarland]

Oh wow do I agree! IPV6's addressing is not well thought out. It's impossible to remember an IPV6 address.

The design seems to work very hard to get rid of DHCP servers. While I understand wanting to make a network able to function without a DHCP server (good idea) they also need to have DHCP so you can avoid the horrible pain those mammoth V6 addresses cause.

Some suggestions just from the few hours I've spent using V6:

• Every machine should get an un-routable prefix of all 0's so you can address every machine as ::LocalAddress to allow for basic intra-network communication. fe80 is lame. Also, they need to get rid of the bits they insert in the MAC address to get the local address segment (02 and ff:fe.) That was just a bad idea. Why did they mix them up in the middle!?! ::MAC would be much better, but also...
• DHCP is good! It assigns network addresses that small, arbitrary, and are easy for humans to remember. Using it, you should be able to assign new local sections of IPv6 addresses that are easy to remember. Everything should still have that unroutable prefix of all 0's so machines would get unroutable addresses that look like ::2 ::3 ::4, etc. That would make me happy. Someone! Please make this happen!
• The high bits of addresses (network numbers) that are assigned by ISP's should be handed out Ipv4 addresses are handed out now, but with the lower bits all turned off until the address space is needed. That way the addresses, at least to start, could be really short. By the time we got as many network number's assigned as there are machines on the internet now we'd have network addresses that look like A9F1:B38C:: Totally reasonable. Then, as more addresses are used up, the addresses simply get longer.
• Reserve any address starting with 1: through F: as non-internet routable addresses (not to be confused with 0: which shouldn't be routable at all). I know the IPv6 architects hated the concept of non-internet routable addresses but there's a reason they are popular and it's not just that there aren't enough routable IP's. Any machine that doesn't have an internet routable IP is, by default, not on the internet. This can be a very good thing. Masquerading isn't evil either. I don't necessarily want every web site I go to to know exactly what machine I'm accessing it from right down to the MAC address. That's too much information to be giving out. I would like to have be able to use video conferencing on my machine but there are other ways of making that work than exposing my machine to the internet. By reserving all that address space you allow people to create complicated local networks including subnet schemes without having the addresses look horrible (have I mentioned that fe80 is lame?)
• Quick and dirty subnets could be done using unroutable addresses i.e. 1::0000-FFFF could be one subnet with up to 65000 machines and 2::0000-FFFF could be a second subnet with up to 65000 machines. This would obviously be quite scalable and yet still yield addresses that are very usable. These subnet addresses wouldn't be internet routable but that's what internet routable subnets are for. If further private sub netting was needed more address space bits could be used i.e. 1:1:: is one subnet 1:2:: is another 2:f:: is a third.
• To do internet routable subnets, you could do one of two things. Use the reserved local address segment (which is in the spec now and yields really ugly addresses) or get a range of addresses from your ISP and leave the local subnet address all 0's which makes the addresses nice. Companies could buy blocks of addresses in the high bits i.e. the company who has A9F1:B38C:: could buy A9F1:B38C:0001-FFFF:: if they wanted. That would allow for 65,534 subnets, all with relatively easy addresses.
  When address ranges get tight, they could end up with just A9F1:B38C:0000-00FF (256

Re:yet another worthless article about IPv6

[ergo98]

NAT does not prevent any kind of packets from moving in either direction.

Right, but NAT in a practical sense (i.e. a Linksys router - the "NAT" that 99.9% of the public is talking about) is effectively a stateful firewall - for every packet coming in from the WAN it tries to match it up with an outbound connection (or it forwards it to a specified machine if the rules are setup such), and packets which don't map it drops to the ground.

Re:yet another worthless article about IPv6

[NoMoreNicksLeft]

The size of the monkey isn't linearly proportional to the number of characters it can remember.

The proper equation for describing the curve involves avocadoes, imaginary numbers, and a pet chinchilla in Memphis named "Earl".

Re:yet another worthless article about IPv6

[misleb]

Ok, I'll explain it: The person whose router is doing only NAT is not blocking any incoming connections at all. If the connection in question is broadband, people on the same subnet can set up routes to the vunlerable party's RFC1918 address block with that person's public address as the gateway. Anyone with sufficient access to the ISP's routers can set up these routes to pass traffic into your network from anywhere in the ISP. So if you're using NAT without a firewall, your network is wide open to nearby people on the same ISP or anyone with sufficient access to the ISP's systems. For starters.

I'm not aware of any common implementations of NAT (we're actually talking about PAT) besides Cisco IOS that will route just any packet to the internal network while in NAT mode. Besides, I didn't say it was perfect security. But for most home users, it amounts to the same thing as a firewall blocking incoming traffic. Now, you can nitpick about the differences, but in the end a simple NAT router is goign to protect users from all of those nasties scanning the internet for exploitable services.. giving them time to update their systems and download virus protections.

NAT makes it incredibly easy for companies who don't own their own IP block to move to differerent ISPs at will.

As do properly set up DNS and DHCP.

Not nearly as easy as NAT. Especially when an internal WAN is involved. I'm talking about larger networks than 10 PCs and a Windows 2000 file server.

For businesses, NAT is great. Few businesses use protocols that are broken by NAT.

SSH? PPTP? IPSec? These protocols are all broken by NAT. Many businesses use them.

How in the world is SSH broken by NAT? I use it all the time through NAT. Most IPsec implementation have a NAT traversal mode. And PPTP? That is solved by NATing to a pool of public addresses. But this requires a decent firewall. And if you have such a firewall, you should really be doing the IPsec/PPTP from that anyway. Or even a VPN concentrator. I'm not talking about putting in some Linksys broadband router at the edge of corporate network, ya know.

It alows nearly unlimited internal network growth without worrying about getting a new public subnet when you outgrow your old one.

As does IPv6. Or does this hypothetical business have more than 2^64 computers?

NAT has the distinct advantage of being available now.

I also work with MANY businesses and NAT is a pain in the ass, especially for those with all but the simplest of needs.

Then I suggest that you just don't know how to take advantage of the benefits of NAT. For example, I do work for a medium sized financial institution about to change ISPs and public subnet. If they didn't do NAT, it would be a huge problem trying to coordinate a re-IP with their many remote locations, vendors, and clients. NAT is allowing them to make a seemless transition. This kind of thing happens more often than you'd think.

Until IPv6 catches on, I won't setup a client without NAT. Well, unless they have some critical application that absolutely will not work through NAT, but so far that hasn't been much of a problem.

-matthew

Re:yet another worthless article about IPv6

[isdnip]

I'm sorry I'm not moderator today or I'd mod you up myself! Another worthless article about a worthless protocol, IPv6, breakfast of idiots.

Ridiculously-long addresses cause more packet overhead, since lots of packets carry nothing but ack's or short requests for data. And use VoIP, which needs small packets to control latency, and IPv6 makes the bandwidth preposterous. The usual excuse is that bandwidth is cheap, but that's not always true, especially if Uncle Sam or mommy isn't paying for it.

But the worthless article has even more wrong. It repeats the false claim, which by now has become a Big Lie of Bushian proportions, that IPv6 helps QoS. It doesn't do jack squat for QoS! You have one DiffServ bit in v4 already, and MPLS underneath IP for when things get more critical. (The two are sometimes used in tandem.) IPv6 has a useless flow indicator in the header. It's too short to have global significance, and IP is connectionless, so it does zilch. Just a waste of bits. Likewise, V6 doesn't do jack for security, since IPsec works with V4 already.

Nor does V6 help control router table sizes as the article claims. Sure, it's possible that existing networks, when renumbered in v6, can be more rationally aggregated. But a bigger address space invites more address blocks.

Look, I was around when V6 was invented. It was during the reign of the first President Bush. The Internet was not yet public. The IETF had pretty much settled on TUBA as the evolution of IP. TUBA was based on OSI CLNP, which was quite rational. (It wasn't all of CLNP, which had a zillion options; rather, it was a profile of CLNP.) The competition came from two half-baked undergraduate-quality proposals. Steve Deering, who was popular in IETF by then for doing some other good work, came up with "SIP" (Steve's IP). Paul Francis (Tsuchiya), another Nice Guy, came up with "PIP". They both played Yugo to TUBA's Mercedes. But "OSI" was unpopular, for religious reasons, and the taint wore off onto CLNP. At the last minute, IPv6 was created by merging some of PIP into SIP. And Vint Cerf, the Chauncey Gardner of the Internet, changed his IAB vote from TUBA to IPv6.

It's been about a bakers' dozen years since then and IPv6 is still two years away from widespread acceptance. With any luck it'll stay that far away. It's useless and costly. IPv6 is just an ego boost for some tech weenie poseurs, and a scheme by Cisco and its ilk to extract more money for new hardware that will be needed to cope with this unnecessary hack.

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

I'm not aware of any common implementations of NAT (we're actually talking about PAT) besides Cisco IOS that will route just any packet to the internal network while in NAT mode. But for most home users, it amounts to the same thing as a firewall blocking incoming traffic.

Linux's does. I just confirmed it on my machine here with vmware.

I'm not aware of any common implementations that don't just route packets when only doing NAT. And that's all they should do. There is nothing in the NAT standards (RFCs 1631 and 2663) that specify dropping packets that aren't in the NAT process. If a device is doing such things, then by definition it is doing more than just NAT. It is doing at least packet filtering and probably a stateful firewall.

NAT makes it incredibly easy for companies who don't own their own IP block to move to differerent ISPs at will.

As do properly set up DNS and DHCP.

Not nearly as easy as NAT. Especially when an internal WAN is involved. I'm talking about larger networks than 10 PCs and a Windows 2000 file server.


Ok, maybe not quite as easy as NAT. But it isn't immensely difficult. I would argue that the benefits of using routable addresses (with a firewall) are worth the extra trouble when changing upstream providers.

How in the world is SSH broken by NAT? I use it all the time through NAT.

Do you ever use it to access multiple machines behind NAT? And what do you do when it yells at you about screwy host keys? Just ignore it and hit yes, thereby negating most of the security SSH provides you?

Most IPsec implementation have a NAT traversal mode.

See RFC 2663, section 9.0. Here's the juicy bit:

With the exception of RSIP, end-to-end IP network level security assured by current IPsec techniques is not attainable with NAT devices in between.

And again, there are real problems if you have multiple machines doing IPSec behind the NAT. The VPN masquerade configuration in the linux kernel warns about this.

And PPTP? That is solved by NATing to a pool of public addresses.

Well if you're going to all that trouble, why don't you just give the actual machines the public addresses and use a firewall, thereby significantly reducing the complexity of this setup?

As does IPv6. Or does this hypothetical business have more than 2^64 computers?

NAT has the distinct advantage of being available now.

As does IPv6 (at least moreso outside North America). Perhaps if less people were disillusioned by NAT, it would be more common there too.

I also work with MANY businesses and NAT is a pain in the ass, especially for those with all but the simplest of needs.

Then I suggest that you just don't know how to take advantage of the benefits of NAT. For example, I do work for a medium sized financial institution about to change ISPs and public subnet. If they didn't do NAT, it would be a huge problem trying to coordinate a re-IP with their many remote locations, vendors, and clients. NAT is allowing them to make a seemless transition. This kind of thing happens more often than you'd think.

I've renumbered networks with multiple locations, one with >150 machines at a location. As I admitted already, it isn't quite as simple as with NAT, but it isn't the extreme pain in the ass you're making it out to be if you're using DHCP and have systems configured to use DNS hostnames whereever possible instead of hard coded IP addresses.

Until IPv6 catches on, I won't setup a client without NAT. Well, unless they have some critical application that absolutely will not work through NAT, but so far that hasn't been much of a problem.

Same here. Most of my clients don't want to pay the two or three limbs that ISPs charge for big enough routable blocks of addresses.

Re:yet another worthless article about IPv6

[Dmala]

In fact, I'd be willing to bet that there are a lot of multiple computer households that are *much* worse off, because they are run by someone who *thinks* they know about security.

Re:yet another worthless article about IPv6

[Spoing]

1. As for the shortages, you think that it's a good idea to have scarcity in the IP market just so people will be encouraged to run NAT? I think its presumptious of you to force conditions on me, personally I'd love to have IPs for each machine in my house, but I can't because IP addresses are hard to come by.

Spliting public addresses (Internet routable) and private addresses (non-Internet routable) addresses from each other is a good idea. NAT is the main way to do that.

As a system administrator, you probably know that your networking equipment is aware of this public/private split, and that this makes your job of configuring everything easier and more secure.

As a system administrator, you know how to route ports from different machines through 1 IP. You pick gear that can do the work for you, so having 1 port isn't much of an issue.

So, as a system administrator...why do I have to even mention this?

Re:yet another worthless article about IPv6

[SpaceLifeForm]

If you are doing MASQUERADE, you are doing SNAT. If you are doing SNAT, it makes it almost a firewall anyway because you would be hiding non-routable ip addys which must be SNAT-ed to traverse the net. External attackers can't route to any machine on your lan, except your gateway/firewall machine.

The main problem these days is having a non-trusted machine on your lan that calls home.

For more, see this article .

Re:yet another worthless article about IPv6

[jadavis]

Creating game servers, etc, usually requires having an outside server with a dedicated IP address.

The reason the internet is successful is that every user is a peer. One computer may be a server and the other a client, but the server could just as easily be the client and the client could just as easily be the server.

Unless, of course, the client is stuck behind NAT and can't be a server. Maybe he could ask his ISP or sysadmin for permission to recieve incoming connections on a specific port.

When you tell some users that they aren't good enough to be servers, they miss out on potential applications. An example may be to create a game server and ask your friend to connect, or if you need to send your friend a large file over ftp and both of you are behind NAT.

Re:yet another worthless article about IPv6

[misleb]

I'm not aware of any common implementations that don't just route packets when only doing NAT. And that's all they should do. There is nothing in the NAT standards (RFCs 1631 and 2663) that specify dropping packets that aren't in the NAT process. If a device is doing such things, then by definition it is doing more than just NAT. It is doing at least packet filtering and probably a stateful firewall.

Even without the firewall, NAT is more secure than no having NAT. Secure enough for most home users whose real concern are the worms scanning the internet and not clever hackers manipulating routing tables. Since common devices do provide the simple filtering necessary to protect against this kind of attack, this is all pretty moot.

Ok, maybe not quite as easy as NAT. But it isn't immensely difficult. I would argue that the benefits of using routable addresses (with a firewall) are worth the extra trouble when changing upstream providers.

Obviously you haven't done it with networks of the complexity I have. It isn't just about changing providers. It could be as simple as adding a new remote office. What do you do when you've already allocated your /24 to your LAN/WAN? How about adding a DMZ to your firewall? All this requires reprovisioning, resubnetting, and re-IPing if you have a fixed public set. NAT offers an incredible amount of flexibility in network design. It would be nice if you could just arbitrarily get new public IPv4 subnets or start with a large enough block as in IPv6, but that is not the way things are.

Do you ever use it to access multiple machines behind NAT? And what do you do when it yells at you about screwy host keys? Just ignore it and hit yes, thereby negating most of the security SSH provides you?

It has never been an issue. I try to avoid port mapping and opt for IP mapping. If there is a server behind NAT that I will need to access, I give it its own static translation. I never have problems with screwy keys. If I need to access many machiens behind NAT, I'll just ssh to the one and go from there. I'd probably do that even if I had public IPs (and a firewall). You know, just to limit the points of entry.

And again, there are real problems if you have multiple machines doing IPSec behind the NAT. The VPN masquerade configuration in the linux kernel warns about this.

As I mentioned, I generally avoid initiating VPNs from inside a corporate network. The firewall/VPN concentrator should be maintaining any VPN connections. You can filter traffic there. Although I have had this issue with users accessing VPN from home through NAT. And I will admit that NAT at home isn't worth the trouble if it can be avoided.

Well if you're going to all that trouble [of NATing to a poo], why don't you just give the actual machines the public addresses and use a firewall, thereby significantly reducing the complexity of this setup?

Umm, I would be using a firewall, NAT or no NAT. I wouldn't put a business on the Internet without one. It was only home networks that I suggested NAT alone would be good enough security. As to why I wouldn't assign public addresses directly to the machines? Because it isn't worth the loss of flexibility.

As does IPv6 (at least moreso outside North America). Perhaps if less people were disillusioned by NAT, it would be more common there too.

Get IPv6 in NA? You mean by tunneling my traffic through IPv4 to some backbone many hops away? No thanks! Neat experiment, but not something I would put into production.

I've renumbered networks with multiple locations, one with >150 machines at a location. As I admitted already, it isn't quite as simple as with NAT, but it isn't the extreme pain in the ass you're making it out to be if you're using DHCP and have systems configured to use DNS hostnames whereever possible instead of hard coded IP addresses.

Well, I really dont' know what this "DNS hostnames instead of hard coded IP addresses" thing is, but OK. If you don't mind dealing with it, go for it. I have dealt with networks more complex than just renumbering some machines. When you start making interconnects with vendors and clients, it gets pretty messy.

-matthew

Re:yet another worthless article about IPv6

[pHDNgell]

(Hey, Dustin.)

Hey!

BUT: Home firewalls are so widespread only because NAT requires one.

That's an interesting way of looking at the problem. Our routers have some pretty neat firewalling features in them for home users, so I tend to think everyone should just use them.

I believe we're to the point where a firewall is something home users are scared into having in general nowadays. People are a lot less likely to consider putting a non-firewalled machine on the internet, and end users should be encouraged to think the same way.

So you get a stateful firewall that defaults to allowing all egress traffic and no ingress traffic and you're back to where you started (or at least, where I started), with the potential to do a lot more with growth.

People make fun of the light switches and all that, but is it really that obscene? I've got remotely accessible power switches, and thermometers, and homemade gadgets and stuff that I like to remotely access. They need addresses, too.

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

Even without the firewall, NAT is more secure than no having NAT. Secure enough for most home users whose real concern are the worms scanning the internet and not clever hackers manipulating routing tables. Since common devices do provide the simple filtering necessary to protect against this kind of attack, this is all pretty moot

Well, most home users I know would be concerned about mildly clever attackers too. But you're right, that's all moot because practically all common router appliances provide some firewall - more than just straight NAT.

Obviously you haven't done it with networks of the complexity I have. It isn't just about changing providers. It could be as simple as adding a new remote office. What do you do when you've already allocated your /24 to your LAN/WAN? How about adding a DMZ to your firewall? All this requires reprovisioning, resubnetting, and re-IPing if you have a fixed public set.

Just request another, additional block from your ISP. You don't need to renumber everything. Still not what I would call too difficult to outweight the advantages of routable addresses. Maybe its a matter of opinion.

It would be nice if you could just arbitrarily get new public IPv4 subnets or start with a large enough block as in IPv6, but that is not the way things are.

And that right there is the whole point of this thread. If we had IPv6, we wouldn't need NAT (at least not for its most common use) and our networks would be a lot more powerful. But every time a discussion about IPv6 comes along on slashdot, people pop up saying "IPv6 is unneccessary. NAT solves all those problems, and gives us security too. And who needs a /64 prefix when I can just pick a large RFC1918 block and use that just as well?" and none of that is true. Maybe if some of this FUD about NAT providing advantages that it doesn't and the fear of giving one's machines real, routable IP addresses would stop, demand for IPv6 would increase.

I try to avoid port mapping and opt for IP mapping. If there is a server behind NAT that I will need to access, I give it its own static translation.

As in one-to-one NAT? So you're essentially giving this machine its own routable IP Address, only with the complexity of NAT thrown in?

Umm, I would be using a firewall, NAT or no NAT. I wouldn't put a business on the Internet without one. [...] As to why I wouldn't assign public addresses directly to the machines? Because it isn't worth the loss of flexibility.

Exactly. So NAT isn't security (except for these home users that you believe aren't that interested in security), you're just doing NAT to avoid renumbering a large, complicated network if you change upstream providers and to have an arbitrarily large prefix. IPv6 addresses both of these concerns - you'll get a /64 from whatever provider you choose, which should be large enough for your network. And if you have to renumber you only need to change the internet prefix, the first 64 bits. And while I admit that is still harder than switching providers with NAT, it is easier than renumbering various sized patchwork networks (created by the situation I mentioned in my second paragraph). But again, even taking into account the renumbering ease that NAT gives you, I still think routable addresses and the abudnance of them that IPv6 gives is worth it.

Well, I really dont' know what this "DNS hostnames instead of hard coded IP addresses" thing is, but OK. If you don't mind dealing with it, go for it.

DNS hostnames instead of hardcoded IP addresses: instead of configuring a machine to make its time server is 10.5.23.40, you make it 'time.company.com'. Instead of telling a user to pull up the com

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

It's a firewall. When you issue those commands, you might notice the conntrack module being loaded. It maintains a table of the active connections. No packets ever go to the interior machines except when they correspond to one of those connections, initiated only on the inside. So it's a specialized firewall, but a firewall. And a good one.

No no no. It isn't a firewall at all. That table of active connections only applies to packets in response to a connection that is already NATed. If a new connection comes in for an internal machine, that inbound connection is not getting NATed. And that connection will go through just fine. Trust me, I just tried this on my own network. I'm going to explain it all in my next reply to the other guy who replied to me.

Re:yet another worthless article about IPv6

[ultranova]

and that device will undoubtedly have a built-in firewall

And that device will undoubtedly have a defult password of admin.

No. The default password will be password. Admin will be the default login name.

Fortunately, it won't matter, since the control interface cannot be reached from the Internet-connected ports, only the LAN ones. So, in order to prepare an attack, you'd need to have a spy on the inside already, and to place one would require a successfull attack.

I wonder, thought: wouldn't it be simpler to just port Mozilla for Playstation 2 / XBOX / Gamecube ? That way, the people who absolutely refuse to learn how their computers work would have a gaming / surfing platform which would be reasonable secure against malware - even if it got a contagion, the next reboot would wipe it clean. The only problem is that TV's are not good for reading text...

Re:yet another worthless article about IPv6

[asdfghjklqwertyuiop]

If you are doing MASQUERADE, you are doing SNAT. If you are doing SNAT, it makes it almost a firewall anyway because you would be hiding non-routable ip addys which must be SNAT-ed to traverse the net.

That depends on what you define 'the net' as. If I go and type those commands on my linux router at this very moment, I can head over to the house down the road or anyone else on this same logical ethernet with this broadband ISP, plug my laptop into their modem, type 'route add -net 10.0.0.0/24 gw ', and I will be able to fully connect to all my machines on the inside network with no problem. If my ISP gets hacked (wouldn't be surprising) or someone with the right access at the ISP wants to screw me, they can set up similar routing on their routers and my network will be fully accessible from anywhere in that ISP and from any of my ISP's customers and maybe beyond.

External attackers can't route to any machine on your lan, except your gateway/firewall machine.

Yes they can. They can route the packets into your router, and given those commands, your router will happily pass their packets along to the internal machine. It has no rules telling it to block anything. I just tried this exact thing on my network here: I have a vmware virtual machine on my laptop connected to my laptop via a virtual ethernet numbered 192.168.1/24. My laptop has a physical ethernet connected to my router, numbered 10.0.0.0/24. I set my laptop up to NAT the vmware machine via the commands I posted. That worked as expected. Then I logged into my main router (10.0.0.1), typed 'route add -net 192.168.1.0/24 gw ', and voila, I was able to ping 192.168.1.2, the vmware virtual machine just fine. Wide open.

Now just shift that process up to my main router instead of my laptop, and you see the problem in assuming NAT also gives you firewall capabilities.

Re:yet another worthless article about IPv6

[Michael Hunt]

ISPs aren't going to have a choice. The bottom-level object in the IPv6 hierachy is the /48. This is what is meant to be handed out to end users. You get 16 bits of subnets, and 64 bits of (usually EUI64) host per subnet.

Sure, ISPs can allocate you a dynamic /128 every time you connect, and attempt to charge you for a /64 (realistically the smallest block you can treat as its own entity,) but other ISPs will give out /48s for free because it isn't costing them anything, and the free market will reassert itself.

IPv6 is necessary, and it IS being rolled out, albeit incrementally. How much further along is IPv6 connectivity now than it was even 18 months ago?

Re:yet another worthless article about IPv6

[Anonymous Coward]

Sysadmins and regular Slashdot readers are in the minority. Personally I'd rather have the Comcast weenies behind a single firewall... Then I wouldn't have to block entire /16's to stop their worms from hammering me.

IPV6 will stop this as its almost impossible to write a worm that would fine many machines to hit.

Re:yet another worthless article about IPv6

[maxwell demon]

What about having an USB slot, and firewall settings can only be changed by writing the changes to an USB stick, and physically putting that USB stick in? The firewall then detects that there's an USB stick containing config data and copies those to it's internal storage. That's a protocol which simply cannot be hacked without physical access to the device.

Re:yet another worthless article about IPv6

[Spoing]

Interesting...modded down for stating the truth.

The person I was commenting on was modded up.

Who would you like to run your network folks? Scary...

Re:yet another worthless article about IPv6

[KWTm]

As a Comcast customer, I resemble that remark!

You certainly would, if you too were composed of two paragraphs of two sentences each. In fact, for a moment I thought it was you yourself that Garcia posted up there.

So, have you figured out what alternatives there are if you resent Comcast?

Re:yet another worthless article about IPv6

[misleb]

As in one-to-one NAT? So you're essentially giving this machine its own routable IP Address, only with the complexity of NAT thrown in?

Maybe I've just been doing it for so long with good firewalls, but it really isn't that complex. I think you are blowing this whole complexing of NAT thing way out of proportion. Adding a NAT rule is just as easy as adding a firewall rule. If you have a good firewall in place that does NAT well, why not utilize it if you can? Works for me.

Whether you like NAT in principle or not, the fact is that it does address many of the problems that Internet as a whole currently presents. NAT isn't perfect, and shouldn't be consider a long term solution to the problems, but people use it for a reason. It isn't like there is some NAT conspiracy spreading propaganda and trying to surpress the truth abot IPv6....

DNS hostnames instead of hardcoded IP addresses: instead of configuring a machine to make its time server is 10.5.23.40, you make it 'time.company.com'. Instead of telling a user to pull up the company website at http://10.3.0.19, go to 'www.internal.company.com'. You do see the advantages and reasons for this, right?

Sorry, I thought you were talking about somehow configuring the IP of the server itself using DNS.

And speaking of messy interconnects, haven't you ever run into the problem where two different networks in need of interconnection have been numbered with the same RFC1918 prefix, such as 192.168.1? Another drawback of NAT: IP addresses that aren't necessarily unique. I know I've run into that problem several times.

WHen setting up a network, I will pick an "unusual" subnet such as 10.16.10.0. The chances of a conflict are pretty low.

Don't get me wrong, I'd like to see IPv6 rolled out in the US, but it is pretty huge change and shouldn't be taken lightly.

-matthew

Re:yet another worthless article about IPv6

[fyonn]

I'd say that it's not as easy as that. I'm of the opinion that nat is a big horrible hack. for one, using nat is for the most part a workaround to their not being enough IP's for each customer to have (why is irrelevant). it works but it breaks things. over the last 5 years or so, it's not broken too much that the average user has cared about (due to the way that protocols have worked, or the workarounds put in place by experienced programmers). but we're coming up to much ore interesting internet apps now.

the whole peer to peer situation is really taking off, and I don't just mean kazaa and the like (but those apps are as valid as any others) but things like voice over ip. this works great between 2 real IP's, often works okay between 1 real ip and 1 behind nat (due to programmers ingenuity rather than anything else) but between 2 natted addresses? now it's getting really difficult, and why should it be? the internet was created in a way that made anyone who wanted to be a publisher as well as a consumer, but with nat that doesn't hold true.

yes, you can put in port forwarding on a router but that doesn't solve the problem. with 2 or more computers in the house then who are those packets for? and why should the user have to know these things? they should be able to plug in their equipment and use it, without all the confusion that nat causes.

then you have online gaming for example. it's getting more and mroe popular with loads of games supporting it, but a user behind nat can only join other people's gaes, not host his own. if three friends want to enjoy a private game between them then they should be able to host the game themselves and not share a public server with others. with a real IP address, they can.

and it's not just the home environment that makes NAT horrible. I work for a big computer company with many customers and lots of data transitting our networks for various purposes, and they all like to use the same private IP addresses. most of our own internal network is on public ip addresses (we have a /16) and so connectivity from them to us is fine and easy, but from us to them (and we're talking over private links here, not public) is more difficult due to the various routers that have to do NAT. and you try debugging it when you don't know the situation at hand, the project manager is telling you one set of ip addresses, the networks guys another, and you're seeing a third set in yo firewall logs! (been there, untangled those threads) it's hell, esp when it's a major incident.

it's not unusual to have a connection have both source and destination addresses natted to get through, and that sucks badly. not to mention remembering that the real webserver is on 10.1.1.1 but co's A, B and C access it on 172.2.2.2, co D access it as 10.66.77.88 and co E access it via two layers of nat so who knows what the fuck they access it as?

if all our customers had public ip addresses for their internal network then, by and large, this wouldn't happen. sure, there would be a couple of nat's here and there (genuine nats that is, not pats) for servers that move and are referenced by too many hosts files (ugh) but mostly it would make debugging serious issues so much easier and make the network easier to understand.

I would love to see more made of ipv6 and my website and email is available by it, no almost no other bugger uses it. in fact I don't even know if my email setup for ipv6 works as no-one I know can test it for me!

dave

Re:yet another worthless article about IPv6

[fyonn]

ISPs make some good money (hell mine gets $5/mo more out of me for an additional IP) selling off static/dynamic IP space. You think Comcast is going to move for a switch when they make $10/mo per extra IP?

you know, I don't know about america, but I thought that in RIPE territory this wasn't allowed according to RIPE-181. ip addresses are, after all, free to the ISP (apart from paying for their membership of the RIR) and I thought that they could only charge an admin fee (ie configuring the routers/radius servers to allcate them) but not charge for the ip addresses themselves. this to me says that a one off charge to configure it is fine, but a standing "rental" charge is not allowed.

alas I never thought to ask the question when I was a RIPE admin and they cared what I thought, I've asked since and been ignored. anyone know?

dave

Re:yet another worthless article about IPv6

[fyonn]

d00d, we already have dhcp v6

http://www.ietf.org/internet-drafts/draft-ietf-d hc -dhcpv6-28.txt

there are even severl working dhcpv6 servers.

dave

Re:yet another worthless article about IPv6

[gfim]

Woosh!!

Moe, Larry, and Curly are turning in their graves!

I'll just wait....

[callipygian-showsyst]

I'll just wait for W. Richard Steven's book on IPV6. That'll explain everything.

Re:I'll just wait....

[bloggins02]

Error in AnonymousCoward.pl (line 42): Sense of humor not found. Please repost and try again.

Re:I'll just wait....

[ceswiedler]

He's passed on (hence the joke, I get it) but in his TCP/IP Illustrated books, he discusses IPv6 thoroughly, including how to write applications to use either protocol seamlessly.

Re:I'll just wait....

[computational super]

Ummm... no he doesn't. I have all three volumes (purchased this year) and there's no mention of ipv6 anywhere in them... although the code samples probably apply to ipv6, I don't see any reference to, say, an ipv6 header, or ipv6 routing schemes or how "security is built into ipv6" as all of the datasheets promise but don't dive into. Am I missing something?

Re:I'll just wait....

[Anonymous Coward]

Chapter 10. IPv4 and IPv6 Interoperability (starts at page 261)

in Part 3. Advanced Sockets

in UNIX Network Programming
Volume 1
Second Edition
by W. Richard Stevens
ISBN: 0-13-490012-x

Re:I'll just wait....

[pchan-]

sure, you guys are thinking that upgrading to an IPv6 is going to be sweet. you'll have tons of torque, and your computer is gonna jump off the line. what most people don't consider when going to IPv6 is all the wasted space under the hood. the v configuration of your packet driver requires a split header design, taking up space on both sides of your cpu. your motherboard will need twin exhausts, and that's really going to take away alot of the space in the case. plus, when you're trying to download slowly, you'll be eating up alot of power just idling that big thing.

that's why i'm switching to IPI6. the inline cylinders make for a faster revving processor, and the headers all fold to one side of the block. not as much torque, sure, but plenty of horsepower on tap when you really want it. the block is really not that much longer than IPv4, and you still have room for the front tie-rods if you want to upgrade to 4 cpu-drive.

well, that's my plan, anyway. for now, i'll just buy a big wing and carbon fiber case-mod and stick it on my IPv4 computer until i get promoted to shift-manager.

Re:I'll just wait....

[d474]

^^^Hello modders....don't miss this parent^^^

LOL I didn't catch the metaphor until the second paragraph. I was thinking twin exhausts was code for dual cpu's or something...I was all 'dang this guy uses some serious industry jargon'.

Hey, it was a long day at work people!

Not a bad start...but a couple of things on IPv6..

[Agent Green]

It's not a bad introduction, but since this is slashdot, I've got a couple of things that I want to point out:

The article suggests that DHCP will no longer be necessary. This is not necessarily true. IPv6 autoconfiguration will get you an address to get onto the net at large, but it will not give you your DNS servers, time servers, or any number of goodies that DHCP is capable of serving up. Autoconfiguration does remove the neeed to define all kinds of crazy scopes, but it doesn't help with other configurable options.

There is exists a problem with multihoming small entities that need provider diversity in IPv6. Some companies are assigning each customer their own NLA, or /48s, giving the customer 16 bits of addressing power. However, customers of Tier 2 ISPs will only get a couple SLAs or so. If I am a small business with one of the SLAs, there is still the problem of BGP multihoming with this address space, and this absolutely needs to be resolved in the not-so-distant future. I don't think there's a facility where I can go to ARIN and request my own /48 to annouce, say, between Level 3, MCI, and AT&T. While this might not make a difference to most people, it is a problem on the transport side of the house.

idiot

[BoldAC]

I didn't understand why we needed IP6 until one of the guys at work described why he wanted each of his light switches to have its own IP address...

Idiots... ...that's why we need IP6.

(just kidding, boss)

AC

Re:idiot

[neitzsche]

Idiots... ...that's why we need IP6.

I strongly agree. However, since politics have not been removed from the situation, IPv6 will still have the same issues. There will still be address hoarding. I don't see how IPv6 prevents that.

Re:idiot

[Technonotice_Dom]

There will still be address hoarding. I don't see how IPv6 prevents that.

It won't, it'll just put it off for a bit longer...

IPv6 is like moving cheese

[Anonymous Coward]

I work at a place where the servers are named after the ip address and zip code (SFA smart fine admins). It hard enough to remember where a mirrored server is and the IPv4 address let alone the IPv6 and GPS coordinates.

Re:IPv6 is like moving cheese

[smclean]

I think the problem is your naming scheme, not IPv6!

Poor planning

[MikeMacK]

The simple answer is that it is due to the very poor planning in the creation and implementation of IPv4 coupled with the unexpected explosive expansion of the internet.

Was it poor planning? The article states that there was an unexpected explosive expansion of the Internet. I believe it's like the Y2K problem, they didn't think their programs would still be in use around 2000, so they only needed to store a two digit year. The same happened here, they didn't realize the Internet would become the World Wide Web, the New Economy, etc. Hell, even Bill Gates didn't see it coming.

Re:Poor planning

[smclean]

NAT may provide us with a nearly infinite number of IP addresses, but none of the addresses behind NAT are not properly addressable; each one can only get ports forwarded to it from the external IP address.

Therefore, there are only as many port 80's out there as IP addresses, and NAT cannot change that. IPv6 can.

To me, NAT is just a hack. Having a handful of real IPs is to me much preferable than one IP, NAT, internal IPs, and a massively complex forwarding ruleset.

Therefore, yay IPv6.

Re:Poor planning

[Neil Watson]

Not enough organizationgs utilizing NAT. Also, many organizations in the USA have huge blocks of IPs reserved that they could never possibly use. I seem to recall reading that one university has an entire class A block.

Re:Poor planning

[NoMoreNicksLeft]

Plus, the protective power of NAT/firewalls, be it a crappy little Dlink home router, or iptables, can easily be replaced by a proper IPv6 router. If your home has 5 computers, they won't all have distinct dedicated internet connections... so NAT doesn't seem to offer any real protection anyway.

Re:Poor planning

[datawar]

Not surprisingly, it's MIT. They own 018.x.x.x

Re:Poor planning

[mark-t]

Actually, with IPv6, machines behind a NAT _can_ be properly addressable, just as if they were "directly connected" to the Internet.

The key to it all is the "extension header" support that is part of IPv6. You would use multiple headers, in a IP packet. The outermost one referring to the IP of the NAT. The NAT then strips the first header out and forwards the remainder of the packet onwards. For outbound packets, the opposite happens... it adds an extension header indicating the IP address of the NAT. The actual data within the IP packet remains unaltered in all of this. so if a system isn't interested in raw IP, they won't see all the extension header stuff at all, only the original data that was sent. The construction of the appropriate extension headers could all be underneath the hood unless one were using raw IP, and the application programmer would not in general ever have to worry about it.

I hate to ask a stupid question,

[Scott Lockwood]

but with virtual networking and CIDR, IPv4 is not going to die any time soon - why would anyone WANT to have to replace all their equipment (like routers, etc.) just to get IPv6 - the ROI doesn't justify the move.

Re:I hate to ask a stupid question,

[caluml]

why would anyone WANT to have to replace all their equipment (like routers, etc.) just to get IPv6

All your networking stuff probably supports it already.
Linux, BSDs, Windows, and Cisco do, to name but a few. And you can always get a block of addresses to play with via a tunnel broker.

Re:I hate to ask a stupid question,

[mp3LM]

Updated firmware?

Re:I hate to ask a stupid question,

[Marxist Hacker 42]

Don't need to move entirely- just get a NAT that supports IPv4 on the LAN side and IPv6 on the WAN side. No problem.

Home

[Rubberpants.net]

There's no place like 0:0:0:0:0:0:0:1

Re:Home

[evil.pringle]

and its theres no place like ::1

anyway from tfa: " Another positive outcome of IPv6 will be better internet routing using QoS, Quality of Service, which routes packets based on priority. So for example, if one person is pinging a server and another is downloading a file, the one pinging will have less priority in their data transmission than the one downloading a file because the user who is downloading a file from has created a data stream which will automatically gain more priority over the simple ICMP data packets."

and is it just me or does QoS on the backbone seam like a bad idea?

Re:Home

[AirShark]

wouldn't that be ::::::::::::::1 ? ;-)

Re:Home

[Marxist Hacker 42]

Shouldn't that be ::1:0? Damn IPv6 shortcuts, take less than 20 seconds to type.

Re:Home

[leerpm]

No, ::1 is the home/localhost/loopback address. ::0 is when you have no assigned IP address, logically equivalent to 0.0.0.0 in IPv4.

Re:Home

[pavon]

and is it just me or does QoS on the backbone seam like a bad idea?

Out of curiosity, why do you think this is a bad idea? It is impossible to layer QoS on top of something which treats all packets equally, and there are legitimate uses for QoS, like VoIP and video conferencing. Furthermore, when the bandwidth is saturated it is better for somethings to work and some not then to have everything jammed up.

Re:Home

[Cato]

Of course, IPv4 is just as capable as IPv6 of doing QoS, and in fact most provider IP networks outside the Internet already offer DiffServ QoS. The 'IPv6 enables QoS' myth is almost as strong as the 'IPv6 has better security' one - IPSec was invented for IPv6, but it's been deployed widely on IPv4.

Fortunately, the explosion in home networks, peer to peer, WiFi laptops and smartphones (particularly 3G) will be enough to make IPv6 happen, sooner or later.

Re:Home

[Y2]

There's no place like 0:0:0:0:0:0:0:1

You're not thinking globally!

Re:Home

[rduke15]

You're not thinking globally!
Of course he is, but like any good revolutionary, he is acting locally.

Re:Home

[evil.pringle]

i just think that every bad thing would automaticaly set itself as "important". and that would make legitimate stuff lag.
and i do qos on my server at home, works great.
the whole job of the routers in the middle is to just route packets, not descide whats important. (imadgine if you had to pay to get QoS over the internet)

Typo?

[TonyTheTiger]

Is that a typo in the department line or is it intentional?

Either way it's hilarious.

Re:Typo?

[adavies42]

Reflective of the quality of the FA, IMAO.

Re:Typo?

[Just Some Guy]

Seems reasonable:

Boss: I just had to cut your budget by 28% to finance the new company jet. By the way, can you deploy all of our servers on IPv6 and have them penetration tested by next Tuesday?
Me: *whack*
Boss: Hey, that smarts!

Remembering IP Addresses

[wetlettuce]

Now it's reasonable to remember IP address like 192.168.x.x but when we go to IPv6 how are you going to remember 43FB:2222:4232:1234:1234:BB3F:A0A0:1234?
But yah to getting rid NAT and the nasty hacks all that involves. Contary to popular belief there is very little added security, if you want security get a firewall.

Re:Remembering IP Addresses

[JonKatzIsAnIdiot]

Contary to popular belief there is very little added security
Really? They block incoming connections to a computer, which is a great security enhancement. A NAT box will prevent you from accidentally sharing your hard drive with the world, unless you explicitly allow it. An unpatched Windows machine lasts 16 minutes or so before being compromised - unless it is behind a NAT box. You will also be protected from all worms that depend on incoming connections to propagate, as well as Messenger spam.
So - please explain to me what is so insecure about NAT.

Re:Remembering IP Addresses

[tensai]

So - please explain to me what is so insecure about NAT.

It's not that NAT is insecure compared to a firewall. What wetlettuce missed is that NAT boxes are firewalls and hence you get that protection. Firewalls, be they NAT or otherwise, are not the end-all of security and should not be treated as such.

But aside from conserving address space, NAT doesn't offer you anything that a properly configured firewall doesn't. It's a hack that has bought us some more time, but I'll dance a jig when I can dump it in favor of IPv6.

Re:Remembering IP Addresses

[dave420]

"Contary to popular belief there is very little added security"

you're funny :)

I for one...

[Artie_Effim]

I for one, welcome our new 128 bit overlords!

Re:Not a bad start...but a couple of things on IPv

[segfault7375]

You seem to understand the technical issues very well... Sorry, but since this is /. you must leave this discussion immediately.

Here's hoping.

[r00k123]

from the unless-you're-to-smart-for-it dept.

Please, oh please, let that be a joke...

Re:Here's hoping.

[Kenshin]

"I am so smart! I am so smart! S-M-R-T! I am so smart!" /Simpsons

Understatement of the week?

[Daverd]

Quoth the article:
Nats will also no longer need to be used as there will no longer be a need for IP address conservation since there will now be enough IPv6 addresses available for each person on the planet to have 10 of their very own.

I might be mistaken, but I thought I'd heard that IPv6 provides more than enough IP addresses to have one for every atom in the universe. Correct me if I'm wrong.

Re:Understatement of the week?

[bloggins02]

Well, it is estimated that there are ~10^80 particles in the entire universe. Meanwhile there are ~2^128 addresses in IPv6.

So, since 2^128 > 10^80, then yes.

Re:Understatement of the week?

[stratjakt]

2^128-1 comes out to
3.4028236692093846346337460743177e+38

Which is lots, way more than 10 each. I don't know the protocol well enough to know if there are reserved/blocked ranges.

Seems to me every living entity on the planet could have a couple million nodes on the 'net.

38 is a lot of digits.

Re:Understatement of the week?

[palfreman]

Yes, there are 2^128 IPv6 addresses, which accoring to bc is 340282366920938463463374607431768211456. But estimates are that there are on 6+ billion people on earth, and if they are to have 10 addresses each, that is still only 2^36

I gave up reading the artical at that point. The author has obviously no idea what he is talking about.

Re:Understatement of the week?

[mewyn]

Hardly. Looking at the whole address space, keep in mind not all of it is usable, it is 128 bits in size. This translates to roughly 3.40e38 unique numbers.

Now, 12 grams of Carbon-12 is one mole, or 6.02e23 atoms. 3.40e38 moles of Carbon-12 is 6.78e12 kilograms.

Now the mass of the earth is 5.97e24 kg, so it's not nearly enough to give every atom in the earth even, but it is quite a lot.

Note - it's been too long since my last Chem or math class, so my numbers may be off. If they are, you can go ahead and correct me.

Re:Understatement of the week?

[tp9674]

2^128 = 10^(128 * log 2) ~= 10^38.53

So 2^128 10^80.

In fact there is only 1 IP addresses for every 10^41.47 particules

Very roughly 1 IP for every 10^15kg of matter in the unverse.

Re:Understatement of the week?

[LowneWulf]

Certainly a huge understatement, but not as much as people are thinking.

It's the difference between how many addresses can be addressed in 128 bits and how many will actually be available. Remember, some of those bits simply indicate unicast traffic, and some of them are reserved. On top of that, much like IPv4, there'll be a lot of wasted addresses as groups classify themselves as high-level providers and grab and dramatically underutilize trillions of IPs for their network.

Re:Understatement of the week?

[Y2]

there will now be enough IPv6 addresses available for each person on the planet to have 10 of their very own.

I might be mistaken, but I thought I'd heard that IPv6 provides more than enough IP addresses to have one for every atom in the universe. Correct me if I'm wrong.

I think there was an exponent on that 10 which didn't make it into the HTML transcription. The right exponent would be about 27.

But counting how many addresses per particle or atom or gram is not actually interesting. (Press coverage notwithstanding.) It's what you can do with all that elbow room, like autoconfiguration and perhaps location-independent endpoint identifiers. (Which we almost but not really got.)

Re:Understatement of the week?

[bloggins02]

Ahh, I stand corrected. Thanks!

Re:Understatement of the week?

[datadood]

Actually 2^128 is ~10^38 so there aren't enough addresses for every particle in the universe but each person on earth could have ~10^28. I think that's enough, for now at least.

Re:Understatement of the week?

[dave420]

The earth has a very heavy iron core, so figuring out how many atoms it would contain if made from carbon is quite pointless ;) As has been stated here before, there are about 10^80 atoms in the universe, which is a lot less than the number of possible IPv6 addresses..

Surprising, for /. :)

[Vadim Grinshpun]

Gee, and nobody even complained at the red flag waved in their face--that the sole reference listed in the article is "Understanding IPv6" by Microsoft Press :-P

Could slashdot readership have become more mature?
Though if I had to guess, I'd say anyone has yet to RTFA :) (by Occam's Razor :)))

IPv6 by 2008? Who's he kidding?

[BridgeBum]

If this is a measure of when people will start using IPv6, the answer is today. It's already there. Every major TCP/IP stack out there supports IPv6. Tunnel networks exist through IPv4. Internet 2 uses it exclusively.

When are corporations going to start moving to IPv6? Who knows...that will depend on individual needs, but in general, large corporations aren't going to see a big need to move towards IPv6 any time soon. Without end user by in, who is going to 'force' people to use IPv6?

Yes, IPv4 space is running out. It has been for a long time. That's why Network Address Translation and private address space are so common in today's world. They may be hacks, but they do the trick. Where's the business case involved in reorganizing major networks?

Short Sighted?

[hubs99]

The article instantly delcares that IPv4 was short sighted because it didn't allow for enough IP address but is IPv6 any better? The articles states that it will allow every person in the world to have close to 10 IPs but with the expanding products that carry addresses could this be short sighted as well? Think about the products that people are getting or are supposed to have within the next 20 years.

Phone (Voip)
Cell
Computer (could be many)
TV (could potentially need IP)
Webcams

then we have the possible use that people keep proclaiming will happen

Fridges, and other appliances. This list could continue to grow and I could potentially see 100 being the closer value for many folks in many years. This being said of course not every person in the world is going to need lost of IP addy's since many people dont even need to use one now.

But just think how fast the growth of Ip-Address need has grown in the past 30 years and use that to predict the growth for the next 30. As soon as there are available addresses people will use them. The only reason they aren't being used as liberally now is because they are not available.

We might look back in 10 years and think how short sighted IPv6 was and why another 2 byes weren't just added to the protocol to make its growth laster for many, many,.... years.

Re:Short Sighted?

[barcodez]

The most obvious distinguishing feature of IPv6 is its use of much larger addresses. The size of an address in IPv6 is 128 bits, which is four times larger than an address in IPv4. A 32-bit address space allows for 2^32 or 4,294,967,296 possible addresses. A 128-bit address space allows for 2^128 or 340,282,366,920,938,463,463,374,607,431,768,211,45 6 (3.4 × 1038) possible addresses.
The population of the earth is ~6 billion (US billion). So 56,713,727,820,156,410,577,229,101,238 each

Re:Short Sighted?

[fgb]

I think the 10 ip addresses per person figure is probably incorrect.

Think about it. Each organization would have a 64-bit address range to assign as it sees fit. Every molecule on the planet could have its own ip address and there would be plenty left over.

Re:Short Sighted?

[GigsVT]

The opposite problem is more likely, they are handing out huge blocks of IPv6 space to people that don't need it now.

If you give each person an allocation the size of the IPv4 address space (32 bits), then we'll run out real quick. We need to give people less addresses, not more. People don't need 2 billion fucking IP addresses.

Re:Short Sighted?

[Ironsides]

unless you can come up with a way for every man woman and child on the planet to use 10^28th IP addresses in 10 years, we aint gonna run out of IPs under IPv6 anytime soon. 2^128=3.4E38 addresses.

Re:Short Sighted?

[jjhall]

There are a lot more than 10 addresses available for each person. What I think the author unclearly stated is that each person CAN have 10 IPs if needed, not that they were limited to 10 each.

I don't remember the exact numbers, but I read in several places of an estimate of some thousands of IPs per square inch of the planet. It may not be accurate, but 10 per person is way on the low side.

Re:Short Sighted?

[stratjakt]

I don't know why he chose to say "10 addresses", it's more like a couple billion per person.

2^128 is a friggin ginormous number with 38 digits in front of the decimal point.

Re:Short Sighted?

[rkeene517]

I noticed the 10 per person quote too. It is wrong. There are something like 6 Billion people in the world. IPV4 is 4 billion addreses. The huge space of the IPV6 address is 18 Million Billion addresses. This is 3 Billion addresses per peron. They must have meant 10 whole internets per person or something, but it is realy about 1 internet per person.

Re:Short Sighted?

[sirket]

Speak for yourself! I need 2 billion addresses for... for... for strategic sheep herding purposes! :)

-sirket

Re:Short Sighted?

[FictionPimp]

No, your wrong. I predict you will only need 1 IP.

It will be for your phone/computer/webcam/digital camera/mp3player/microwave/fridge/sex toy/stun gun/car/shower/beer/goatse combo device.

Re:Short Sighted?

[Daverd]

If I had any mod points I'd mod you funny... but instead I'll post a reply.

I think it might actually be beneficial if devices had more than one IP address. It seems like a very nice layer of abstraction to assign an individual IP address to each process/application running on a device, for example. Then you don't need to mess around with ports or any of that. Additionally, it would be just as easy for processes on the same device to talk to each other as if they were on separate devices, as long as they used the IP layer to talk. Not very feasible for today's technology, but you never know.

Re:Short Sighted?

[dgatwood]

After you account for overhead, they probably meant 10 IPv4 namespaces per person on Earth.

Of course, that's assuming the overhead takes you down to about 0.000000000000000001% efficiency, give or take... which, given that it is being heavily pushed by government bodies, isn't entirely out of the question, but I digress.

Re:Short Sighted?

[Enigma_Man]

Some quick google-based calculations for number of IP addresses for every square inch of the surface of the earth (including the ocean):

(2^128) addresses / (7.9*10^17) square inches on earth = 4.3*10^20 addresses/in^2... That's a lot.

But then again, they probably thought it was a lot to begin with :) Hindsight is 20/20.

-Jesse

Re:Short Sighted?

[good-n-nappy]

Yeah and what about the Y10K problem? It's being completely ignored!

Re:Short Sighted?

[MyHair]

Hey, we live in a 3-d world. Recalculate for cubic inches including atmosphere and ocean. And convert to metric while you're at it for our non-SAE people (most of the world).

Oh, crap! What about the moon, Mars and Io?

Re:Short Sighted?

[dreamer-of-rules]

I see about a dozen replies so far and no one else mentions that the blocks of 8 IDs are SLA IDs. So it looks like you'll get 8 subnets for your personal use, each of which can have 2^(16*8) unique addresses. Which is more than enough for your cell phones, faxes, and god-knows what other devices. But that's assuming I read that part correctly. For a Dummies Introduction to IPv6, I have to say it wasn't very clear.

Initially a pool of IP addresses will be assigned to an Internet Backbone provider who in turn parts out those IP blocks and assigns them to individual ISP's and customers giving each their own unique NLA number. At this point your ISP will then part out your IP address and assign you a unique block of IP's with your own block of SLA ID's. Most likely they will give you a block of 8 ID's, each of which can become a subnet if you so choose to use each of these ID's separately on your network as a unique subnet.

Re:Short Sighted?

[cms108]

"...size of an address in IPv6 is 128 bits, which is four times larger than an address in IPv4. A 32-bit address space..."

(2^128) / (2^32) is not four.
It's 79228162514264337593543950336.

cHris.

Re:Short Sighted?

[GoCoGi]

There are (2^128)/(2^32) times more different addresses than on IPv4, but nevertheless an IPv6 address only takes up 4 times as much space as an IPv4 address does. Remember, if you have a storage of n bits, 2^n different combinations are possible. So if you take a storage q times larger you have 2^(n*q) different combinations, > 2^(n*q)/2^(n) = 2^(n*q) * 2^(-n) = 2^(n*q-n) For IPv4->IPv6, n = 32, q=4 2^(32*4-32) = 2^96 = 79228162514264337593543950336

Signifigance?

[ceswiedler]

Apart from the number of addresses, how signifigant are the changes in IPv6? Are our routers going to collapse soon under the weight of routing tables, and will v6 really fix that? Will subnetting be easier? The article mentions less (or no) reliance on DHCP; is this simply because there will be enough addresses to hand them out algorithmically (based on MAC?) or is there a replacement for dynamically requested IP addresses in v6?

Oh Jeez

[ReidMaynard]

I read Playboy writes and thought oh wow, is Miss October a Network Engineer..?

Re:Oh Jeez

[koreth]

Dammit, now my keyboard is all sticky.

Re:Oh Jeez

[Enigma_Man]

I've noticed it's more slippery than sticky... Have you been eating anything weird?

-Jesse

Re:Oh Jeez

[ribo-bailey]

eheh thought the same thing.

Very hard to read.

[winkydink]

Not the content, the page itself.

Note to web page designers:
Dark characters, light background, sans serif fonts. Trust me. People way smarter than you and mr have already figured this out.

Re:Very hard to read.

[Paralizer]

I thought this as well. I flipped over to another virtual desktop, and to my surprise I saw weird horizontal lines that weren't really there. What was he thinking? sigh

Re:Very hard to read.

[jared_hanson]

People way smarter than you and mr have already figured this out.

Which isn't saying a whole lot, apparently.

Re:Very hard to read.

[Bishop]

The problem is that you have your contrast and brightness turned up too high. Probably because you needed to compenstate for the stupid defacto standard of black on white. Black text on a light background is perfect for paper. A monitor is not paper.

Re:Very hard to read.

[winkydink]

Which would explain why so many books use your format.

Re:Very hard to read.

[egarland]

sans serif fonts

Actually, there's no font defined on the page, it uses whatever font you told your browser to use (as web pages should!)

What's that? You never told your browser what font to use? Maybe you should just change the default to something that doesn't suck. Or maybe you should complain to whoever makes your browser that it's default sucks!

Re:Very hard to read.

[808140]

While I definitely prefer black text on a white background, I have to point out that you missed his point. A book does not have a backlight like a monitor/LCD screen does. It does not shine in your eyes. When a pixel is black, there is no light coming out of it -- as a result, a black background is probably better for your eyes.

However, better for your eyes does not mean more legible.

Interesting math

[bojanb]

since there will now be enough IPv6 addresses available for each person on the planet to have 10 of their very own.

Heh, only if there is an "unexpected explosive expansion" of the human race. Last I checked, IPv6 address space is more than enough for a loooooooooot of addresses per capita.

Oh, and I almost skipped the obligatory bashing - his first reference at the bottom of the article is Understanding IPv6 by Microsoft Press.

Switches?

[ImaLamer]

What about the bulbs? How can check to see if they are actually on? How will my switch...

oh forget it... just give me a few million addresses

Re:Switches?

[MyHair]

With webcams! Duh!

Guys got an error or two...

[Ironsides]

there will no longer be a need for IP address conservation since there will now be enough IPv6 addresses available for each person on the planet to have 10 of their very own.

Given that there are 128 bits for IPs in IPv6 this translates into 3.4*10^38 IP addresses. I think this comes out to roughly 5.6*10^28 IP addresses per person.

Re:Guys got an error or two...

[LanMan04]

Nitpick...5.32379*10^28 per person, assuming a world population of 6,391,727,078, which is the current world population estimate according to the US census bureau.

That means one address for each atom in a pile of carbon that weighs 2369 lbs! (88435 moles)

Re:Guys got an error or two...

[pinkocommie]

OR tin foil hat its a CONSPIRACY!!!! .
they want us to have 0.56*10^28 Kids per person O:-)

Re:Guys got an error or two...

[MyHair]

MIT, Apple and IBM are hoarding the rest.

Re:Guys got an error or two...

[mod_parent_down]

I remember when I first read about this, my friend sent me a quote from an MIT professor who was working on the IPv6 standard that was something like

"There seems to be an unspoken fear among the committee that there will only twice as many 64-bit addresses as there were 32-bit. 128 bits is absurd. That's 160 addresses for every square angstrom on the surface of the earth."

Re:Guys got an error or two...

[mod_parent_down]

Okay, found it. (Dumbass for replying to my own post, I know)

Steve Deering of Xerox PARC at an MIT Lecture:
"Many people thought that 64 bits for IPng addresses would not be enough. Some people seemed to think 64 bits could only hold numbers twice as large as today's 32 bits could, but mostly people were concerned there be enough address space for tomorrow's Internet toasters, wristwatches and automobiles. So we eventually settled on 128 bits, at which point no one had strong objections. It was then calculated that 2^128 was 1400 for every square angstrom on the surface of the Earth."

Re:Guys got an error or two...

[naelurec]

And for all the people who don't know how big an angstrom is.. apparently it is 1 hundred-millionth of a centimeter. A sheet of paper is 1,000,000 angstroms thick.

So lets calculate..

"Earth Surface Area: Land area, about 148,300,000 sq km, or about 30% of total surface area; water area, about 361,800,000 sq km, or about 70% of total surface area." -- Coble, Charles R; Murray, Elaine G; Rice, Dole R. Earth Science. Englewood Cliffs, NJ: Prentice-Hall, 1987: 102.

Total surface area of earth: 510,100,000 sq km = 5.10100 × 10^34 sq angstroms x 1400 IP addresses = 7.1414e+37 IP addresses.

IPv6 Space = 2^128 = 3.402823669209e+38 IP Addresses

It appears from my quick calculations that the professor was off. I get 6670 IP addresses per sq angstrom.

I guess the question ends up being ... why? Based on this calculation, a sheet of letter sized paper would receive 4.023508082e+22 IP addresses.. This ends up being the address space for 9,367,959,764,790 current IPv4 networks .. or in other words, every person, object and device in the entire earth could receive a unique, network addressable IP address and we would still not even come close to filling up even a fraction of the IP space in IPv6.

Seems like a case of getting a bit carried away .. yes?

Re:Guys got an error or two...

[HorsePunchKid]

Which comes out to roughly 5 IPv6 addresses for every atom in every human body in the entire world! (Source, look for the string "28".)

Only "10" IP addresses per person?

[Vexler]

I don't think so. Even if he discounts the bits in the addressing architecture responsible for routing and local/global flags and just focuses on the global unicast address space, that still gives you 64 bits (see Section 2.5.4 of RFC3513).

(2^64)/10000000000 = 1844674407.37 (approximately)

And that's assuming ten billion total world population. It's not just ten addresses; everyone can network his/her own cold-fusion-powered TOASTER to the Internet and we wouldn't run out of IP's anytime soon.

Re:Only "10" IP addresses per person?

[Brooks Davis]

For an amusing bit if trivia. The full 128-bit address space is remarkably close to a mol (6.02E23) per square meter of earth's surface.

Re:Only "10" IP addresses per person?

[Vexler]

You know, I came across something the other day that reminds me of this idea: That an NP-complete problem can have more number of possible solutions than the total number of atoms in the entire universe.

The implication is that, even if we were to use quantum computers to store states, there are problems out there whose scope will outclass even our very method for attempting to find a solution.

"P=NP?", by the way, is one of the seven millenium problems, along with the Poincare Conjecture most recently making the news, that are waiting to be solved.

Re:Only "10" IP addresses per person?

[kallisti]

That an NP-complete problem can have more number of possible solutions than the total number of atoms in the entire universe. The implication is that, even if we were to use quantum computers to store states

The whole point of quantum computing is to effectively store all the possible solutions in a small number of bits, then finding the best solution in P time (which is exactly what NP means "non-deterministic polynomial"). There are bigger classes of problems (P-space, Exp-time) which even quantum won't help with, though. Games tend to fall into this category.

you losers are still talking IPV6 ? get with it!

[Anonymous Coward]

Come on guys, theres this thing called IPV8.

get with the program!

augh!

Whatever happened to IPv5?

[waynegoode]

If you ever wondered what happened to IPv5, check here.

Now if we can just find out what happend to Netscape v5.

Re:Whatever happened to IPv5?

[kallisti]

Then we're headed for a disaster even bigger than Y2K, what happens when the 8 bit version field in IP rolls over? IPv256 will be indistinguishable from IPv0. It will be end of civilization!

IPv6 Multi-homing

[mplex]

Last time I looked at IPv6, it seemed there was no way to multi-home hosts to two or more ISPs. Of course, this capability is essential for IPv6 to succeed. BGP has scaled pretty well thus far, but it is impossible to support peering on IPv6 like it is done on today's internet due to the size of routing tables and it's heirarchical nature. Anyone familiar with this problem or know if any progress has been made?

Re:IPv6 Multi-homing

[Y2]

Last time I looked at IPv6, it seemed there was no way to multi-home hosts to two or more ISPs. [...] Anyone familiar with this problem or know if any progress has been made?

Sure there was. You either do the same as in IPv4 (announce the prefix to two providers, with all the breakage that entails), or you give the host two different addresses, one from each provider's space. "Then a miracle occurs" if you want failover of existing sessions in the case of one path dying.

Last time I looked at the IETF, they were giviing up on the miracle.

Re:IPv6 Multi-homing

[anticypher]

There's no problem getting a PI IPv6 block for your AS, and multi-homing it. I'm doing it, so its not rocket surgery. There's even a new internet draft for multi-homing devices like IPv6 cell phones.

Its almost but not quite the same thing as IPv4, you get an AS, you ask the RIPE(or your local RIR) for a /48 (or /32 if you have big plans or lots of customers), then negotiate with various IPv6 capable peering points. A little playing around with BGP4+, a lot of playing around with broken multicast support, and the next thing you know, you've got multi-homed IPv6. Its a nerd thing right now, although growing into the commercial world at a steady pace.

the AC

FrontPage

[Tonik, the]

Amusing... a article describing IPv6, an open standard, was created with Microsoft Frontpage 3.0. (Noticed this when changing the text colors from white-on-black to black-on-white.)

Re:Poor planning - Bill Gates

[Nom du Keyboard]

Hell, even Bill Gates didn't see it coming.

Of course he didn't. He always said, "640K IP addresses should be enough for anyone."

I am missing some detail

[wafflemonger]

I was under the impression that a 128 bit addressing scheme was enough to directly address every molecule in the Universe with some bits left over. Why then is IPv6 limited to 60 thousand million addresses? I understand that some addresses cannot be used because of multicast addresses and some other things like that, but what other sort of limits reduces the available range down to such a (relatively) small number?

Re:I am missing some detail

[Enigma_Man]

It's probably incorrect. I just calculated IP addresses per every atom in the earth, and there aren't enough in IPv6. I realize you said molecules and I said atoms, but... I'm only talking about the earth, and not the whole entire universe.

That information is very easily calculated with a quick google search and google calculation.

-Jesse

Re:ADD or ESL?

[Anonymous Coward]

I couldn't agree with you more. Sometimes it amazes me the stuff that get front page attention. Basicly the read a MS IPV6 book and wrote a summery and it makes front page.

Re:IPv6 will never happen

[leerpm]

It will take an act of god, government, or microsoft to force all ISPs, all web sites, and all Joe Users over to IPv6.

You mean like the DoD mandating that all its networks be moved over to IPv6 by 2008?

Doomsday...

[ARRRLovin]

The internet is getting too big! The only way to save it is by using IPv6!

I have a feeling this is going to be about as successful as getting the United States to convert to metric.

"She'll do 20 hectares on one tank of kerosene!"

I just read Slashdot for the articles!

[IntelliTubbie]

Playboy writes

Does that mean that everyone will pretend to read the article, but no one actually will? Come to think of it, maybe Slashdot should change its name to Playboy.

Cheers,
IT

Reserve Addresses?

[fgb]

Can you reserve addresses yet?

I want dead:beef:dead:beef:dead:beef:dead:beef

I had it all caps but the lame-ass lameness filter yelled at me ;-)

Re:Reserve Addresses?

[Kiryat Malachi]

It's gone.

Me, I want dead:beef:feed:face:dead:beef:feed:face.

Re:Reserve Addresses?

[cuyler]

If I were you I'd forward that address to the guys.

Re:Reserve Addresses?

[juliao]

Sorry, you can't use that. That's the address we use for network testing.

Re:Poor planning? BS. Poor Math? Certainly!

[Spinlock_1977]

I thought it amazing that the designers of IP carved out a 32-bit address rather than 16. When there was just a couple of universities on the internet, who woulda though 4 billion addresses would eventually be needed? But our author says with IP v6, we get enough addresses for every person on the planet to have 10 of their own. Let's see... 5 billion people, 10 addresses each... 50 billion? IP v6 only offers up 10 times the address space? I don't think so!

Re:IPv6 will never happen

[dotwaffle]

As far as I remember, IPv4 over IPv6 has to be in a wrapper, that is sorted out by a third party... Why was backwards compatibility put in so that ANY v4 IP can be reached with v6? Then more people are likely going to have it as MS update the TCP stacks through Windows Update etc... Or am I just rambling? (and whatever you say, most of the world DOES use Windows)

Re:Geez, ipv(ision)6ness

[Skiron]

'Ctrl a' helps a lot.

There is no shortage

[Wesley Felter]

Dozens of /8s are available; last time I checked it was about 40% of the total address space.

Re:There is no shortage

[Anonymous Coward]

There is no shortage because people have figured out ways to work around the fact that the address space is too small. That doesn't mean there isn't a problem.

Killer App Required

[Anonymous Coward]

IPv6 wont take off until there is a killer app that requires it. It really is that simple.

Re:Killer App Required

[betamaxV2.1]

This is kind of relavant. I was watching 60 minutes the other evening when they did a spot on the porn industry. The porno biz has been a first or almost first adoptor of lots and lots of technologies in the past. VCR, mpeg codec, streaming video, secure internet sites, purchasing products/services over the internet.

Re:Killer App Required

[Y2]

IPv6 wont take off until there is a killer app that requires it. It really is that simple.

There is one.

It's called, "Building any sizable network outside North America."

It is really that simple.

Dizzy @.@

[Spy der Mann]

Man... that thing has WORSE colors than /. !!! Can I hack their website and reface it? Pleeeease??? O:)

Re:Not a bad start...but a couple of things on IPv

[liam193]

Actually some of those issues are covered in IPv6. There is a new address type called an any-cast address. The idea, which will be interesting to see how it's implimented, is that all DNS servers will use an single any-cast address. The routers will somehow be told that this any-cast exists on this particular machine. When someone needs a DNS lookup they will use the hard-code any-cast address for DNS that everyone else in the world uses; however, instead of everyone hitting the same machine, they will hit the "closest" machine with that any-cast address. The same can be true for NTP, etc. Basically these are services that do not require that you have any particular device, just one of any of the ones in the world... preferably the closest or least busy.

Re:IPv6 will never happen

[Tony Hoyle]

No, 6to4 is really that bad - it relies on custom tunnels and special ISP support rather than just specifying it on the routers.

I've played with ipv6 in the past, but after so many years it's still a very long way from useful. Since nobody has ipv6 machines and you need ISP support (which ISPs don't provide) putting up an ipv6 website is a sure-fire way to get zero hits.

It doesn't help that proxies eg. squid don't support it yet.. the project to do it (http://devel.squid-cache.org/ipv6) has been dead since 2001.

Distro-specific introduction

[jgarzik]

Setting up IPv6 is actually quite easy these days.

For Fedora Core users stuck without a direct IPv6 connection (read: most of the world), I wrote a quick IPv6 6to4 setup guide.

6to4 is "automatical tunnelling", which in layman's terms means you don't have to bother your ISP or a tunnel broker in order to set up IPv6 on your network. Most OS's these days (not only Linux but *BSD and Windows) fully support basic IPv6, including 6to4.

Re:IPv6 by 2008? Who's he kidding?

[farnz]

I'm not connected to Internet 2, so I can't comment on what it uses, but if it's exclusively IPv6, how come its website is pure IPv4?

Poorly written

[JAgostoni]

Not that I can really do that much better but if you are "publishing" your paper on IPV6 on the Internet you might want to get someone to edit it for you. There are many many errors in that paper that would not pass a high scool writting course.

I didn't mind the content, however.

The only bad thing about switching to IPv6 ..

[pentium69]

... is it isn't fully tested in a real world environment. We honestly don't know what will happen once the entire internet begins talking in IPv6. It may make the transition seamlessly, or it may fall flat on its face. There is also the other problem of legacy support.

Slashdot poll anyone?

It's already out there EVERYWHERE...

[Olmy's Jart]

IPv6 is already deployed and it's available and reachable anywhere IPv4 is available. You can use 6to4 and start accessing it immediately without asking anyone's permission. Works over the cable modems, the broadband providers, and 3G cellular networks, everything. No special support required. You can even run servers on it and the clueless providers who are blocking access to ports on IPv4 have no idea of what's happening on IPv6, even tunneled on IPv4 (which is really just a header encapsulation to provide transport).

Check the IANA and RIR allocation tables. There are more IPv6 networks allocated to the ISPs and LIRs than IPv4. Check the BGP tables. Last I looked (couple of months ago) there are over 40 million IPv6 networks (not even counting RIPE's insane route for an entire /20) routable to the ISP level right now (and only takes about 400 routes compared to IPv4 with 130,000 routes routing far fewer networks).

Sitting around LinuxWorld Expo SF a month ago, I was sniffing live IPv6 traffic on the wireless lans in the session rooms. I could access global IPv6 from anywhere. From public IPv4 space or private IPv4 space. If a router was advertising, I didn't even NEED IPv4 space or addresses.

I have yet to find anywhere on IPv4 where my global IPv6 connectivity was not available to me and I've had several instances where IPv4 was "unavailable" (DNS or DHCP brain farts) and yet all my IPv6 was operational.

IPv6 doesn't depend on IPv4 "going away" and has coexisted with IPv4 for years and will coexist with IPv4 for years to come.

Wait until the peer to peer crowd learns what they can do with "Privacy Enhanced Addresses" that change dynamically and are not tracked (like dhcp or ppp addresses are).

Several major government agencies are already using IPv6 backbones and tunneling islands of IPv4 across IPv6.

There are enough IPv6 networks in production that TOTD (the Trick Or Treat Daemon) actually shows up in a survey of DNS servers with a significant percentage. TOTD is used for IPv6-ONLY networks to shim the DNS requests and translate "A" record responses into "AAAA" records which the IPv6 only hosts can use. It's not needed if systems have direct access to IPv4 and is an indication of systems and networks which have to use protocol translators like NAT-PT or pTRTd.

Wake up! IPv6 arrived years ago and is likely already on your LANs (you just don't know it or control it...). You watch for IP protocol 41? You monitor 3544/udp? Check your PPP connections for IPv6 endpoints? How 'bout dem tunnels??? :-) They don't all work everywhere but everywhere has something and several that work, and work well.

Re:It's already out there EVERYWHERE...

[Olmy's Jart]

Best web site to start... IPv6 Style: http://www.ipv6style.jp

Best book I've found so far, O'Reilly (of course) IPv6 Essentials.

IPv6 for Linux, DeepSpace6: http://www.deepspace6.net (May be slow at times, be patient).

Another good site: HS247: http://www.hs247.net

Lot's of links from those to many other fine sites.

Re:IPv6 by 2008? Who's he kidding?

[Elwood P Dowd]

Internet 2 uses it exclusively.

Boy, are you wrong.

WRONG.

(Just that sentence, of course. The rest of your post is right.)

Wrongity-wrong-wrong-wrong.

Re:IPv6 will never happen

[jgarzik]

No, 6to4 is really that bad - it relies on custom tunnels and special ISP support rather than just specifying it on the routers.

Actually 6to4 Just Works(tm) in most cases. You can't get much easier than that. That is the purpose of 6to4: the special anycast prefix guarantees that you do not need special configuration or special ISP support.

I've played with ipv6 in the past, but after so many years it's still a very long way from useful. Since nobody has ipv6 machines and you need ISP support (which ISPs don't provide) putting up an ipv6 website is a sure-fire way to get zero hits.

Putting up an IPv6-only website would be pointless. The idea is for IPv6 transition to be seamless: a web server admin adds IPv6 to an existing website, and nobody except the IPv6 users will notice a difference.

My own website supports IPv6, and it gets a few hits daily from IPv6 users. It also supports IPv4, of course. And neither set of users ever need know, or care, about my web server setup. It Just Works(tm), and will continue Just Working as the world moves to IPv6.

It doesn't help that proxies eg. squid don't support it yet..

Apache does proxy caching and http acceleration quite nicely, and has stable IPv6 support.

I agree that squid lags behind, but overall you picked a poor example. Most of the core Internet software, both client and server, either has production-stable IPv6 support, or is close to it.

Re:Not a bad start...but a couple of things on IPv

[pete-classic]

The grandparent said, "There is exists a problem [. . .]"

He also covers his bases on the whole "verb" thing.

-Peter

Article is from Microsoft Press

[Jack9]

I would think the editors would have at least posted a warning in the pre-blurb.

Re:Article is from Microsoft Press

[azaris]

No, it's not.

References:
Understanding IPv6 by Microsoft Press

Do you understand the concept of 'reference' in a technical or scientific article? Or maybe you think the editors should have added the standard /. "I heard Microsoft might have something to do with this so it must be crap" disclaimer?

Re:serve Addresses?

[DrStrangeLoop]

Can you reserve addresses yet?

I want FEED:FACE:FEED:FACE:FEED:FACE:FEED:FACE

I have it all caps so the lame-ass lameness filter ignored me ;-)

Re:Not a bad start...but a couple of things on IPv

[Just Some Guy]

IPv6 autoconfiguration will get you an address to get onto the net at large

Almost. I got a /64 from Hurricane Electric into my FreeBSD firewall/router. The problem is that I have three distinct subnets from that router:

1. My LAN
2. A DMZ
3. My WLAN

Autoconfig seems to require a /64 or larger netblock, but each of those segments necessarily has to be smaller than the /64 I was given. Even if I only used two bits to identify each local subnet, the resulting /66s would be too small for autoconfig to work.

So, I'm stuck with using DHCP6 or static configuration to assign IPv6 addresses at hope. I wish you could universally say that IPv6 autoconfiguration works, but there are some relatively common circumstances that give it fits.

So very wrong, it's not funny

[johne_ganz]

Another positive outcome of IPv6 will be better internet routing using QoS, Quality of Service, which routes packets based on priority.

What? There is nothing in IPv6 about this. You can do this right now, today, with IPv4 by having a flexible queueing methodology and flexible packet pattern matching systems. Violla. Any packet destined to network 1.2.0.0/16 that is TCP and port 80 no gets dumped in the high priority queue.

QoS is also the perfect snake oil. In a practical sense, QoS only "kicks in" when there's contention, when there's more data that needs to squeeze in to the pipe than can fit. QoS makes the choice of which packet gets to go over all the other packets waiting to go.

In other words, the only time QoS is of any good is when you are on a over subscribed, saturated network, where there isn't enough bandwidth available to meet demand. In simple terms, the network is broken, and QoS just helps pick who gets screwed the least.

Lastly, routing will be simplified because the IPv6 information header on each packet is far more flexible and can contain more detailed information than an IPv4 header thus allowing for faster routing of data across a network or the internet. Currently, most routers need to maintain as many as 48,000 different routes in their routing tables just to effectively route data that passes through them. IPv6 reduces this number by at least 75%.

This, too, is just flat out wrong. The only way this works is if you have a "clean slate" and parcel out IP addresses in a country/provider hierarchal fashion. Want to move providers? You get new IP's, out of their block. Want to multi home? Well, that kinda blows the efficiency right out of the water because now your network is no longer contained within the providers supernet, you have to announce your individual network both via your provider and where ever else you're peered. Therefore, you just added networks to the global routing tables.

Now, quick show of hands... how many of you want to run your systems off a single homed, single provider only network? And please, none of this god awful "let the router pick which source IP to use!" crap.

Also, if you're worried about IPv6 requiring you to change all of your software, learn new protocols, new methods of connecting, new ways of sending and receiving data or anything like that, fear not. The only thing really changing with IPv6 over what was in IPv4 is that you now have a larger address space which allows for more network addressable IP addresses, a more flexible header and packet system, and faster routing.

Yea, you don't have to change a thing. Not any of your software, or nothin'. Of course, you do need a whole new IP stack to talk IPv6, but that's pretty minor right? Windows folks can make this change by simply cracking open their registries and changing the IP Version key from 4 to 6. Ta da!

Faster routing? How's that? Does it make sense to anyone that looking up a 128 bit address is going to be faster than looking up a 32 bit address? There's more to look up.

Furthermore, all routers worth their salt use hardware accelerated forwarding engines these days. Modern BiCAM's or (nearly always) TCAM's can do single cycle lookup of an address out of a potential 512K entries. It doesn't matter how many entries there are, it can always do find the correct match in a single cycle. And 512K entries is a bit more than a default free routing table (~140K entries) that's common today, so there's no worries there.

The catch is, most of these hardware lookup engines are hard wired for IPv4, and can't easily be extended to IPv6, which means the packets become exception packets and need to be dealt with by the CPU. The CPU lookups are orders of magnitude slower than the hardware lookups. This means that performance for IPv6 goes right through the floor for most routers. Newer routers/blades are starting to come with IPv6 hardware accelerated, but there's an awful lot of infrastructure out there that has no IPv6 hardware acceleration.

Therefore, for most people, IPv6 will initially result in a signfigicant performance drop in terms of packets per second over IPv4.

Re:So very wrong, it's not funny

[Y2]

Lastly, routing will be simplified because the IPv6 information header on each packet is far more flexible and can contain more detailed information than an IPv4 header .... Currently, most routers need to maintain as many as 48,000 different routes in their routing tables just to effectively route data that passes through them. IPv6 reduces this number by at least 75%.

This, too, is just flat out wrong. The only way this works is if you have a "clean slate" and parcel out IP addresses in a country/provider hierarchal fashion.

No, it's pretty much right. It would be perfectly right if it said "can reduce." IPv6 did have a clean slate, and has room for multiple levels of hierarchy aboce the site level.

Want to move providers? You get new IP's, out of their block.

Exactly. And autoconfiguration and router renumbering go part of the way to solving your prefix-change problem. (Yes, there's still more to do.)

Now, quick show of hands... how many of you want to run your systems off a single homed, single provider only network?

At home, sure. At work, I've got my own AS number. OK, so I'm a bad example for this point.

Yea, you don't have to change a thing. Not any of your software, or nothin'. Of course, you do need a whole new IP stack to talk IPv6, but that's pretty minor right? Windows folks can make this change by simply cracking open their registries and changing the IP Version key from 4 to 6. Ta da!

No need to work that hard. It's already in Windows. Yes, some apps may have been written with IPv4 dependencies. Just as some may have been written with US-ASCII dependencies. That doesn't mean it isn't high time to make some revisions if the whole world is going to play.

Faster routing? How's that? Does it make sense to anyone that looking up a 128 bit address is going to be faster than looking up a 32 bit address? There's more to look up.

Oh for crying out loud, take out a loan and put a down payment on a clue!

Furthermore, all routers worth their salt use hardware accelerated forwarding engines these days. [...] The catch is, most of these hardware lookup engines are hard wired for IPv4, and can't easily be extended to IPv6,

And the depreciation period on these routers is what, 3 years?

Re:So very wrong, it's not funny

[halbert]

Good Title.

Another positive outcome of IPv6 will be better internet routing using QoS, Quality of Service, which routes packets based on priority. What? There is nothing in IPv6 about this.

Actually, there is.

Read RFC 2460 - Internet Protocol, Version 6 (IPv6) Specification

Here is an apropo excerpt:

Flow Labeling Capability

A new capability is added to enable the labeling of packets
belonging to particular traffic "flows" for which the sender
requests special handling, such as non-default quality of
service or "real-time" service.

As for the purpose of this capability, think VOIP, streaming video, stock quotes or other "real-time" applications.

Faster routing? How's that? Does it make sense to anyone that looking up a 128 bit address is going to be faster than looking up a 32 bit address? There's more to look up.

How is that, you ask. Read RFC's 2460, 2402, and 2406, and you will see that one of the reasons is because of the way IPv6 handles extension headers and because of the way the IPv6 packet is designed with speed in mind. After all, with all of the atoms in the universe vying for a router's time, we have to make it speedy, yes?

Also, for your homework assignment, class, please read RFC 2461 - Neighbor Discovery for IP Version 6 (IPv6)

Class dismissed ;-)

Re:So very wrong, it's not funny

[dave420]

You misunderstand QoS slightly, or at least haven't thought of this scenario: You are on your LAN, and you want to shift data from one machine to another, saturating the network. You don't mind, as you just want the fastest speeds available so your dinner doesn't get cold. But then you want to make a VoIP call, when QoS kicks in. Instead of your VoIP call vying for bandwidth from your pr0n transfer, it will get the necessary bandwidth allocated to it. Far from being broken, the network is being used at its fullest speed, which is what anyone copying large amounts of stuff over a private network will want :)

what's all the hubbub, bub?

[mcmonkey]

Doesn't every device on the net already have a unique (unless customized otherwise) address? Can't we use MAC addresses?

Re:what's all the hubbub, bub?

[andfarm]

MAC addresses aren't guaranteed to be unique, and they're useless for routing. You can look at the IP address on a packet - whether IPv4 or v6 - and quickly tell where it should go next. You can't do the same with MAC addresses, though: routers would have to keep a table of every single MAC address on the Net (!!) to route packets properly.

um... hectares is a measure of area.

[Run4yourlives]

distance would be in kilometers.

Re:um... hectares is a measure of area.

[John Hasler]

Yes. Land is measured in hectares. As in "She'll plow 20 hectares on one liter of kerosene!" (not bloody likely)

IPv6 vs. the floppy

[still cynical]

We've been told for years that IPv6 is coming and the floppy is dead. Told right here on Slashdot. Which one is common now? Want to bet on which one will be more common in 3 years?

Re:Not a bad start...but a couple of things on IPv

[Y2]

Almost. I got a /64 from Hurricane Electric ...

Damn. We tried to make it unmistakably explicit that every customer, from single cell phone on up to a university, would get at least a /48 allocation. (Although that allocation might be dynamic.)

Want to revive draft-thaler-ipngwg-multilink-subnets?

Re:you losers are still talking IPV6 ? get with it

[Kourino]

I'm still stuck on IPv7. You know, the one that lets you upload your brain onto the global network.

Mm, Lain.

Re:Poor planning? BS.

[Y2]

I thought it amazing that the designers of IP carved out a 32-bit address rather than 16. When there was just a couple of universities on the internet, who woulda though 4 billion addresses would eventually be needed?

Recall that they were superseding NCP, which used 8-bit addresses, and were building a network on which multiple hosts attached to a given router. Two bytes might handle that much, but local networks were popping up also. Four bytes seemed plenty, but it was not exactly prescient.

Re:IPv6 by 2008? Who's he kidding?

[stripyd]

Every major TCP/IP stack out there supports IPv6.

Support in the network stack doesn't necessarily mean the utilities you want to use support it. Solaris is very v6 clean: I guess corporate coding style dictates not checking address family of a passed socket is a bug.

The story with GNU/Linux last time I looked (RedHat AS 2.1, last year) was way patchier, with a worrying number of things one might expect [x]inetd to exec simply assuming they were being passed an AF_INET (ie v4) socket. Yes the major stuff is sorted but more stuff than you might think isn't.

Artificial scarcity

[j1m 5n0w]

The current network providers have little incentive to move to IPv6 because they make money through the artificial scarcity of IP addresses. They like the current situation because they have an advantage - new ISPs have trouble entering the market due to the lack of large contiguous IP blocks. When we start falling behind the rest of the world (since countries without enough IPs to go around have no reason to stick with IPv4), maybe they'll start switching to IPv6.

NAT is a solution, and it may be usefull in IPv6 networks as well as IPv4 for security reasons, but it shouldn't be forced on people (it interferes with the end-to-end philosophy of the internet). Also, not all countries have enough IPs for a one NAT per household policy.

-jim

Re:Artificial scarcity

[Y2]

NAT is a solution, and it may be usefull in IPv6 networks as well as IPv4 for security reasons, ...

NAT is not security

NAT is not security

NAT is not security

Imagine two boxes which pass certain packets and drop others. Suppose they pass exactly the same packets, but box #1 fiddles with the IP addresses on packets it passes.

How is use of box #1, the NAT, more secure than using box #2?

Re:Artificial scarcity

[j1m 5n0w]

You can't send a packet to a box behind a NAT unless it's part of a connection initiated by the machine behind the NAT. This makes it immune to all sorts of potential attacks from outside machines. NATs don't fix browser bugs or email worms, but they do prevent quite a few remote exploits.

-jim

Re:Artificial scarcity

[Y2]

You can't send a packet to a box behind a NAT unless it's part of a connection initiated by the machine behind the NAT. This makes it immune to all sorts of potential attacks from outside machines. NATs don't fix browser bugs or email worms, but they do prevent quite a few remote exploits.

And I can say the very same words about a firewall which does not munge the addresses.

!Firewall sí, NAT no!

(Where's the damned ¡ ?)

Re:Artificial scarcity

[asdfghjklqwertyuiop]

You can't send a packet to a box behind a NAT unless it's part of a connection initiated by the machine behind the NAT.

Wrong. You can send all the packets you want to a machine behind a NAT router if the routing on the outside is set up right.

It is a firewall which only allows packets related to connections that were established by something on the inside. A firewall is what you are thinking of. As has been said many many times before, NAT has abosolutely nothing to do with security.

Re:Artificial scarcity

[j1m 5n0w]

Wrong. You can send all the packets you want to a machine behind a NAT router if the routing on the outside is set up right.

Maybe if you set up port forwarding, or you're using a broken NAT that uses a static table rather than full IP masquerade. Nothing behind the NAT has a globally routable IP address, so there's no way to send anything to it unless the NAT is configured to forward packets sent on a particular port, which it shouldn't do unless port forwarding is configured on that port or an internal machine has transmitted a packet to the outside world and the NAT remembered it's source port and internal IP so it can rewrite incoming reply packets.

As has been said many many times before, NAT has abosolutely nothing to do with security.

If it's been said that many times, would it be that hard to cite a reference?

Re:Artificial scarcity

[asdfghjklqwertyuiop]

Maybe if you set up port forwarding, or you're using a broken NAT that uses a static table rather than full IP masquerade.

Nope. A proberly functioning NAT only translates packets that it was specificly instructed to (new outbound in this case). Packets that you didn't tell it to translate get passed right along untranslated. It doesn't block anything.

Nothing behind the NAT has a globally routable IP address,

It may not be "globally" routable - but that doesn't mean it isn't routable by people you don't want in your network. For instance, If I disable firewall rules on my router leaving only NAT, I can go to my neighbors (who has the same broadband ISP and is on the same logical ethernet), add a route to my private network via my router's public IP address and the packets will come right in. If someone has access to your ISP's routers, they can make traffic to your private network routable to the entire ISP and all the ISP's customers. And then there's loose source routing. And spoofed internal source addresses... all kinds of things you may be vulnerable if you're using NAT without a firewall. And yes, this is with masquerade and no port forwardings.

so there's no way to send anything to it unless the NAT is configured to forward packets sent on a particular port, which it shouldn't do unless port forwarding is configured on that port or an internal machine has transmitted a packet to the outside world and the NAT remembered it's source port and internal IP so it can rewrite incoming reply packets.

If a forward isn't set up for a certain type of traffic, all that means is that NAT won't translate that packet. It doesn't mean it gets dropped. It will just get passed along untranslated unless firewall rules block it.

Re:Artificial scarcity

[asdfghjklqwertyuiop]

And BTW:

If it's been said that many times, would it be that hard to cite a reference?

Sure, every slashdot story about IPv6. Every time such a story comes up, a bunch of people talk about how NAT solves all their problems and provides them with nice security, and then other people come along and inform them that NAT != security.

Re:Artificial scarcity

[j1m 5n0w]

If a forward isn't set up for a certain type of traffic, all that means is that NAT won't translate that packet. It doesn't mean it gets dropped. It will just get passed along untranslated unless firewall rules block it.

That's a bug, not a feature. If a NAT receives an IP packet from outside that's addressed to it's internal, unroutable network it should drop it on the floor (if it's not already filtered by your ISP). Perhaps not all NATs work that way, but it's not hard to imagine one that works correctly. If such a device no longer fits your definition of NAT, you should think about expanding your definition.

-jim

Re:Artificial scarcity

[asdfghjklqwertyuiop]

That's a bug, not a feature. If a NAT receives an IP packet from outside that's addressed to it's internal, unroutable network it should drop it on the floor (if it's not already filtered by your ISP). Perhaps not all NATs work that way, but it's not hard to imagine one that works correctly. If such a device no longer fits your definition of NAT, you should think about expanding your definition.

It isn't MY definition of NAT that such a device wouldn't fit. It wouldn't fit ANY definition of NAT. See RFCs 1631 and 2663 - the standards that define NAT. Nothing in them specifies dropping packets.

Can you name any implementation of NAT which drops packets like this? I can tell you Cisco's doesn't and Linux's doesn't. I don't know of any that does. And they shouldn't either. Deciding what packets to drop and what packets to pass isn't NAT's job.

"Security will now be native..."

[skooba]

Security will now be native in IPv6, not an additional feature such as it appears in IPv4.

the article failed to explain how security is improved by ipv6. anyone care to enlighten us, please?

Re:"Security will now be native..."

[Wesley Felter]

IPv6 doesn't improve security; this is a common myth. (IPSec is "mandatory" in IPv6, but it's not mandatory for you to actually use it. And "mandatory" doesn't mean much since the IETF has no enforcement power.)

What then?

[JSBiff]

Ok, I can understand the concept of 6 to 4. Sounds good, but unless I and everyone I want to interact with are running 6 to 4, I still have to fall back to IPv4, I suppose. Or, in more concrete terms. If I want to setup a teamspeak or roger wilco server, anyone who wants to connect is gonna have to setup 6to4. If I want to run a game server, likewise. This does present some problems, as not everyone I interact with is enough of a geek to get it working.

But, I am interested still. I assume to use 6to4, you have to have some sort of upstream IPv6 ISP to connect to. That is, if I'm tunnelling IPv6 over the internet, I've got to be tunnelling TO an IPv6 gateway/router somewhere. Are there any free gateways? Is there a list somewhere of free gateways?

Re:What then?

[nsayer]

6to4 is completely autonomous. Because it encodes the IPv4 address of your 6to4 router in your prefix, everyone knows how to get the packets back to you. The only thing that needs to be configured is a default route for reaching non-6to4 destinations. Fortunately, you can simply use 2002:40a8:47d1:: and let RFC 3068 do the work for you. :-)

So there's no reason that anyone can't start using 6to4 immediately, unless they totally lack a public IPv4 address.

Re:What then?

[nsayer]

Whoops! The correct 6to4 default route is 2002:c058:6301::

Little extra wrinkle

[riptalon]

There is one small thing that the the article leaves out; where the 64-bit "Interface ID" that is the second half of the address will come from. It isn't going to be some essentially random number assigned to that computer as it is for IPv4 (e.g *.001, *.027, *.145). The first 64 bits of the IPv6 address is routing information to get you to the right subnet, like the first 24 bits in IPv4 (e.g. 145.67.56.*). But unlike IPv4, that has only 8 bits left to identify the particular machine on the subnet, IPv6 has 64 bits available.

This vastly larger space doesn't just allow for larger subnets, it is so big that it allows the values to unique, not just on the subnet but globally. So how are these unique values to be chosen? From the unique IDs embedded in the NIC hardware of course (i.e. your ethernet cards MAC address or the EUI-64 standard that will eventually replace it). So the two halves of the IPv6 address will contain routing information (where you are) and a unique ID (irespective of where you are).

As wireless becomes more unbiquitous in the future, using IPv4 addresses to track people will get more difficult. IPv6 provides the solution. As someone connects with a wireless device at different locations only the first 64 bits of routing information will change, the second 64 bits, the unique ID will stay the same. Who you are (or at least what NIC you are using) and where you are is plastered one every IPv6 packet you send.

Re:Little extra wrinkle

[Tim the Gecko]

People have recognised this problem (track by last 64 bits) and the solution is to generate random temporary addresses and use them instead - http://www.faqs.org/rfcs/rfc3041.html

Re:Little extra wrinkle

[riptalon]

Clearly that would be a solution, but only if ISPs etc. allow it. The IPv6 protocol has the potential to allow everyone's internet usage to be tracked much more easily than IPv4. Obviously ISPs, governments etc. could be nice and allow the "Interface IDs" to be randomly selected at every connection, but how likely is that in the present climate.

Re:Little extra wrinkle

[riptalon]

The Interface ID does have a purpose, it can't just be anything. It is the equivalent of the last byte in the present IPv4 address (e.g. *.001, *.047 etc.) and the ISP will need to know it in order to route packets to the correct computer on the subnet. Either the ISP has to assign it at connection time (i.e. DHCP) or the connecting computer has to tell the ISP what is at connection time (i.e. the inverse of DHCP). The ISP has control and can be choose what method to use and whether to be nice or not.

Unless, NIC manufacturers decide to "hard code" the selection of the Interface ID into the cards firmware and force it to always be the MAC address or EUI-64. In this case even the ISP doesn't get a choice. This senario is probably the most likely since the card manufacturers and ISPs probably don't care how the Interface IDs are choosen (provided there is a fixed system to follow) but there will be a lot external pressure (and perhaps even legislation) from governments, RIAA, MPAA etc. to go this route.

Only 10 numbers?

[6Yankee]

(haven't there been studies that say 7-10 numbers in a row is about all we can remember?)

I'd love to see how they arrived at that conclusion. Seven to ten numbers? Remembering a phone number taxes us to the limit?

I carry my Visa numbers (16 digits) around in my head, as well as my 19-digit Switch number. I don't consider myself to have any particular ability in this regard, and I know others who can do it. Unfortunately for my balances, I can also recall at will the expiry dates, issue number (for the Switch card) and the 3-digit code on the back that is meant to prove you have the card in your hand. This means I can lock the cards away, even cut the bastards up, and still go nuts on Ebay, I mean, ThinkGeek. :(

I can't recall pi to a gazillion decimal places though.

Re:Only 10 numbers?

[covertbadger]

7-10 numbers is generally regarded as short-term memory capacity. If I tell you a 7-digit phone number you'd probably be able to recite it back to me immediately; if I tell you a 16-digit credit card number you probably couldn't. You can remember your card number because you've committed it to long-term memory.

Some errors, I believe

[nsayer]

The implication in the discussion of TLA, NLA and SLA imply that customers will be getting /64s. Unless things have changed since last I checked, customers will actually be getting /48s. That is, the NLA represents both the retail ISP and the customer, and the SLA is 16 bits of subnet that the customer can use to subdivide their network. Each subnet will be a /64, which fits in with the automatic negotiation of suffixes for most hosts (take your EIN-48, aka your Ethernet address, xor the top byte with 2 and stick FFFE in the middle - 8:0:20:AA:BB:CC -> a00:20ff:feaa:bbcc).

This article misses on an opportunity to discuss 6to4, which is a way that anyone with a single static IPv4 address (actually, it doesn't have to be static, but if it is dynamic, then your IPv6 prefix will change whenever it does) can have their own IPv6 /48 today. In fact, it saddens me a bit that Netgear and those bozos haven't made IPv6 support at the very least optional in their little NAT router boxen. Any device that is an IPv4 NAT is in an excellent position to provide IPv6 connectivity (and, of course, firewalling) with 6to4.

Warning: Self Link

[GeorgeH]

I thought about how to jump start IPv6 a while ago and wrote How the Internet is broken, how to fix it, and why that's not going to happen. I figured I'd link to it again because it got a lot of good feedback last time I posted it.

The basic idea is to create islands of IPv6 by having consumer routers tunnel IPv6 over IPv4. This would prime the pump for IPv6 applications, which would create demand for IPv6 ISPs.

It turns out Microsoft came up with something similar, so now I'm trying to figure out what's wrong with my approach :)

Re:you losers are still talking IPV6 ? get with it

[perlmonk007]

IPv7 ???? Man your lucky, I am still on IPv386

Re:IPv6 by 2008? Who's he kidding?

[Hiro2k]

Hmm you must not have read the post above yours. All those things are hacks, but they are not very friendly solutions. IPv6 can change all that by giving each machine all the ports it needs. If you have 1 IP address you can only have 1 port 80 on your internal network. So that means you would have to purchase more IP's or change a lot of configurations to have multiple webservers in your network. Me and my brother like to use the same P2P applications, but I have to configure each of our machines to use a differnt port on the firewall. With IPv6 I wouldn't have to change the ports.

Those are easy examples, but imagine how much time you would spend if you had 30 or more machines with individual ports to configure. It can get out of hand keeping track of which computer has which port. And adding that many rules into the firewall will take a while. Now with each computer having it's own IP you can have one rule that allows traffic on that port to go through your firewall and all the computers on the network would recieve the packets that are destined for thier IP.

Re:Not a bad start...but a couple of things on IPv

[asimulator]

The author probably means that more (IPv6) addresses means less pressure to "conserve" them, so no need for DHCP - every host can get a statically assigned address.

There's no denying though, the other things DHCP can help with.

PAT?

[asdfghjklqwertyuiop]

I'm pretty sure we are actually talking about PAT (Port Address Translation) and not one-to-one IP translations. PAT is stateful by nature and disallows any inbound traffic that isn't associated with an outbound connection. Whether you like it or not, it does offer protection that would otherwise require a firewall.

I guess that's what we're talking about. Everytime I've ever used it it was called NAT, and yes what I am thinking of is stateful by nature. It keeps track of translated outbound connections and watches for the return traffic, and if it matches it translates them back again. But the point is it doesn't have any effect on incoming traffic which is not in its table of translated connections. So if I try to establish a connection out of the blue to a computer on the inside of your network while your router is doing NAT only, your router will just happily pass my packet along, un-munged, to my target machine.

Now your router might say, block everything by default, allow outbound traffic and keep track of outbound connections and only allow replies back in, but that is a basic stateful firewall, not NAT (or PAT).

Re:PAT?

[misleb]

Now your router might say, block everything by default, allow outbound traffic and keep track of outbound connections and only allow replies back in, but that is a basic stateful firewall, not NAT (or PAT).

I was under the impression that most common NAT/PAT implementations (such as a broadband router) besides Cisco IOS did block inbound packets that weren't associated with outbound connections. But I should really test it myself.

-matthew

Re:PAT?

[asdfghjklqwertyuiop]

I was under the impression that most common NAT/PAT implementations (such as a broadband router) besides Cisco IOS did block inbound packets that weren't associated with outbound connections. But I should really test it myself.

Linux's does not block packets if you only tell it to do NAT, I just tested it myself. And most of those broadband router boxes are doing much more than only NAT. In fact in my experience, you can't make them only do NAT and not any kind of filtering.

Re:PAT?

[fyonn]

was under the impression that most common NAT/PAT implementations (such as a broadband router) besides Cisco IOS did block inbound packets that weren't associated with outbound connections. But I should really test it myself.

then surely it's being a firewall? :)

the GP was both right and wrong though. in the situation where you have a router directly between A and B doing PAT of A addresses towards B, then B can still access A by using it's unnatted addresses and the router will pass those packets straight along. this involves knowing what those addresses are, and routing that network to the router.

this is where this fallls down on the internet. if my dsl router acted as the router above does then I am still by and large safe. the attacker can make a good guess at what my internal ip addresses are (or brute force) but how does he route those packets towards my router, the half dozen other routers between my attacker and I will swallow those rogue packets.

nat is still a horrid hack that should be binned though :)

Re:PAT?

[asdfghjklqwertyuiop]

this is where this fallls down on the internet. if my dsl router acted as the router above does then I am still by and large safe. the attacker can make a good guess at what my internal ip addresses are (or brute force) but how does he route those packets towards my router, the half dozen other routers between my attacker and I will swallow those rogue packets.

In most broadband connections, people in the same physical area appear to be on one big ethernet with you. If you turn off your firewall, those people can easily route packets past your router since there are no other routers between you and them.

And in the larger picture, you're putting the security of your network entirely in the hands of your ISP. Is that really a good idea? :)

Re:PAT?

[fyonn]

In most broadband connections, people in the same physical area appear to be on one big ethernet with you. If you turn off your firewall, those people can easily route packets past your router since there are no other routers between you and them.

that's a cable thing though isn't it? rather than a dsl thing? well, I suppose I can't speak for the states, but in the UK, (almost) all dsl connections are logically tunneled from the local dslams to a router at your isp (across BT's network) and thus you always have a router outside your control between you and your "neighbours".

And in the larger picture, you're putting the security of your network entirely in the hands of your ISP. Is that really a good idea? :)

well, of course not, and I have a proper openbsd firewall protecting me cos I'm not silly :) however I was just trying to say that while nat concerns are perfectly true, in the UK at least, nat still provides an amount of protection as no-one can route private networks to you as you have to go through other routers outside your control which will drop the packets, or at least route them eslewhere. I wasn't thinking about cable, or possible situations in the states I admit, but I don't really know those situations so maybe my comment was a bit "specialist"

dave

Re:PAT?

[asdfghjklqwertyuiop]

In most broadband connections, people in the same physical area appear to be on one big ethernet with you.

that's a cable thing though isn't it? rather than a dsl thing?

Both. Cable and DSL connections, from the standpoint of your equipment, looks and works like one giant regular ethernet covering the whole area. My router plugs into my cable modem via regular ethernet. The cable modem kind of functions like an ethernet bridge. And on the other side it appears like everything gets unbridged and plugs into one ethernet switch, and one of those devices is the cable/dsl company's router connecting us all to the internet.

Now that isn't how it really works at the lower level - there's more equipment involved and there is really a physical ethernet switch. But from the standpoint of me and the potential attackers, it just looks and works like we are all plugged into one ethernet switch.

firewall+NAT in one

[asdfghjklqwertyuiop]

Right, but NAT in a practical sense (i.e. a Linksys router - the "NAT" that 99.9% of the public is talking about) is effectively a stateful firewall - for every packet coming in from the WAN it tries to match it up with an outbound connection (or it forwards it to a specified machine if the rules are setup such), and packets which don't map it drops to the ground.

That's just NAT and a firewall combined into one system. NAT doesn't drop packets, it just alters certain ones under certain circumstances. The part about dropping all packets except those that are replies to outbound connections that you mentioned - that's a stateful firewall. That is above and beyond the definition of NAT. If you yanked all the NAT functionality out of those linksys routers and left only the stateful firewall behind, they would be no less secure.

Re:firewall+NAT in one

[misleb]

That's just NAT and a firewall combined into one system. NAT doesn't drop packets, it just alters certain ones under certain circumstances. The part about dropping all packets except those that are replies to outbound connections that you mentioned - that's a stateful firewall. That is above and beyond the definition of NAT. If you yanked all the NAT functionality out of those linksys routers and left only the stateful firewall behind, they would be no less secure.

They'd be MORE secure because they wouldn't be able to access the internet. ;-)

-matthew

Re:Who funded this ?

[AchilleTalon]

Anyone writing white on black cannot be trusted. Serious guys are writing black on white. Who ignore typographic rules and ergonomy should be ignored.

Re:Not a bad start...but a couple of things on IPv

[Chanc_Gorkon]

With NTP this will work. With DNS however I don't see it working. What if I want to have my own, isolated blocks of IP's that only resolve behind my firewall? Granted, this is NO form of security what so ever, but it's damn convenient.

Not hard to read

[Invalid Character]

I actually like the white on black. It's a helluva a lot easier on the eyes than the black text on white background, which is basically like looking right into a light bulb. I wish more people could take a hint.

Re:IPv6 by 2008? Who's he kidding?

[Olmy's Jart]

You are correct. He is wrong. The operative word here is "exclusively". He would have been more proper to say "primarily". IPv6 IS the protocol of choice on the Internet 2 but it does, grudgingly, provide for IPv4. It doesn't EXCLUDE IPv4. But it does PREFER IPv6. And there are some things on Internet 2 which you can NOT do if you are limited to IPv4. (High bandwidth stuff requiring jumbograms, just to mention one obvious one.)

and to store all those addresses...

[zogger]

... in a portable device, I would suggest the *new*
I Pod Version 6

plug it in, scroll to where you want to go to....

They're for if you have no DHCP server.

[Anonymous Coward]

If you have a network with no DHCP server, the computers will fall back to auto-configuration, wind up on the same subnet, and be able to ping each other and have full TCP/IP connectivity between each other, which is enough to do Windows filesharing & other things.

Basically, the old methods had limitations and were complemented by the addition of a third method.

1. Static Configuration (old) -- doesn't require a DHCP server, but takes a lot of work.

2. DHCP (old) -- doesn't require a lot of configuration on the clients, but does require you to have a DHCP server.

3. Auto Configuration (new) -- doesn't require any configuration or a DHCP server, but doesn't let you connect beyond the subnet you're on, and isn't supported by every system.

Re:IPv6 by 2008? Who's he kidding?

[bap]

Internet2 using IPv6? Don't think so! Nor is anyone else. That is the problem isn't it? No viable bootstrap path.

$ host -t aaaa www.internet2.edu
www.internet2.edu AAAA record currently not present
$ host -t aaaa internet2.edu
internet2.edu AAAA record currently not present
$ host -t aaaa www.google.com
www.google.com CNAME www.google.akadns.net
www.google.akadns.net AAAA record currently not present
$ host -t aaaa www.yahoo.com
www.yahoo.com CNAME www.yahoo.akadns.net
www.yahoo.akadns.net has no AAAA record (Authoritative answer)

what are they doing with Class A's?

[RMH101]

Probably smoking them.

Re:IPv6 by 2008? Who's he kidding?

[Elwood P Dowd]

IPv6 IS the protocol of choice on the Internet 2 but it does, grudgingly, provide for IPv4. It doesn't EXCLUDE IPv4. But it does PREFER IPv6. And there are some things on Internet 2 which you can NOT do if you are limited to IPv4.

Right. But I'd guess (totally out of my ass) that the majority of Internet 2 nodes are Windows desktops in university dorms. No matter what I2 prefers, I betcha most of the end-to-end traffic is kazaa & gnut over IPv4.

I don't remember my computer in my dorm getting an IPv6 address assigned to it. But maybe I wasn't paying attention.

Do they run the backbones as IPv6-only? Does all that IPv4 get tunneled over IPv6? If so, that's rad.

Re:IPv6 by 2008? Who's he kidding?

[Olmy's Jart]

Most MS-Windows desktops, all you have to do is "turn it on". For WindowsXP SP2 (or SP1 with the advanced networking patch) all you have to do is add IPv6 to the connection under connection properties. You don't even need to reboot the box! It will autoconfigure, if a router is advertising a prefix, and it will enable 6to4 and Teredo (IPv6 over UDP).

If you are using Windows2K, you have to install a patch from MS. Earlier versions of Windows, you can get patches from Hitachi. All free.

The V6 backbones are just that V6 native and V4 tunneled over V6 ala DSTM (4over6).

Re:IPv6 by 2008? Who's he kidding?

[Olmy's Jart]

Maybe you are asking the wrong questions. Many sites which are on IPv6 maintain separate namespaces. Some overlap and have both A and AAAA records but some prefer to determine which is which.

One of your examles, internet2.edu...

$ host -t AAAA ipv6.internet2.edu
ipv6.internet2.edu has AAAA address 2001:468:1420::1500
$ host ipv6.internet2.edu
ipv6.internet2.edu has address 207.75.164.64
$ host www.internet2.edu
www.internet2.edu has address 207.75.164.64

How about that. It's the same box as www.internet2.edu, they've just got the AAAA records under a different name. But it IS IPv6 enabled.

Other sites that separates v6 and v4 into separate name spaces (this time with an entire subdomain):

$ host -t AAAA irc.ipv6.freenode.net
irc.ipv6.freenode.net has AAAA address 2001:1418:13:1::25
irc.ipv6.freenode.net has AAAA address 2001:1bc0::ffff:ffff:1337
$ host -t AAAA altavista.ipv6.digital.com
altavista.ipv6.digital .com has AAAA address 3ffe:1200:2001:1:8000::1

*.freenode.net is IPv4. *.ip6.freenode.net is IPv6. They chose to keep the namespaces orthogonal. Their shot to call. Same with the digital site

Some others with mixed records...

$ host -t AAAA www.netbsd.org
www.netbsd.org has AAAA address 2001:4f8:4:7:290:27ff:feab:19a7
$ host -t AAAA www.arin.net
www.arin.net has AAAA address 2001:440:2000:1::16
$ host -t AAAA www.stealth.net
www.stealth.net has AAAA address 2001:458:20:100::5
$ host -t AAAA www.comedycorner.org
www.comedycorner.org is an alias for puck.litech.org.
puck.litech.org has AAAA address 3ffe:2900:2006:40:202:b3ff:fea4:a44e
host -t AAAA www.kame.net
www.kame.net is an alias for orange.kame.net.
orange.kame.net has AAAA address 2001:200:0:8002:203:47ff:fea5:3085

You can come up with piles and piles and piles of sites that don't use IPv6 and you still miss the fact that some of them ARE using IPv6 and none of it shows that IPv6 isn't being used, even if it isn't being used (yet) by your favorite sites.

Re:IPv6 by 2008? Who's he kidding?

[Elwood P Dowd]

Most MS-Windows desktops, all you have to do is "turn it on".

That's all I was trying to say.