Slashdot Mirror

← Back to Stories (view on slashdot.org)

More on China's IPv6 Network Buildout

Posted by ryuzaki0 on from the go-big-or-go-home dept.

photojournaliste writes "China has developed and demonstrated its first high-performance network core router based on the next-generation Internet standard known as IPv6, which the country officially inaugurated earlier this week." There's also a CNet story, which has a bit more information than our earlier story.

110 of 163 comments (clear)

  1. Any more high-profile rollouts of IPv6? by The+One+KEA · · Score: 3, Interesting

    Does anyone know if there are similar projects in scope and concept to this one?

    --
    SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
    1. Re:Any more high-profile rollouts of IPv6? by Xeo+024 · · Score: 4, Informative

      From the article:

      China is not the only Asian country with a strong interest in IPv6. Japan has already implemented an IPv6 production network, which is used by every service provider in the country. South Korea is working with the EU to develop applications and services using IPv6.

      Also, check out this article: Japan, China, S. Korea developing next Net.

  2. Develop intellectual property, copy model # by PornMaster · · Score: 3, Interesting

    Yes, this new router does IPv6 and the Cisco 12016 doesn't, but isn't the model number a little familiar?

    Is this the Intel/AMD "486" thing all over again?

    --
    500GB of disk, 5TB of transfer, $5.95/mo
    1. Re:Develop intellectual property, copy model # by Duncan3 · · Score: 4, Funny

      What, are you implying the chinese would take the Cisco product, copy it IOS, product number and all, then add IPv6?

      That's absurd, noone can read Cisco source code.

      --
      - Adam L. Beberg - The Cosm Project - http://www.mithral.com/
    2. Re:Develop intellectual property, copy model # by Jeff+DeMaagd · · Score: 1

      Wasn't the AMD 486 basically the same design? For a while Intel had to licence out the chip designs so they can supply the military. Around the 486 time, Intel decided to leave that market and quit the licencing.

    3. Re:Develop intellectual property, copy model # by agristin · · Score: 3, Interesting

      The 12000 series supports IPv6 and so does the very model you point out.

      Check the release notes:

      http://www.cisco.com/en/US/products/sw/iosswrel/ ps 5014/prod_release_note09186a0080199977.html

      The chinese probably are using the cisco GSRs. If you google for GSR IPv6 you'll see a couple places with IPv6 and the GSR in action (abiliene?) and some with Juniper to GSR Ipv6 connections.

      -A

      While the idea that the chinese stole the router and hacked in IPv6 is nice, it is much easier to believe they bought a couple GSRs that support IPv6.

    4. Re:Develop intellectual property, copy model # by SexyAlexie · · Score: 1

      I know a man who can.

      --
      I'm too sexy for you.
    5. Re:Develop intellectual property, copy model # by Anonymous Coward · · Score: 1, Insightful

      You realise that the Chinese basically 0wn the US, and that intellectual "property" is just bits of paper at most?

      I"P" is a massive scam to get the West to stop manufacturing. "Made in England (or USA)" used to be a mark of pride, now all the real work is done by China, while the idiot West kills itself fighting over who has the most imaginary property?

      Pretty soon, all the West will have will be ephermal dreams, and the rest of the world will say "fuck that".

    6. Re:Develop intellectual property, copy model # by myowntrueself · · Score: 1

      "That's absurd, noone can read Cisco source code."

      Do you mean;
      "noone has the opportunity to look at and read cisco sourcecode" (because its so secret)

      or;
      "even if you had the opportunity to look at cisco sourcecode you wouldn't be able to read it" (because its so badly written)

      --
      In the free world the media isn't government run; the government is media run.
  3. I wonder how thay tested it? by CdBee · · Score: 1, Interesting

    The network operates between 10gb and 40gb a second... with current hard-disk technology it must have been a challenge to collate enough equipment at each end of the link to generate that much bandwidth without bottle-necking.

    Do network speed tests rely on clusters of machines?

    --
    I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
    1. Re:I wonder how thay tested it? by imsabbel · · Score: 1

      just use more clients... or /dev/random as source... or just sends the same 2GB again and again from RAM...

      --
      HI O WISE PRINCE. WHT TOOK U SO DAM LONG?
    2. Re:I wonder how thay tested it? by networkBoy · · Score: 4, Informative

      No they rely on things like this:
      http://www.spirentcom.com/analysis/product_line.cf m?pl=33&wt=2
      and this:
      http://www.ixiacom.com/products/chassis/ch_display .php?skey=ch_1600t_400t_100

      I used one of these to demonstrate to the IT department of my megacorp exactally why my networking lab needed it's own isolated subnet on its own Cat6K, and its own servers.
      Once I started pumping out thousands of frames per second of random IP and MAC addresses their routers started dying under the loads.
      I got everything I asked for :-)
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    3. Re:I wonder how thay tested it? by Enrico+Pulatzo · · Score: 1

      Remember, GB is 8*Gb. So if you have 8GB of RAM, you can easily saturate a 40Gb line.

    4. Re:I wonder how thay tested it? by networkBoy · · Score: 1

      I call BS.
      What counts is your ability to put that data on the line. This is something no PC and exceptionally few server class machines can do.
      With the advent of PCIe we are beginning to see PC's that conceivably could saturate a gig link, though even then they would have trouble.
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    5. Re:I wonder how thay tested it? by loyukfai · · Score: 1

      When there's no compression involved, maybe you don't have to actually send meaningful data to test the bandwidth?

      Remind me of flood ping.

    6. Re:I wonder how thay tested it? by PornMaster · · Score: 3, Informative

      Apparently, YOU HAVE NO IDEA WHAT YOU'RE TALKING ABOUT.

      The "Internet2 speed record" had Dell boxes running NetBSD pushing 4Gbps for an hour with no packet loss.

      ...and you call yourself networkBoy.

      --
      500GB of disk, 5TB of transfer, $5.95/mo
    7. Re:I wonder how thay tested it? by networkBoy · · Score: 1

      Let me quote myself:
      "This is something no PC and exceptionally few server class machines can do."
      I think I have your statement covered.
      I know what I'm talking about, I also know that the standard way to test a router is with the test tools I outline previously, not a group of PCs.
      but hey, you're the one with the respectable handle :P
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    8. Re:I wonder how thay tested it? by PornMaster · · Score: 1

      Did you see the specs of the PCs they used?

      I know that load generators are used to throw bits on the wire for network testing, but you don't have anything covered.

      --
      500GB of disk, 5TB of transfer, $5.95/mo
    9. Re:I wonder how thay tested it? by networkBoy · · Score: 1

      I'd love to see the specs.
      Show me one PC that can source 4Gbps off of it's I/O bus. That's faster than a single PCIe lane. Desktop boards supporting faster, multi-lane PCIe are only now coming to market. There aren't even many NICs that can support over 1Gbps. Myrinet only supports 2 gig, Infiniband supports 10Gig and in theory could support 40 gig. I suspect that the machine you are talking about is not a desktop class machine.
      Load generators are the accepted standard unit of speed measurement. Whether or not you want to accept it, using a PC is for publicty, not testing.
      Have it your way if you want though, I really don't care.
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    10. Re:I wonder how thay tested it? by Alien+Being · · Score: 1

      Right, the PC couldn't go any faster than 4Gb/s. We're talking about 40Gb/s, no?

    11. Re:I wonder how thay tested it? by PornMaster · · Score: 1

      I know that this is Slashdot, and nobody RTFAs, but I linked to the page with the specs.

      Sender:
      Dell 2650, with one single Intel Xeon 2.0 GHz CPU and 1024 Mbytes of RAM
      Receiver:
      Dell Precision 650, with one single Intel Xeon 2.8 GHz CPU and 512 Mbytes of RAM. NOTE that this host only has a 100 MHz PCI-X bus(!)
      Network interfaces (both sender and receiver): Intel® PRO/10GbE LR

      --
      500GB of disk, 5TB of transfer, $5.95/mo
    12. Re:I wonder how thay tested it? by PornMaster · · Score: 1

      Yes, but networkBoy was saying that no PCs could pump out a gigabit/sec to the wire.

      --
      500GB of disk, 5TB of transfer, $5.95/mo
    13. Re:I wonder how thay tested it? by Alien+Being · · Score: 1

      Ah, so he did.

    14. Re:I wonder how thay tested it? by peachpuff · · Score: 1

      According to the specs you linked, they used server-grade Intel(R) PRO/10GbE LR NICs which cost more than a whole PC. They point out that one of the machines "only has a 100 MHz PCI-X bus(!)" but that's a lot faster than whatever is on your desktop, and it comes on a server-grade motherboard (see here under "Will new PCI-X cards be compatible in conventional PCI based systems?").

      These guys called the machines PCs, but they obviously spent a big wad of cash on server-grade I/O busses. The result:

      "[T]he PCI-X bus and the memory bandwith in the end hosts are currently the bottlenecks."

      I'd say networkBoy has some idea what he's talking about.

      Think about it for a second. When someone says "no PC and exceptionally few server class machines" can do something, are you going to disprove them by pointing to the world record holders?

      --
      -- . . ramblin' . . .
  4. One thing I like by bert.cl · · Score: 4, Insightful
    From the CNet article:

    Some experts have predicted that once China has embraced IPv6, Western countries that wish to do business with Asia will have to upgrade their own networks.

    There is actually some truth in this, and might increase the accepetance rate. Same thing is happening to governments using OOo file formats is all, but at a smaller scale.

    However, the other article said that it is backward compatible with ipv4, are they using some kind of NAT then, or is it just backward compatible in the sense that the Chinese network can read of ipv4 networks.

    Another critique is that, whilst this network uses ipv6, it is mainly used to connect university networks, therefore, business won't be as much pushed to adopt ipv6, hence the article...

    1. Re:One thing I like by LiquidCoooled · · Score: 1

      I suppose you could do some kind of hash from ip6 down to ip4.
      It may infact make the internet a bit more random and fun again ;)

      --
      liqbase :: faster than paper
    2. Re:One thing I like by St.+Arbirix · · Score: 1

      However, the other article said that it is backward compatible with ipv4, are they using some kind of NAT then, or is it just backward compatible in the sense that the Chinese network can read of ipv4 networks.

      yeah, that'll translate well...

      Chinese guy: let's browse over to Slashdot...
      His computer: Hey 66.35.250.150, I'm FEDC:BA98:7654:3210:FEDC:BA98:7654:3210 and I want all your base to belong to me. Or maybe just you're index.html.
      Slashdot server: WTF? What's all that "FEDC" gobbly-gook supposed to mean? Don't you try to set us up the bomb by giving us 128 bits. We only accept 32! We're not gonna even try to respond. Fucking cats.

      --
      Direct away from face when opening.
    3. Re:One thing I like by dryeo · · Score: 1

      However, the other article said that it is backward compatible with ipv4, are they using some kind of NAT then, or is it just backward compatible in the sense that the Chinese network can read of ipv4 networks.
      IIRC the way it should work is slashdot.org (66.35.250.150) becomes 0:0:0:0.66.35.250.150 which tells the ipv6 router to use ipv4. After upgrading to ipv6 slashdots ip is now 0:0:0:FFFF.66.35.250.150
      which means that slashdot can use ipv6. Eventually slashdot would get its own ipv6 block and stop using ipv4. Unluckily it seems ipv6 is never going to be totally implemented

      --
      https://en.wikipedia.org/wiki/Inverted_totalitarianism
  5. I think that... by wolf31o2 · · Score: 5, Interesting

    I really believe that this is a good thing. Many people are not embracing IPv6 due to lack of a high-profile rollout showing its feasability. Also, much of the software out there does not take advantage of IPv6. Having such a large number of people using IPv6 will persuade a few more people to start coding their software capable of using IPv6 addressing.

    I really look forward to the day when I can (once again) have end-to-end connectivity with peers. The proliferation of NAT devices truly has changed the face of the Internet from a large peer-to-peer network with content at every corner, to a client-server model where content is only served by those with enough capital.

    This is readily apparent in the draconian acceptable useage policies of most providers.

    I *want* to be able to connect to any of my home machines from work, and vice-versa (firewall permitting). I would *love* to have my own block of portable address space for me to do with as I please.

    I simply can't wait for this to catch on in more places. I encourage all of you to look into IPv6 and see how much added benefit you could get from having a near-unexhaustable pool of addresses available.

    1. Re:I think that... by jessecurry · · Score: 1
      I *want* to be able to connect to any of my home machines from work, and vice-versa (firewall permitting). I would *love* to have my own block of portable address space for me to do with as I please.

      I already do all of this, I don't see why you wouldn't be able to, it just requires that you correctly setup your router at home and know your ip address. I use dyndns with my router and have each machine setup to be accessible from a different port number.

      --
      Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
    2. Re:I think that... by ctime · · Score: 3, Insightful

      You know just as well if everyone on the planet had their own dedicated IP space, the number of trojans, worms, and other malicious code that uses IP 'sprays' to find hosts would spiral out of control.. I don't think anyone realizes how many PC's are effectively firewalled and safe thanks to the NAT routers you think we should abandoned. Even if we did have IPv6 available at home, no business with enough sense to rub together would give every end user a block of IP's, routing of their own IP's (block), nor would they unblock 'malicious' ports and known common ports at the CPE level (cable or DSL modem). The current market dictates that services should be can on dedicated _servers_. IPv6 is only going to be realized as your thinking suggests when programs which listen on ports become secure..which may never happen.

    3. Re:I think that... by Tony+Hoyle · · Score: 1

      Not true.. it actually becomes unfeasable to find machines with random IPs.

      If you have a /48 or a /64, which is likely, then the rest of the address is derived from your mac address... unless you can actually randomly guess that then 'random' hunting just isn't going to work.

    4. Re:I think that... by Anonymous Coward · · Score: 2, Insightful

      I really believe that this is a good thing. Many people are not embracing IPv6 due to lack of a high-profile rollout showing its feasability.

      Many people are also not building gigantic football stadiums made out of cotton candy due to lack of a high-profile rollout showing its feasability. But just because someone does it doesn't mean you will get more gigantic cotton-candy stadiums, even though it does solve the shortage of cotton-candy at football games.

      Also, much of the software out there does not take advantage of IPv6. Having such a large number of people using IPv6 will persuade a few more people to start coding their software capable of using IPv6 addressing.

      Why should it. All the good web sites are on IPv4 (or IPv4 along with IPv6 in a few cases). For instance slashdot is still on IPv4. So why would I need IPv6? In fact I regularly remove IPv6 support from all my software. My ISP doesn't even support IPv6.

      I really look forward to the day when I can (once again) have end-to-end connectivity with peers.

      I don't. I don't want any AOL customers to have direct internet connections for instance.

      The proliferation of NAT devices truly has changed the face of the Internet from a large peer-to-peer network with content at every corner, to a client-server model where content is only served by those with enough capital.

      Demonstrate how IPv6 will solve this problem.

      This is readily apparent in the draconian acceptable useage policies of most providers.

      My ISP gives me both public (non-NAT) address AND a draconian AUP. Demonstrate how IPv6 will solve this problem.

      I *want* to be able to connect to any of my home machines from work, and vice-versa (firewall permitting).

      Use port forwarding if you have less than roughly 60,000 machines. It works for me.

      I would *love* to have my own block of portable address space for me to do with as I please.

      Try 10.*.*.*, I hear that's available.

      I simply can't wait for this to catch on in more places. I encourage all of you to look into IPv6 and see how much added benefit you could get from having a near-unexhaustable pool of addresses available.

      I did look into IPv6. There are some nice features but on balance it seems like a total waste of time. I'm sorry to hear that you used up all the 10.*.*.* addresses on your LAN, you must have a lot of machines.

    5. Re:I think that... by Jeff+DeMaagd · · Score: 2, Informative

      I *want* to be able to connect to any of my home machines from work, and vice-versa (firewall permitting). I would *love* to have my own block of portable address space for me to do with as I please.

      IPs were never meant to be portable. Making it portable really messes up routing. This is why you set up DNS so you can name each device. I have a DHCP server that gives out IPs based on MAC addresses so all I have to remember is a name, not a long number (IPv6 numbers are a lot longer too).

    6. Re:I think that... by loyukfai · · Score: 1

      I agree that using a NAT is a pain if you need direct P2P connectivity, but OTOH, it's also useful as it basically works like a one-way firewall so that outsiders won't be able to get into your network so easily. For once, I didn't have to worry about those Windows RPC worms for my home network. In that way, it's kind of useful. But then, there are many more ways to infect a private network.

    7. Re:I think that... by ctime · · Score: 1

      Security through obscurity? I'm pretty sure thats what you just described.

    8. Re:I think that... by PhraudulentOne · · Score: 1

      I agree, I can't wait for IPv6. We are rolling out our new 10Gbit network in the spring and once we start doing video, we will probably do IPv6 for all the set-top boxes as well as the streaming servers. That way we can have a totally closed IPv6 network to start playing around. Foundry makes the NetIron 40G that does IPv6 at wirespeed right now and it's backplane is 40Gbs so its ready to go when we want to increase capacity yet again. Also, I run the IP network for an ISP and I have our DSL network set up so that people can have a non-routable IP (DHCP 10.x.x.x) when they plug in, or if they need to do a voice chat etc, they can do PPPoE for a real IP. I really would like to just assign real IPs to everyone, but as you all know, IPv4 addresses are running low.

      --
      You create your own reality - Leave mine to me.
    9. Re:I think that... by loyukfai · · Score: 1

      I agree using a NAT is a pain if one needs direct P2P connectivity, but OTOH, it also gives you a basic one-way firewall so that outsiders won't be able to get in so easily.

      For example, if a Windows box is behind a NAT, the chance of getting infected by a new RPC bug drops significantly.

      In that sense, it's useful.

      But then, there are so many more ways to get into a private network (Such as worms propagate through browser bugs...), and a basic NAT is not a replacement for those who need two-way access control.

    10. Re:I think that... by ctime · · Score: 1

      Actually it's a 128bit addresses space, but I'm not an expert. What I do know is that when ARIN or whomever starts to really hand out addresses and they become hugely routable on the internet now, It's not going to be that difficuilt at all..they are likely to assign address space contigously for one, secondly most of the IPv6 space "prefixes" will be availabe on routers making the 'spray' range for certain blocks less than /32 or /48.

      There's more than one way to do this, my point is that having every device, cell phone, blow-up doll online isn't a good thing. It just leaves everyone open to attack.

    11. Re:I think that... by rekoil · · Score: 1

      True, but what you're doing is working around a fundamental weakness of both IPv4 (the relative scarcity of addresses) and your ISP's policy (not willing to allocate you a static IP for each machine, partly due to #1). With IPv6, both issues are moot.

    12. Re:I think that... by GoofyBoy · · Score: 1

      >Guess what SSH, PGP, SSL, and every single encryption standard we've come up with to date have in common? They all use security through obscurity. If you don't believe me, then you should stop "obscuring" all your private keys and post them publically.

      Thats not "security through obsecurity". Its if others didn't know how SSH, PGP, SSL worked and relied on that to provide a level of security. The fact that you keep a key secret ok.

      --
      The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
    13. Re:I think that... by timoteo21 · · Score: 2, Insightful

      Evidentally, there are a fair number of hosts on the Internet with public IP addresses that are running "programs which listen on ports." Otherwise, there would be no communication at all. So, what is it about these "server" machines that make them more secure than "client" machines? Why can those practices not be implemented on client machines?

    14. Re:I think that... by Yebyen · · Score: 2, Informative

      Bzzzt... There is actually an addressing protocol built into IPv6 known as "Mobile IPv6" which allows a machine on the home network, listening for packets addressed to one of your "mobile IP's" will respond with a packet that tells the sender where to find that computer right now, a "care-of address."

      This all requires the mobile computer to report back periodically with status updates on its current "care-of IP", and that's all. This is not a tunnel, it's real mobile IP, built into the protocol. I believe this feature is also available for IPv4 through use of some extension to the protocol.

      --
      Restating the obvious since nineteen aught five.
    15. Re:I think that... by asdfghjklqwertyuiop · · Score: 3, Insightful

      I don't think anyone realizes how many PC's are effectively firewalled and safe thanks to the NAT routers you think we should abandoned.


      NAT has nothing to do with firewalling. NAT does not drop any packets whatsoever - your firewall does. With IPv6 noone is proposing that we stop using firewalls, just that we stop using NAT. Nobody's network will be one bit less safe by dropping the NAT and keeping the firewall.

    16. Re:I think that... by asdfghjklqwertyuiop · · Score: 1


      I really look forward to the day when I can (once again) have end-to-end connectivity with peers.

      I don't. I don't want any AOL customers to have direct internet connections for instance.


      Then keep your firewall in place. You do have one, don't you? Noone is proposing we drop firewalls with IPv6, just NAT.


      Use port forwarding if you have less than roughly 60,000 machines. It works for me.


      You don't use SSH or SSL or any other protocol that does host-based authentication? If not, and if you don't mind memorizing what 60,000 numeric port numbers are for since you can't use DNS, then yeah, I guess it does work for you... but not many other people.



      I would *love* to have my own block of portable address space for me to do with as I please.

      Try 10.*.*.*, I hear that's available.


      But that's not portable - you don't actually "port" 10/8 to another ISP because that network doesn't even exist as far as the ISP is concerned.

    17. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      I agree that using a NAT is a pain if you need direct P2P connectivity, but OTOH, it's also useful as it basically works like a one-way firewall so that outsiders won't be able to get into your network so easily.


      Actually NAT doesn't act like a firewall at all. Read the RFCs sometime, it doesn't actually drop any packets, it simply re-writes certain ones.

    18. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      now Let's think about what you are asking for. you want a multiple IP address router/firewall. Do you know how firewalls work? they do not act transparent like a router. so you can not have one of them to protect multiple destination IP addresses... so now if you have 4 pc's at home you need 4 firewalls.


      Wow... if the parent poster knows a "VERY tiny bit" about networking, you know absolutely nothing at all.

    19. Re:I think that... by tabrisnet · · Score: 1

      Both true and false.

      NAT rewrites outgoing packets and maintains a connection tracking table for outgoing packets so that incoming packets may be routed to the correct internal host.

      However, this also means that packets coming in that do not match an entry in the conntrack table will simply be... ignored. aka dropped. After all, short of you setting up a default host for random packets to go to, a NAT device does not know what to do with random packets.

    20. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      NAT rewrites outgoing packets and maintains a connection tracking table for outgoing packets so that incoming packets may be routed to the correct internal host.

      However, this also means that packets coming in that do not match an entry in the conntrack table will simply be... ignored. aka dropped. After all, short of you setting up a default host for random packets to go to, a NAT device does not know what to do with random packets.


      No, they won't be dropped. Random packets ariving will simply be routed normally. If a packet arrives with a destination address matching your internal network, it will be routed right in. Anything else will follow your default route out.

      Try it sometime - set up a capable router someitme with no filtering rules and only NAT. You can set up routes on the outside to the inside and that router will pass them right through.

    21. Re:I think that... by loyukfai · · Score: 1

      Are we talking about the NAT as described in RFC 1631?

      AFAIK (please correct if wrong), internal hosts behind a NAT uses private addresses (and that's the whole point of using a NAT...?), and the only device within the internal network including the NAT who has a REAL IP is the NAT device.

      Therefore, how could external packets "routed" to internal hosts? As private IP won't get transferred at all on the Net.

    22. Re:I think that... by loyukfai · · Score: 1

      According to RFC 3022:

      Traditional NAT can be viewed as providing a privacy mechanism as sessions are uni-directional from private hosts and the actual addresses of the private hosts are not visible to external hosts.
    23. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      According to RFC 3022:

      Traditional NAT can be viewed as providing a privacy mechanism as sessions are uni-directional from private hosts and the actual addresses of the private hosts are not visible to external hosts.


      That is just a conceptual view of how the usual network using Traditional NAT works - sessions are going one way, and the private addresses are not visible to outside hosts. That doesn't specify that NAT should drop connections that are going they other way. Nothing in any of the NAT RFCs says to do so. Search for the words drop, reject, deny, filter, etc in any of the NAT RFCs.

      Not only that, but if you look at RFC2663, section 9.0, you'll see:


      NAT devices, when combined with ALGs, can ensure that the datagrams
      injected into Internet have no private addresses in headers or
      payload. Applications that do not meet these requirements may be
      dropped using firewall filters. For this reason, it is not uncommon
      to find NAT, ALG and firewall functions co-exist to provide security
      at the borders of a private network.

    24. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      AFAIK (please correct if wrong), internal hosts behind a NAT uses private addresses (and that's the whole point of using a NAT...?), and the only device within the internal network including the NAT who has a REAL IP is the NAT device.

      Therefore, how could external packets "routed" to internal hosts? As private IP won't get transferred at all on the Net.


      Your own router will route them to internal hosts unless it has filtering rules to tell it to do otherwise. All the attacker has to do is get the packets to your router. There are various ways of doing that - your ISP could be compromised, or if you happen to have brodband which places nearby customers on one logical subnet, any one of those customers machines could be compromised and used to send such packets into your router (which will then happily pass them to your internal host).

    25. Re:I think that... by loyukfai · · Score: 1
      Your own router will route them to internal hosts unless it has filtering rules to tell it to do otherwise.

      I don't get this, since the hosts behind the NAT are using private IPs, how could the NAT knows which host to send the packets to?

      Say, someone initiate a TCP connection to port 80 to the NAT host, which has a real IP of 123.123.123.123, when the NAT receives the packets, how could it know which internal host to forward the packets to?

      Maybe it's because I'm too get used to Linux's IP Masquerade, but I suppose a NAT maintains a "database" of connections initiated from INSIDE the NAT, when packets from the OUTSIDE arrives, it matches against the database to see which host the packets should then be forwarded to. As the way implemented in the Netfilter's stateful firewall.

      Therefore, when an outside initiated connection comes to the NAT at an arbitrary port, and the NAT found that there are no records of connections with regards to that, it doesn't know where to forward the packets to (I suppose it won't randomly forward packets to internal hosts...), so the packets will be rejected or dropped.

      Or maybe, this is only ONE type of the NAT and oops... There are static NATs (just Googled it...)?

    26. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      I don't get this, since the hosts behind the NAT are using private IPs, how could the NAT knows which host to send the packets to?

      Say, someone initiate a TCP connection to port 80 to the NAT host, which has a real IP of 123.123.123.123, when the NAT receives the packets, how could it know which internal host to forward the packets to? ...
      when an outside initiated connection comes to the NAT at an arbitrary port, and the NAT found that there are no records of connections with regards to that, it doesn't know where to forward the packets to (I suppose it won't randomly forward packets to internal hosts...), so the packets will be rejected or dropped.


      I'm not talking about incoming packets addressed to the router itself (123.123.123.123), I'm talking about incoming packets addressed to the private addresses (10/8, 192.168/16, 172.16/12, whatever you use on the inside).

      If a packet arrives on the outside interface with an inside destination address, your NAT doesn't come into play at all because your NAT rules only alter outbound packets (departing on the outside interface) and packets addressed to the firewall on certain ports (ie, port forwards).

      You're right that NAT does keep a connection state table for translating inbound packets related to established connections, but again, all that stuff doesn't come into play for the situation I'm talking about.

    27. Re:I think that... by loyukfai · · Score: 1
      I'm not talking about incoming packets addressed to the router itself (123.123.123.123), I'm talking about incoming packets addressed to the private addresses (10/8, 192.168/16, 172.16/12, whatever you use on the inside).

      But wait... Aren't private IP addresses non-routable on the real Net? Then how could someone, outside the private network, contact a host inside the private network?

      Say, if you're running a private network with 10/8 and a host with the address 10.10.10.10, I shouldn't be able to "ping" you at that address, the packets won't get through the Net, right...?

      I'm so confusing now... @_@

    28. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      But wait... Aren't private IP addresses non-routable on the real Net? Then how could someone, outside the private network, contact a host inside the private network?


      You're right, they aren't routable for the most part, but certain people can make them routable, at least on the network near you on the outside. See my other post. You can't rely on the non-routability of those addresses to maintain the security of your network.

    29. Re:I think that... by loyukfai · · Score: 1

      I see... I suppose a stateful firewall like Netfilter configured correctly can prevent this, right?

      Anyway, thanks alot, I think I get a better view on NAT now. :)

    30. Re:I think that... by asdfghjklqwertyuiop · · Score: 1

      I see... I suppose a stateful firewall like Netfilter configured correctly can prevent this, right?


      Yeah. Well, netfilter does nat and filtering. Just make sure you have some stuff in the filter table as well as nat.


      Anyway, thanks alot, I think I get a better view on NAT now. :)


      No problem.
  6. Re:Not suprisingly slashdot "editor" michael posts by ScrewMaster · · Score: 1, Funny

    Unless ... you happen to be a Communist who is squatting on a domain.

    --
    The higher the technology, the sharper that two-edged sword.
  7. seems like I've heard of CERN before by garyisabusyguy · · Score: 1, Flamebait

    According to the CNET article, CERN stands for China Education and Research Network... What about History of CERN? Oh well, I guess that there are advantages to living in a world without legacy systems or intellectual property...

    --
    Wherever You Go, There You Are
  8. Communism and the internet. by DanielJosphXhan · · Score: 1, Offtopic

    One has to wonder what vested interest China has in implementing new protocols, especially with a view to becoming a leader amongst world powers when it comes to the internet. Especially when one factors in the way information is controlled (alright, less and less, but still controlled) in China at the moment.

    Isn't this self-defeating for a communist country as it exists now?

    --
    [ think ]
    1. Re:Communism and the internet. by jay-be-em · · Score: 1

      I think it's self-defeating for a totalitarian dictatorship.. For communism I don't really see the problem.

      --
      "Orthodoxy means not thinking--not needing to think. Orthodoxy is unconsciousness." --Eric Blair
    2. Re:Communism and the internet. by loyukfai · · Score: 1
      a view to becoming a leader amongst world powers when it comes to the internet

      That doesn't do it? : )

      To be serious, I think (With no hard data supporting the claim.) China's technology, especially in the academic institutions, is much more advanced than many think, and can actually utilize some of that.

    3. Re:Communism and the internet. by wheelbarrow · · Score: 1

      I don't see much difference between totalitarian dictatorship and communism. Both can only be implemented through coercion and force. Why do you draw a distinction?

    4. Re:Communism and the internet. by jay-be-em · · Score: 1, Insightful

      Any non-trivial government can only be implemented through coercion and force. The most 'free' nations in the world _still_ need jails to enforce it's laws. As Tolstoy said 'Government is an association of men who do violence to the rest of us' (paraphrased, and where Tolstoy's violence is 'some people forcing others, under threat of suffering or death, to do what they do not want to do.) I don't really see a reason why communism requires a totalitarian dictatorship; it is true that most communist societies have had one but I'd argue that most aren't (or weren't) communist, they were/are more purely totalitarian than anything. Disclaimer: I am not a communist.

      --
      "Orthodoxy means not thinking--not needing to think. Orthodoxy is unconsciousness." --Eric Blair
    5. Re:Communism and the internet. by leereyno · · Score: 1

      "Self-defeating" as applied to a communist nation simply means continuing to embrace communism.

      --
      Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
    6. Re:Communism and the internet. by jay-be-em · · Score: 1

      "The free nations of the world use jails to incarcerate criminals. Nations that are not free use jails to incarcerate dissidents." Um, yes. And they are criminals because of the government's definition of laws. The implementation of, for instance, the US government and legal system directly puts people in jail. I'm not saying this isn't a good thing, I'm just saying that enforcing any legal system which hands down punishments requires force. The rest of your post basically confuses the pseudo-communist dictatorships which have existed with communism.

      --
      "Orthodoxy means not thinking--not needing to think. Orthodoxy is unconsciousness." --Eric Blair
  9. Billions? by Anonymous Coward · · Score: 3, Informative

    From the news.com article
    By increasing this to 128 bits, IPv6 provides billions more IP addresses

    Billions? Try 3.4 dodecillion

  10. The Question Is... by ewanrg · · Score: 2, Insightful
    When will IPV6 support become important rather than just interesting? I think the CNet article partly addresses this - when the Asian markets make it a requirement.

    On the other hand, it's still pretty easy to tunnel IPV4 through IPV6, so where is the incentive to upgrade going to be?

    At least running Linux at home, that's one conversion worry I don't have :-)

    ---

    My blog or yours?

    1. Re:The Question Is... by kinema · · Score: 1

      I wasn't aware that there was an easy way to tunnel v4 over pure v6 nets. The only method I know of is the dual stack transition mentor (DSTM) which IIRC requires daemons not only at the v6 net's edge but on each of the v6 clients doing.

  11. Last to market by hey · · Score: 3, Insightful

    It helps to be last to market. They get those nice pebble bed nuclear reators, IPv6, no need to waste all the money with land lands just use the latest WiFi or cell phone tech, etc.

  12. why, if there's no freedom? by diegocgteleline.es · · Score: 1

    If China government is trying to control what Chinese people can do on Internet...what's the point of having a high-performance router if they can't download pr0n movies? Linux distros?

  13. Re:this isn't ipv6 related by MightyMartian · · Score: 3, Insightful

    The problem with private address spaces is that they technically break the end-to-end structure of the Internet, not to mention a number of protocols. While most NAT routers now finally have helper apps to take care of protocols like FTP and IRC, it's still a pain in the a** at times.

    However, the IP6 rollout is going to be an expensive process. It certainly hasn't gone at the pace that we were being told four or five years ago.

    For myself, I've moved the company I work for away from some of their older hardware to Linux-based routers. This way we won't be shovelling money down Ci$co's throat, and the upgrade, at least at the head, will require nothing more than a reconfiguration.

    Of course, there is our old Ci$co AS5200 dialup server. That may have to be put in an IP4 NAT space. :-(

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  14. Why the Chinese are using IPv6 by mabu · · Score: 2, Funny

    ..because they are running out of non-RBL'd IPv4 space from which to spam....

  15. For those who claim China respects IP by glrotate · · Score: 1, Informative

    Hitachi GST sues Chinese disk drive maker

    Reuters

    Wednesday December 29, 4:59 PM
    Hitachi GST sues Chinese disk drive maker
    HONG KONG, Dec 29 (Reuters) - The hard disk drive manufacturing joint venture between Hitachi Ltd. and IBM said on Wednesday it has sued Chinese firm Magicstor Inc., saying it had made multiple patent infringements.

    In the suit filed in United States District Court, Hitachi Global Storage Technologies seeks monetary damages and a permanent injunction barring Magicstor from making and selling the allegedly infringing products.

    A spokeswoman at Magicstor, located in the interior Chinese city of Guiyang, had no immediate comment.

    The suit names Magicstor, its Chinese parent company, GS Magic Inc. and California-based Riospring Inc., according to a statement released by Hitachi GST.

    According to its Web site, GS Magicstor is a hard disk drive maker that was founded in 2002 "as the first small form factor manufacturer with its own intellectual property rights."

    The filing of patent infringement lawsuits in the United States against Chinese firms has become a relatively common strategy by plaintiffs wary of using China's fledgling patent protection system.

    Taiwan Semiconductor Manufacturing Co. Ltd. (TSMC) the world's biggest contract maker of semiconductor chips, is using the tactic in its lawsuit against Shanghai-based rival Semiconductor Manufacturing International Corp. (SMIC) .

    Last year, Cisco Systems , the world's biggest maker of routers and switches used in telecoms networks, also used a U.S.-based lawsuit when it accused Huawei Technologies, China's largest telecoms equipment maker, of copyright infringement.

    1. Re:For those who claim China respects IP by loyukfai · · Score: 1

      So...?

      Minidrive maker Cornice slapped with another suit

      If you want to claim the Chinese doesn't respect the US IP system as much as the US do, just pointing out a Chinese firm being sued doesn't seem very convincing to me...

      Just my 2 cents.

      P.S. Software piracy is probably more (Or much more...) serious in China (And many developing countries.), and China doesn't seem to have a good track record in holding up the US IP system, but the above article doesn't tell much IMO, US companies get sued on IP infringements all the time... Umm?

  16. Re:One Thing China Needs to Develop and Rollout by iamacat · · Score: 1

    Seriously, what use is a high performance router if you are going to have a firewall that does extensive filtering, blocking and logging? Or a large number of IP addresses if private citizens are not allowed to run servers?

  17. Not feasability, need. by glrotate · · Score: 2, Informative

    I *want* to be able to connect to any of my home machines from work, and vice-versa. NAT and port forwarding take care o this already. Most companies DON'T wan any machine to be publicly accesible.

  18. I want to buy some of this stock by gtrubetskoy · · Score: 3, Funny

    China has developed and demonstrated its first high-performance network core router based on the next-generation Internet standard

    China? Are they public yet? What's their ticker, I can't find it??

  19. tunnel by ashpool7 · · Score: 1

    IP4 over IP6 tunnel. Set the IP4 gateways at the border, where the rest of the world is, only route IP6 inside.

    easy way to determine what's outbound traffic without having to look at the destination.... that would probably be benificial to the chinese government

  20. someone has to say it. by ctime · · Score: 4, Interesting

    According to the article, half of the 'core' networking equipment was suppied by chinnese companties, of the two, one happened to be Huawei technolgies.

    Lest we forget!

    http://newsroom.cisco.com/dlls/corp_012303.html

    One of my favorite quotes to be found on cisco's website:

    Copying of IOS source code: Cisco alleges that Huawei has copied portions of the Cisco IOS source code and included the technology in its operating system for its Quidway routers and switches. Huawei's operating system contains a number of text strings, file names, and bugs that are identical to those found in Cisco's IOS source code.

  21. Content control? by bckspc · · Score: 1

    Has anyone heard about content control and surveillence technology built into all of this? I'd be very surprised if the government designed router and network did not have a mechanism to sniff packets and block or reroute email or Web traffic they find objectionable.

  22. The CNET article itself is terrible. by James+Youngman · · Score: 5, Informative
    I cannot believe there were so many errors in an article which is only 358 words long. What a bad piece of journalism. Only 81 words are devoted to the China new item, the rest ss background on IPv6. The IPv6 information is riddled with errors.

    There is a rather better article on the subject of IPV6 adoption at InternetWeek, but that article is now four years old.

    As for the specific information in the article,
    "IPv6 provides billions more IP addresses" - I think the reporter is a bit confused about all these large numbers. IPv6 provides billions of TIMES more addresses. More even than that in fact; 2 to the power 128 is 79228162514264337593543950336 times greater than 2 to the power 32. (This calculation was brought to you by GNU bc)

    "It was created and deployed in response to ... especially as Web use in Asia rises sharply." - The author has fallen for the post hoc ergo propter hoc fallacy. In any case, the beginning of the development of IPv6 occurred significantly before the extensive takeup of Internet technologies in Asia.

    As other people have already mentioned (including in the reader comments below the article - I would have contributed but see no point in "registering" with CNET), goodness knows where the journalist got their figure of "257 nodes". They should perhaps take the time to either check their notes or cross-check the information their sources are giving them.

    Something the author failed to point out is that it is not only Asian countries that have been working with IPV6. There has been significant piloting in most countries that make use of the Internet. This means that there are IPV6 over IPv4 tunneling facilities that work therse days, meaning that it is not necessary for countries up upgrade everything to IPv6 in order for their businesses to trade with China, no matter what the article implies.

    1. Re:The CNET article itself is terrible. by burns210 · · Score: 1

      "...meaning that it is not necessary for countries up upgrade everything to IPv6 in order for their businesses to trade with China, no matter what the article implies."

      The IPv6 network was academic institutions only, from what I understood. How is this any different than the Internet2 that we (colleges, etc) have in the US?

    2. Re:The CNET article itself is terrible. by Tesla+Tank · · Score: 1
      I cannot believe there were so many errors in an article which is only 358 words long. What a bad piece of journalism. Only 81 words are devoted to the China new item, the rest ss background on IPv6. The IPv6 information is riddled with errors.

      Is it customary to count the number of words in an article?

    3. Re:The CNET article itself is terrible. by James+Youngman · · Score: 1
      I cannot believe there were so many errors in an article which is only 358 words long. What a bad piece of journalism. Only 81 words are devoted to the China new item, the rest ss background on IPv6. The IPv6 information is riddled with errors.
      Is it customary to count the number of words in an article?
      It struck me as a very short article with a large number of errors. With "wc -w" it's easy to count the words. You didn't think I did it by hand, did you?
  23. Re:wow! by PhraudulentOne · · Score: 1

    Naw, the Americans still piss off the world the most in That Department

    --
    You create your own reality - Leave mine to me.
  24. No idea of how IPv6 works by silas_moeckel · · Score: 2, Informative

    OK I'm a network engineer been one for 15 years. IPv6 does not make customer address space portable, it does make it easier to "renumber" but in no way does it even help multi homing. So you IP's from your provider are no more portable actualy since the rules for getting IPv6 space are harder pretty much anybody withou an AS does not qualify and there are 16 bits of those half of them allready used. v6 only deals with multicast and IP space as it's big wins. Funny the telco's dont want Multicast to work and the IP space thing isn't hurting anybody yet you can get all the space you can justify and pay for.

    BTW I can do what you described with NAT and with Public IP space (yes I have a public Class C in my home :) but most people dont qualify for a /19 and dont have 2.5k to buy the block.

    --
    No sir I dont like it.
  25. Re:One Thing China Needs to Develop and Rollout by PhraudulentOne · · Score: 1

    Oh I dunno... telephone, and TV maybe? All the bandwidth for cellular telephones and the video/data they transmit, all the medical data for hospitals, all the data/research for universities/military etc etc etc etc... basically the same as in America.

    --
    You create your own reality - Leave mine to me.
  26. 37.25 GB/sec by kevincw01 · · Score: 1

    320 billion bits per sec == 37.25 GB/sec. Seems low to me?

    --
    netkev.com
    1. Re:37.25 GB/sec by kevincw01 · · Score: 1

      good points.

      --
      netkev.com
  27. IPv6 on Internet2 by Danathar · · Score: 2, Informative

    Contrary to what many people know...there are MANY networks that are IPv6 enabled. Just not many IPv6 apps.

    ALL of abiline (Internet2) is v6 enabled, just not all the way to clients.

    Here is an up to date map of deployment of Ipv6 on I2.

    http://www.abilene.iu.edu/images/v6.pdf

    1. Re:IPv6 on Internet2 by barureddy · · Score: 1

      I know when I at school at Vanderbilt (I2 enabled school) we get IPv6 addresses all the way down to our dorm rooms. I've had an IPv6 address for well over a year if not more. Never noticed until I installed gentoo about 2 years ago.

      I'm interested that this did not make the news aswell. Internet 2 is what exactly the new Chinese network is trying to do. It must be the fact that
      China, a technological underdog.

  28. Re:Compatibility by jacksonj04 · · Score: 1

    Yes, yes it is. IPv6 is just like IPv4, except a new standard. It's published by the IETF (whos URL escapes me right now, possibly a child will have it) and is already implemented left right and centre, just not on any large scale. The network in my house uses IPv6, as does my school's 'Test Suite'. Microsoft have a big 6to4 router (lets IPv6 talk to IPv4) which is publicly available (search TechNet for the "6bone").

    So, although China has fairly whupped most other places in getting IPv6 in first, there's no way it can run the show.

    --
    How many people can read hex if only you and dead people can read hex?
  29. Re:When is Slashdot going to do IPv6? by b1scuit · · Score: 1

    They tried, but on the second day everyone was screaming "Dupe! This was on yesterday!", so they took it down. :)

  30. You're kinda slow aren't you? by glrotate · · Score: 1

    The point is that the Chinese government doesn't do anything about it. In the US you have the recourse of a legal system that respects IP.

    1. Re:You're kinda slow aren't you? by loyukfai · · Score: 1

      Why would a government like to do something to protect someone else's broken system?

      And I don't think the Chinese government is doing nothing about it, but if you want to put US standard on other countries, so be it.

  31. Re:Compatibility by rekoil · · Score: 1

    I think the IETF's web site is http://www.ietf.org.

  32. Because it helps you track your citizens? by xixax · · Score: 1

    While I am not familar with IPV6 beyond the large increase in address space; IPV6 security features such as the Authentication Header might be a great way of making sure only nproperly documented citizens are allowed on the Internet. You may also be able to ensure that they do not connect to undesirable services such as anonymous proxies.

    Xix.

    --
    "Everything is adjustable, provided you have the right tools"
    1. Re:Because it helps you track your citizens? by forfan · · Score: 1

      Ok, have u ever been to China? or Do u understand Chinese? If not, just stop talking about "Freedom in China".

    2. Re:Because it helps you track your citizens? by xixax · · Score: 1

      No, I have never been to China. However it has been demonstrated that the Chinese government has an interest in technology to control Internet access:
      http://www.theregister.co.uk/2003/12/04/it_giants_ fingered_over_links/

      On this basis, I'd expect the security provisions of IPV6 to be attractive (depeinding on what they let you do). Seems like a pretty logical conclusion to me.

      Xix.

      --
      "Everything is adjustable, provided you have the right tools"
  33. Re:this isn't ipv6 related by asdfghjklqwertyuiop · · Score: 1

    you already can connect between home and work to your own block of ips.
    just set up a vpn tunnel, and assign your 10.x.x.x addresses and set up routing through it.


    And as you want to connect to more and more networks, you'll find you need to centralize allocation of network addresses, you'll run into portability and route table size issues, and you'll eventually run out of space in 10/8 to use, and at that point you realize you didn't solve the problem at all, you just duplicated it on a smaller scale.

  34. "Intellectual Property" vs National Interests by MacDork · · Score: 3, Interesting

    Can you guess the winner? Did Germany pay the Wright Brothers royalties on their intellectual property? How about the USSR and the A bomb? India and AIDS drugs? The very notion that an idea can be owned by any one person or corporation is absurd. As for the alleged wholesale plagiarism, well... that's karma for you. It serves Cisco right for helping build the great firewall of China. I feel no pity for them.

  35. china by fudy · · Score: 1

    They are comunists ! they can`t do nothing right! They are EVIL !

  36. high perfomance filtering, blocking and logging by sonictheboom · · Score: 1

    maybe you need really high performance router if you are doing lots of filtering, blocking and logging ???

  37. Re:One Thing China Needs to Develop and Rollout by iamacat · · Score: 1

    Well, China requires website/IM operators and owners of Internet Cafes to self-censor their contents, monitor discussions and report people who mention certain topics to the authorities. This will not be feasable if a million of individuals run their own little servers. People will be able to have forbidden discussions using someone's obscure personal blog script with no relalistic chance of being caught.

    Now, I don't know if currently there is a regulation that bans an individual from having a routable address. But if enough people do, one of them will cause a problem sooner or later and then there will be a crackdown.

  38. Article misses main benefits of IPv6 by SgtChaireBourne · · Score: 1
    I cannot believe there were so many errors in an article which is only 358 words long. What a bad piece of journalism. Only 81 words are devoted to the China new item, the rest ss background on IPv6. The IPv6 information is riddled with errors
    Probably some crap article from a few years back got stuck in the vertical file and keeps getting resurrected every time some journalist wants some background information on IPv6. I'd rather think that than say there is some agenda to keep people in the dark.

    This and other articles neglect the main reasons to go with IPv6:

    + better security + simplified headers + quality of service + multi-casting + improved routing + geographically mobile IP numbers + autoconfiguration Firewalls can be done with either IPv4 or IPv6, no big deal there. Oh, and NAT != firewall. It can't be that after all this time the so-called journalists can't get their teeny minds around all the above.

    China's on a roll. This is good. But the article sucks, she can write better.

    --
    Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
  39. Re:this isn't ipv6 related by MightyMartian · · Score: 1

    And you probably shouldn't be let anywhere near a monitor, as you seem to be incapable of reading.

    I never said Cisco was inferior to Linux. We're a small outfit, and money spent to upgrade our existing *older* Cisco equipment to IP6 could be much better spent elsewhere. Linux does a damn good job on routing, and is a lot cheaper than Cisco.

    You must be a Cisco employee, because Linux routing and iptables/netfilter are not unknowns. Cisco ain't the only equipment in the world, but it sure is among the most expensive.

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  40. Blog on Internet in China by fatblock · · Score: 1

    Hi all, I'm blogging news on the development of the internet in China. I hope that it's useful and interesting to some of you. http://china-netinvestor.blogspot.com/ fatblock