The exhaustion of IPv4 address space

FireFury03 writes "Cisco has an interesting article talking about estimates for the exhaustion of the IPv4 address space, and the inevitable move to IPv6. It predicts that the IPv4 address space will be exhausted in 2 - 10 years and suggests that it isn't worth trying to reclaim old allocations. With the mainstream use of IPv6 now potentially within the ROI period of many products the manufacturers need to start including support, but will the ISPs roll out native IPv6 networks before they absolutely have to? IMHO, ISPs providing native IPv6 support would be a Good Thing since it opens up the door for peer-to-peer technologies such as SIP without needing nasty NAT traversal hacks, but a major stumbling block seems to be a complete lack of IPv6 support on current consumer-grade DSL routers (tunneling over IPv4 is an option but requires more technical know-how from the end user)." Of course, Cisco may have some vested interest in driving up the IPv6-compatible router sales *cough*, but the bottom line is that the transition will have to happen at some point in the near future.

Comments

Interesting

[Legendof_Pedro]

Interesting, but is 2 - 10 years as precise as they can be?
8 years seems to be a long time, to me...

Re:Interesting

[Psiolent]

is 2 - 10 years as precise as they can be

In the article, this range comes from the fact that the data can be fitted to different curves, resulting in a different timescale. Some of the curve fitting I saw in the article used polynomials, exponentials, and linear functions.

Re:Interesting

[Profane MuthaFucka]

Good eye. That's a huge range. When you're talking about small numbers it makes a bigger difference too. When they say 2-10 years, that's much more fuzzy than a prediction of, for example, 102-110 years.

It's almost like me saying that any random new car model from Detroit will get between 20 and 100 miles per gallon. We all know how fuzzy EPA figures are, but even those are more precise than Cisco is here.

Re:Interesting

[kihjin]

2 - 10 would be -8 years. So this already happened, 8 years ago.

Welcome to Slashdot.

Re:Interesting

['nother poster]

And nobody did a thing about it until about 1997.

Re:Interesting

[rubycodez]

yup, 8 years ago they were saying the ip4 space would be exhausted in next 5 years. Heck, I sat at a presentation on IPng in 1994 where that was said. At least such a statement is more true now than it was then, but I'll bet reclaiming old absurdly huge allocations of IP space could push this out beyond 10-12 years.

Re:Interesting

[Anonymous Coward]

The REAL question is whether IP drilling operations in ANWR, Alaska will buy us any time. What about our strategic reserves? I believe our goal should be to reduce dependence on foriegn address space.

Re:Interesting

[LilGuy]

Just imagine a world where all the address space is shared and free... we could go back to not thinking about Alaska *EVER*.

Re:Interesting

[Anonymous Coward]

2-10 years?? Sounds like a Microsoft release timeline.

Re:Interesting

[Hizonner]

Yeah, they said the address space would be exhausted AND THEY WERE RIGHT. The only reason we're not out of addresses now is that people made a fundamental change in the network architecture by deploying NAT (primarily because IPv6/IPng wasn't ready), and using RFC1918 private addresses. NAT is a nasty kludge that breaks all kinds of things. Furthermore, NAT has been done, so it's not going to save us again.

Re:Interesting

[Cramer]

It's "not worth it" simply because of the greedy bastards hoarding those /8's. Let's see who is hoarding all that space...
003/8 - GE
004/8, 008/8, 046/8 - BBN
009/8 - IBM
015/8 - HP
016/8 - DEC
017/8 - Apple
018/8 - MIT
019/8 - Ford ...
045/8 - Interop Show Network !!

And then there's the US GOVERNMENT with 8+ /8's -- more if you count the number of big contractors holding /8's.

Re:Interesting

[AuMatar]

But no buisness will ever implement a v6 address when v4 users can then not access them. It would incredibly stupid. Thats why we can't just stop handing out v4 addresses.

Its not like there aren't plenty to go around still- HP owns 2 class As now, and a handul of universities own a full A as well. Reclaim a major portion of them for reuse.

Re:Interesting

[Cramer]

BBN... currently known as Level 3 Communications.

They were one of the first movers and shakers in the internet industry 20 odd years ago.

Re:Interesting

[leathered]

More worrying is that Iran are now believed to be in posession of a /24 subnet and are seeking to enrich it to a /16.

Re:Interesting

[Detritus]

Greedy bastards? I'd call them pioneers. They helped create the Internet.

Your comment reminds me of the people who will buy a house next to a rural airport and then complain about the noise and try to shut it down.

Re:Interesting

[wildsurf]

The REAL question is whether IP drilling operations in ANWR, Alaska will buy us any time.

Yes, the range could certainly be extended by adding a few drill bits.

Re:Interesting

[Pii]

Couple things...

First - Hearing people talking about Cisco, and other companies, drumming up hype so that they can start selling new-fangled IPv6 capable routers is getting old... The Cisco router you already have will do IPv6 today. It's a software change.

Second - Why do people seem to insist that by turning on the IPv6 website, somehow that will prevent people from accessing the IPv4 website? So many ways to address this: Enabling a second network stack on the existing host; Standing up an additional server to host the IPv6 version; putting a 4to6 gateway in front of the website...

IPv6 is coming. It's going to be a difficult transition, but the sooner it happens, the better for us all. Doing it sooner means less "transition work," because the installed base continues to swell.

Re:Interesting

[Ernesto Alvarez]

yup, 8 years ago they were saying the ip4 space would be exhausted in next 5 years. Heck, I sat at a presentation on IPng in 1994 where that was said. At least such a statement is more true now than it was then, but I'll bet reclaiming old absurdly huge allocations of IP space could push this out beyond 10-12 years.

The address space in 1994 really was almost exhausted. What you saw at that conference was 100% true. They made a plan consisting of a long term solution, and a short term one.

IPv6 was the long term solution, and the idea is to eventually start using it.

What you seem to have missed is the short term solution, CIDR. The idea behind it was to take all the unused address space (and reclaim another addresses too) and allocate them in a less wasteful manner.

And yes, IANA should reclaim those /8 assigned, nobody has that many hosts. They probably will if the situation gets desperate enough.

Already rolled...

[jamesgamble]

Most of the major ISPs have already rolled support for IPv6. They started the rollout about five years ago when the lack of IP address began to be a problem. I know for a fact that Sprint is ready to roll it, they are just waiting for other networks to support it. T-Mobile is also ready to roll it as is AOL. It's not really a big deal. It's already been done. Everyone is just waiting to push the big red button and turn on the support. Hell, even Windows supports it.

Re:Already rolled...

[FireFury03]

Everyone is just waiting to push the big red button and turn on the support

Why do you need to wait to turn it on? IPv4 and v6 can run side by side. I've been running v6 for a few years using 6to4 tunnelling to provide connectivity since my ISP doesn't do native IPv6... infact I haven't seen *any* ISP (in the UK) offering IPv6 connectivity over DSL. Just providing a 6to4 anycast gateway on their core network would be a start.

Re:Already rolled...

[jamesgamble]

Of course they can run side by side, but why turn it on now when it isn't absolutly necessary? We can still use IPv4 until it reaches critical mass. There's really no point in causing more headaches for support groups it's really needed. Right now, companies really don't need to. They can still wait a year or two to perfect their infrastructure.

Re:Already rolled...

[Spetiam]

All I know is that if, once my broadband ISP serves up IPv6, they want to charge me extra for a static IP, I'll be pissed.

Re:Already rolled...

[jguthrie]

What DSL routers or CableModems work with IPv6? It doesn't matter if I can buy a OC-512 with IPv6 if "Joe Sixpack" can't get it through his cablemodem. Sure I can get (and, in fact, have gotten) an IPv6 tunnel for my network, but that means that my IPv6 throughput sucks.

Since demand for addresses necessarily comes from the leaf nodes of the network (where the bulk of them are consumed) rather than the backbones, I think it is disingenuous (to say the least) to claim that IPv6 is already "rolled out" because it is available from various backbone providers when the reality is that it is not available directly to the end users.

Re:Already rolled...

[comcn]

Try Andrews and Arnold. I've had IPv6 (via a tunnel from their network) for the last two years with them. Native IPv6 (without a tunnel) is integrated into the new router they are developing, and should be live by the end of the year (only problem is finding an ADSL router that will support it, but you can use an ADSL modem and Linux, for example).

Re:Already rolled...

[fm6]

Why do you need to wait to turn it on? IPv4 and v6 can run side by side.

If they run it, they have to support it. Not an extra expense they'll want to bear before they need to.

Everybody seems to think that the added costs of a new software product end with deployment. Not so.

Re:Already rolled...

[Waffle Iron]

hey moron, the reason you get charged for a static ip is not because of the lack of ip's, but because of the extra labor required to manage your static ip

No it's not. The reason they charge more is because they're charging what the market will bear. They figure if you want a static IP, you're trying to run some kind of server, and you're probably willing to pay more for it.

If IP6 effectively gives every device in the world a static IP, then the upsell oportunities associated with the witholding of static IPs by the ISPs go away. That's why I don't see many ISPs supporting IP6 any time soon.

Re:Already rolled...

[julesh]

If they run it, they have to support it.

Not necessarily. Many ISPs provide non-core services that they don't offer support for; for instance, my ISP runs an NTP server, but the only support they provide is a single web page giving details of its address; if you phone up the tech support people and ask about it, they don't even know it exists.

Because it isn't advertised as part of the provided service, they don't have to support it. An IPv6 gateway would be similar -- all they need to do is put some text somewhere telling you how to access it, and warning you that it's an experimental service. If it stops working sometimes, that's your problem for using an experimental service.

I can't understand why...

[saskboy]

Why don't more routers that are sold today tout their IPv6 compatibility? Are they not compatible with the new protocol? If not why not?

NATs at home can only hold IPv4 together for so much longer. Soon a killer ap will come out that just doesn't want to be NATted, and the whole Internet using public will demand direct addressing [at least they'll demand a solution that requires direct IP addressing].

Re:I can't understand why...

[pete6677]

Why don't more routers that are sold today tout their IPv6 compatibility?

Because IPv6 isn't yet a buzzword that non-technical buyers are looking for. This will probably change in the next few years when the business world becomes concerned with it. Once a company CIO hears that his internet connection will die without IPv6 support, there will be a huge marketing effort on the part of Cisco and other router makers.

Re:I can't understand why...

[xappax]

I know that Azeurus happily opens up a few ports on my router every time that I start it up. Whether this is a good idea security wise is another story...

NAT is not a security tool.
NAT is not a security tool.
NAT is not a security tool.
Network Address Translation was never intended to function as a firewall or a packet filter, it was designed exclusively to allow multiple computers to share the same IP at once. That's it.
The fact that NAT has some side effects which are similar to a firewall has been a big problem for network security, because it leads users and even administrators to believe that their network does not need a firewall because they use a NAT system.

We are finally, after many years, starting to see real firewall use become commonplace, and a XP even has an automatic software firewall now, but if it hadn't been for NAT, I bet people would've been implementing real, security-focused firewalls a lot earlier.

Re:I can't understand why...

[petermgreen]

afaict most home nats are similar to the most basic config of a statefull packet inspection firewall. That is they let you connect out but don't (at least easilly) allow connections in.

the problem is of course that you wan't some connections coming in but not others (because of chronically insecure lan protocols etc). UPNP helps to some degree as generally only internet orientated applications use it leaving stuff thats only safe for lan protected. another option is to manually open the holes but this is a pita for experianced people and basically impossible for the masses.

the final possibility is software firewalls. Theese work good at controlling what apps can be accessed from the internet but running on the pc you are trying to protect leaves them vulnerable to interferance from malware.

Re:I can't understand why...

[mrchaotica]

Why don't more routers that are sold today tout their IPv6 compatibility? Are they not compatible with the new protocol? If not why not?

You know what's really ironic? Not even the Linksys WRT54G, which is made by Cisco, supports it with the default firmware.

Is NAT Better?

[HugePedlar]

I remember reading a while ago that NAT actually turned out to be better than IPv6 by virtue of it "solving" the limited number of addresses problem and simultaneously providing a defence against simple hacking attempts by hiding your real IP address.

Can anyone explain whether this is true or not and why?

Re:Is NAT Better?

[pixelpusher220]

There's no technical reason you can't 'NAT' your IPv6 address is there?

The majority in new IP address growth comes from all the future gadgets, your house, the washing machine, fridge, etc. So PCs can still 'hide' behind a NAT if they need protecting.

Re:Is NAT Better?

[amalcon]

The one "benefit" of NAT over IPv6 is that you can't access ports which aren't forwarded to that computer. i.e. it basically acts like a firewall, but potentially a little weaker because it isn't designed to be a firewall. As IPv6 doesn't keep you from having a firewall, this is almost moot. It's not entirely moot because home users who have NAT would not always consider having firewalls. The benefits of IPv6 are numerous, however.

Re:Is NAT Better?

[phoenix.bam!]

NAT is not defense. The stateful firewall is defense. You can use stateful firewalls on IPV6 also and there is no reason that consumer grade routers would not include the firewall.

Re:Is NAT Better?

[fyonn]

I remember reading a while ago that NAT actually turned out to be better than IPv6 by virtue of it "solving" the limited number of addresses problem and simultaneously providing a defence against simple hacking attempts by hiding your real IP address.

well, it's not "better" as such, just a different solution. NAT is not a golden bullet though. Yes, it does, by and large prevent random machines on the internet directly contacting your unpatched windows desktop at home, but a firewall will do that too, and virtually every dsl router has a firewall these days too. I would like to see home dsl routers supporting native ipv6 but I don't know of any.

I think that ipv6 is a good thing to go for, but it's not finished (but then, is ipv4? :). there's lots of advertised features for ipv6 (mandatory encryption, mobile ip etc) that are good on paper, but aren't all that in the real world.

Mandatory support for ipsec is great.. except how many of us would use it? as there is currently no support for mndatory ipsec encryption to unknown strangers. you've got to be pre-configured for crypto. I'd like to see something like ssh. if you know the key then great, if you don't then you can accept and save one and then while you may not have verified the destination, you're at least protected on the wire. yes, they also need to sort out authentication and perhaps some form of certificate distribution, but lets make a start on something useable.

mobile IP. sounds great! I can be using my ipv6 pda via my mobile phone and as I walk into my house, it picks up my wireless net and my downloads speed up instantly, all the while not dropping the voip call I'm making. or I'm using a laptop on the train and as it flits from hotspot to hotspot I don't lose any of my connections. sounds great! how does it work? you tell me, details are not easy to find. ots of talk, few working implementations (if I'm wrong, please tell me, I'm genuinely very interested).

working with networks as part of my job, I know how useful and really annoying NAT can be, and I really think it should be an option, not a requirement. I'd love to see ipv6 rolled out and see what changes it brings, but I also think it needs a fair amount of work still.

dave

Re:Is NAT Better?

[theCSapprentice]

It is true that NAT can hide your IP, but it depends on how it is configured. The whole point of using NAT is to route un-routable Ip addresses, like 192.168.0.1, on the internet. Depending on what you want and need, NAT can be done in three different ways:

STATIC: this is when the router assigns one routable address to one non-routable address. This 'hides' your IP address, but as the new address always points to your real one... Well you get the idea

DYNAMIC: this selects a random routable address from a 'pool'. The assignment is temporary and this will hide where your requests are coming from. But as the pool is a range of addresses given to you offically, it wouldn't be hard to find who was using them.

DYNAMIC-PORT: this uses only one routable IP, but translates all of the non-routable IPs onto different ports for each connection. The appearence is of one computer making many connections.

I hope this helps.

Re:Is NAT Better?

[FireFury03]

I remember reading a while ago that NAT actually turned out to be better than IPv6 by virtue of it "solving" the limited number of addresses problem and simultaneously providing a defence against simple hacking attempts by hiding your real IP address.

NAT in itself doesn't provide any extra security - the connection tracking needed by NAT is what provides the security (and you can do this equally well without using NAT). I wrote an article on this subject a while back.

Whiles NAT does to some extent "solve" the limited number of addresses problem, it also creates many more problems. The Internet was designed to be peer to peer but NAT turns it into a client/server model. Whilest client/server works fine for "traditional" applications such as web surfing, it's a major stumbling block for peer to peer services such as VoIP, which have to employ various hacks to trick NATs into letting the peer-to-peer traffic through (with varying degrees of success). The likes of Skype are designed to hijack the connections of random Skype users who don't have NAT and use them to route traffic between peers who do have NAT when the NAT traversal hacks fail.

Re:Is NAT Better?

[ryanvm]

NAT is not defense. The stateful firewall is defense.

NAT *is* a stateful firewall. That's how it works. It has to keep track of outgoing connections to remap those ports on the external interface. No outgoing connections == no port remapping on the external interface.

If you disagree, then explain to me how one could connect to a machine behind a NAT device if said machine has initiated *no* connections to the Internet. Sounds like stateful filtering at work.

Now, stateful firewalls are just as easy to implement on IPv6, so NAT is certainly not a valid reason for sticking with IPv4. But NAT is indeed a stateful firewall.

Re:Is NAT Better?

[LordSnooty]

The majority in new IP address growth comes from all the future gadgets, your house, the washing machine, fridge,

Ah yes, the fabled "Internet Devices". When will the companies realise that I have no need to control my washing machine from the other side of the world, or from work, for that matter. I survived this long without the useless feature, I think I'll manage. For nearly a decade I've heard about IP-enabled white goods, in that time I've seen precisely one device, an IP fridge. And it still can't ring up Tesco's & place your order.

Re:Is NAT Better?

[MSZ]

The benefits of IPv6 are numerous, however.
Cisco marketing rep:
NOBODY expects the IPv6!
Our chief benefit is length... greater length of the packet header and and unrememberable addresses...
Our two benefits are greater length of packet header and unrememberable addresses... and rewrite of all network apps....
Our three benefits are length of packet header and unrememberable addresses... and rewrite of all network apps.... and an almost fanatical devotion to some broken standard....
Our four... no...
Amongst our benefits... Amongst our array of benefits... are such elements as greater length of packet header and unrememberable addresses...
I'll come in again.

But seriously, if IPv6 was so good, it would not require so much pushing. If the IPv4 exhaustion was real and imminent, it would not rquire so much pushing.

Re:Is NAT Better?

[fm6]

...[NAT] basically acts like a firewall, but potentially a little weaker because it isn't designed to be a firewall.

Weaker how? If you can't address a node, how can you attack it? Not having your systems in the public IP space may limit your functionality (such as not being able to run P2P applications), but I don't see how it's less secure than the complicated (and thus fallible) filtering rules in a "real" firewall.

Re:Is NAT Better?

[freidog]

IPv6 implements some nice features that aren't aimed at a larger address space.
IPv6 provides for priority and quality of service information in the packet, allowing for better priority based routing.
It also doesn't permit for fragmenting packets, which makes life easier for both routing and stitching it back together at the destination.
And distrobution of the addresses is done more fairly. It's not the US and western Europe (to a lesser extent) grab the address space they'd like and the rest of the world can scrounge for what's left.

NAT does blur the line between Network layer and transport layer somewhat. NAT uses TCP or UDP ports to do routing. Good design would dictate that independant modules of a system should stay indepedant, NAT doesn't do that. Not that it's really a big deal here, there's not much change of a new transport layer protocol grabbing hold anyomre.

Re:Is NAT Better?

[saikatguha266]

Actually, NAT is better because it provides address space isolation. If your organisation has 500 computers that all have a public IP address, it is harder for you to switch providers (500 IPs is too small to get your own address space for). When you switch your provider, you have to renumber all hosts, fix config files, fix DNS servers etc -- a royal pain in the ass. A NAT allows your to keep your internal structure exactly the same while you switch providers. That address isolation is very important for small-mid sized companies.

Second, NAT helps multihomed corporations. For large companies, your 10k hosts are going to be distributed over many states/countries/ISPs ... and each site advertising its own address space is expensive for the ISP's because they cannot perform route aggregation (since your address space may not line up with the address space of each ISP). NAT solves this by having each site be NAT'ed behind that ISP's IP address (convinient for the ISP, cheaper for the company). The internal company network runs in the private space and when traffic crosses to the public internet, it gets an IP from the ISP it came out of ... consequently replies come back in through the ISP. Read: If you send a packet out of India, the response won't come back inthrough America ... which would otherwise require you to then forward it to India through your company's routers.

It is this address isolation and multihoming support that drives NAT use in small and large companies. Address space depletion has nothing to do with it. IPv6 does not fix these problems; companies will continue using NATs because NATs do.

Re:Is NAT Better?

[mrmagos]

A modern firewall (including consumer-grade routers) use Stateful Packet Inspection, which will help defend against varoius man-in-the-middle attacks, while NAT does not. NAT alone will still be susceptible to replay and injection attacks, while a SPI firewall will be able to detect and block such an attack. Besides, you can have a very effective firewall that only has a couple rules, as long as you aren't running any boxes you want accessible from the Internet.

Re:Is NAT Better?

[Gr8Apes]

NAT and firewalls (FW) are 2 separate things, as you can have NAT without a FW, and you can have a FW without NAT. Now, NAT, by its nature, inherently has some features in common with FWs, such as that it effectively hides ports unless they're mapped.

A second item is that moving to IPv6 will not necessarily remove NAT or the current 1 router many PCs setup so many of us have. ISPs in general have charged per IP connection/computer, considering each IP a separate computer. Do you honestly think that will change with IPv6? That ISPs are going to be nice and just let you wire up however many systems you want to their network?

I don't think they'd give up that type of revenue stream. (Besides, think of the security nightmare of locking down and managing security for all those items, like your refrigerator! You'd want some sort of appliance FW/NAT box, both to secure you and keep you from paying extra each month. The latter would be the selling point for most normal users.)

Re:Is NAT Better?

[michrech]

You, sir, are a moron.

There's nothing inherently more secure about NAT, it's just the way it's set up on most home routers. As a little experiment you can take a Windows box and put it in the "DMZ" of a normal home NAT box, which means that all ports and protocols get forwarded to it, just as if it was sitting on the public internet itself. It should end up getting owned by viruses and spyware just as quickly as if you plugged it into the modem, even though it's subject to NAT. The point being: the address translation isn't providing any security itself, its only because it's being applied selectively.

Of COURSE the Windows machine will get "owned" (as it were) if you TELL your FIREWALL/NAT device to forward all unexpected incoming connections to it!

Here. I've got one for you. Here's a condom. You can wear it while you have sex with whatever partners, but there is one particular partner for which I'm going to poke a hole in it for you.

Geez..

Re:Is NAT Better?

[Armour Hotdog]

Login: kenmore
Password: admin

Welcome to your Kenmore Refrigerator administration console! Please choose from the following options:

1. Refrigerator compartment configuration
2. Freezer compartment configuration
3. Ice maker configuration
4. Fault generator configuration

>4

Kenmore Fault Generator (tm) configuration menu. Please choose from the following options:

1. Enable random grinding/creaking/moaning noises
2. Enable random blowing/dripping noises
3. Enable random refrigerator temperature fluctuations
4. Enable random freezer temperature fluctuations
5. Enable strange odor generator
6. Enable random faults from all categories (recommended)
7. Disable faults when human detected in proximity to refrigerator (recommended)

>

Re:Is NAT Better?

[Frank T. Lofaro Jr.]

IP address exhaustion is like Peak Oil.

There is a time where the problem is looming, but taking action then will mitigate a lot of the damage.

Or one can wait until it is having severe impacts, and then we will all be hosed very very badly.

Re:Is NAT Better?

[FireFury03]

Weaker how? If you can't address a node, how can you attack it?

Well, ignoring the fact that there _are_ ways to defeat NAT (although they usually require cooperation from hosts behind the NAT anyway), one notable weakness is that you're relying on your ISP to get things right, and relying on someone else's cluefulness is always bad.

What I mean by that is, given a network like:

      PC (192.168.0.1) ------ (192.168.0.254) Router (1.2.3.4) ------- ISP

Assuming 1.2.3.4 is a global scope address and 192.168.0.0/24 is site-local. The router is doing NAT, all well and good. However, if the ISP somehow ends up routing traffic destined to 192.168.0.1 to your router (for exacmple, a routing cockup on their end) then most consumer grade routers will just let it right through because they don't explicitly block incoming traffic.

Admittedly it's unlikely this would happen, and only nodes reasonably close to you would be able to take advantage of the routing. However, I still maintain that trusting a third party as part of your network security is a Bad Thing.

but I don't see how it's less secure than the complicated (and thus fallible) filtering rules in a "real" firewall.

Firewall rules don't have to be especially complex - a firewall that does the same job as a NAT (security wise) but provides protection from the above problem is simply a connection tracker configured to drop incoming connections. Infact, since a NAT is basically a connection tracker with some more stuff shoved ontop it could be argued that the NAT is more complex and thus more fallible.

Re:Is NAT Better?

[SquadBoy]

Well yes. But, security, like ogres, onions, cake, and parafait should have layers. NAT provides a, yes rather weak, layer. But it is still a layer. So doing both is a good thing.

Re:Is NAT Better?

[FireFury03]

Mandatory support for ipsec is great.. except how many of us would use it?

Well, all those businesses that currently shell out rediculous amounts of money for VPN solutions I suppose. Things will get more interesting if DNSSEC (shoving X.509 certificates in DNS records) gets widespread and easier to use - at the moment it's horrendously complex to set up.

I think in the long run it'd be nice to use IPSEC with DNSSEC instead of SSL, etc. There are some advantages - for one thing, once the keys have been negotiated between 2 hosts then that's it (until they expire), no having to renegotiate the encryption for every connection with the associated multiple round trips needed. Of course it'll cause firewall administrators a headache since they can nolonger filter packets by port number.

Re:Is NAT Better?

[asdfghjklqwertyuiop]

Exactly. What the H*ll is a packet with a source or destination IP address of the private address space doing on the public internet? Why don't ISP's filter this crap at its source, the networks edge, instead of making me deal with this fluff.

They do. That doesn't save your ass in these situations:

Scenario 1: ISP gets hacked. Attacker sets up routes to your internal network. Attacker now has full access to your network and never even needed to lay a finger on your "firewall".

Scenario 2: Broadband ISP has everything set up such that the outside IPs of all customers in the area look like they're all on one big ethernet. Road Runner (Time Warner's cable ISP) works this way. Other customers in the area can set up routes to your LAN right on their own routers.

And people who consider the security of their own networks "fluff" are better off not being connected to the internet at all. They're just providing connectivity to that many more spam/ddos zombie hosts.

And for the record, have you actually tried this little experiment?

Yes.

most devices I know of would just drop that clearly troubled packet in the old bit bucket, not carefully move it to the "right side of the fence".

Most devices you know of (ie, cheap consumer broadband routers) are not capable of being confiugred to perform NAT without filtering, at least not through the idiot proof web interface (and that's certainly a good thing).

Re:Is NAT Better?

[QuantumRiff]

Actually, while not directly connected to the internet, a College I work with has started to move all of their classroom flouresent lights to IP addressable dimmable balasts. This enables them to adjust the light, depending on the ambient light coming in from the windows, having certain lights dim when the network gets a broadcast saying the networked projector is turning on, alert maintenance when a light burns out, alert someone to the fact that the lights have turned on at 3 am and maybe security should head over and check it out, and other fun stuff.. Also, all their sound is now over IP. I know, this is not "over the internet" and does use private IP address space, but still, there are more IP devices coming out than you would think..

Re:Is NAT Better?

[quantum bit]

Since you had a clue when you set up the network (right? :), all your addressing is done through DNS and your machines are configured by DHCPv6 or the native IPv6 router discovery protocol (which is part of the IPv6 stack), so just changing the prefix on your router and in DNS will cause your entire network to migrate over to the new network automagically.

Hahahahahahahaha, yeah right!

DHCP has been a internet standard RFC for what, 8 years now? DNS for over 20? And yet there are still brand new devices (copiers, network timeclocks, etc) that don't support either standard correctly. Devices which don't even work correctly with DHCP and IPv4, which have to be statically assigned and addressed by IP address because the vendor's crappy software won't do DNS lookups for some unknown reason. Or that claim to support DHCP, but in reality request a lease once and never try to renew it.

As much as I'd like it to be true, corporate networks are not in any way ready to go fully dynamic. Renumbering, whether with IPv4 or IPv6 will always be painful. IPv6 makes it worse since it strongly discourages private address space.

Re:Is NAT Better?

[Spy Hunter]

Wrong. Firstly, IPv6 provides support for automatic network renumbering, which solves the real problem instead of hacking around it with a band-aid that ultimately changes the network architecture. Switching ISPs with IPv6 is easy. Secondly, your multihoming example doesn't require NAT at all; why would it? Each site uses its ISP's address space, and you can set up your internal routing however you like.

Re:Is NAT Better?

[shreak]

Here's one that's not layer 3, and isn't an application bug and NAT takes a huge crap all over it.

I have a control stream (TCP/UDP doesn't matter) that I can successfully set up from within my NAT'ed network to an external machine. This control stream signals that we're going to set up two media streams, one from me to him, and one from him to me. They're over UDP.

I send him the port # I'm opening on my machine to receive the stream he's sending.

I never get the media he's sending. Want to know why?

Because I opened port 20057 on my machine but nothing happened on the NAT machine who is refusing to relay the media.

Many protocols use this technique and have to jump through hoops to get it to work through NAT.

NAT good riddance!

=Shreak

Re:Is NAT Better?

[illegalien]

But seriously, if IPv6 was so good, it would not require so much pushing. If the IPv4 exhaustion was real and imminent, it would not rquire so much pushing.

Haven't you learned anything from GWB: being proactive is better than waiting for "real and imminent".

Seriously... it is better in this case to be proactively preparing for the transition than to one day realize we *really* need IPv6 and are not capable of making it happen effectively. No one is saying it has to be a hard and fast cutover today. I don't see anything wrong with getting some momentum going and starting to work out some unexpected kinks before the need is *real and imminent*.

Re:Is NAT Better?

[asdfghjklqwertyuiop]

Perhaps your point isn't clear. The cheap NAT gateways (actually PAT, see below) everyone else is talking about don't do this (ie are secure), but I assume you are refering to a larger scale Cisco Router that a begining network admin might activate NAT on thinking it will secure him.

Yes, that's right. But most of the cheap NAT gateways probably function that way interally also. It is just the web interface that prevents you from setting it up in that way.

For example, a number of linksys routers run linux. Linux can definitely be configured to NAT and NAT only, and it won't drop a thing. It is just the linksys web interface that prevents you from configuring it that way.

Honestly, your concerns sound like a seriously broken NAT implementation. If the "device" is not explicitly listening for the private IP address on the outside interface, why the heck isn't it dropping the packet thats not meant for it?

It isn't broken. It just isn't a function of NAT to decide to drop or accept packets. NAT just rewrites or does not rewrite. In just about every type router there is, NAT and firewalling are separate and distinct things. The NAT standards don't specify dropping packets if they can't be rewritten, and it is just good design to keep those things separate. It gives you more flexibility and power and makes debugging easier.

The decision wether to drop or accept is a function of the firewall.

There's nothing broken about a NAT implemenation that only Translates Network Addresses. It would be broken if it ever did more than that.

Re:Is NAT Better?

[asdfghjklqwertyuiop]

That's a weakness that NATs share with firewalls. So you're hardly making a case for NATs being weaker than firewalls.

No it isn't. No correctly set up firewall will be susceptible that type of attack where the ISP makes your network routable.

On the other hand, if you aren't using a firewall, every kind of NAT will be susceptible to that because NAT alone doens't drop any packets, ever. It just translates or does not translate.

Love that quote

[Matey-O]

"and suggests that it isn't worth trying to reclaim old allocations."

Isn't worth it to whom?

Re:Love that quote

[Cheeko]

HP? IBM? MIT? Or anyone else who has a nice class A all to themselves ;) HP I belive actually has two (the original HP 15, and the old DEC 16). These companies/institutions will never run our of v4 addresses, so they likely will only push as hard as they are made to by their partners/customers.

Re:Love that quote

[Kadin2048]

Well if you look at the List of Class A address allocations you'll see some possibilities of people who might not be interested.

In particular, Level 3 Communications has not one but two Class A blocks, the 4.0.0.0 and 8.0.0.0 blocks; "Comcast IP Services" has another one.

There are some oddball Class A assignments on there too. Who would have guessed that Ford has one? The US Postal Service? The Defense Department has something like seven, not a huge surprise given when the assignments were made. Halliburton even has one.

Anyway, reading down the list you can see that the people who already have their own Class A blocks are unlikely to care too much about how quickly v6 gets rolled out, at least for their own use. But some of the newer big-time tech companies who aren't on that list might have more of an interest ... Cisco, for instance, is not on there.

Dupe.

[haeger]

I know I've read this statement atleast yearly for the last 2-10 years.

.haeger

It's a race!

[Anonymous Coward]

Will *BSD die before the switchover to IPv6? Maybe a good Slashdot poll:

[ ] Yes
[ ] No
[ ] Microsoft
[ ] I don't know what IPv6 is, but I'll post anyway
[ ] Cowboy Neal encodes my packets

Re:It's a race!

[Anonymous Coward]

[ ] Depends on if Duke Nukem Forever supports IPv6

Re:It's a race!

[Nom du Keyboard]

[] Profit!

Re:It's a race!

[aurb]

[ ] Only if Netcraft confirms it.

concurrent operation of IPv4 and IPv6?

[pixelpusher220]

I'd say this is going to be a huge test of the internet and all the various pieces.

Can IPv4 and IPv6 coexist? When do the root servers transfer over? (have they already?) If they can co-exist, what's the motivation for *everyone* to switch?

What happens to smaller countries that don't have the resources to make hardware changes to keep up to date.

From a laymen's perspetive this seems a lot like Y2K in terms of the scope of changes required.

Re:concurrent operation of IPv4 and IPv6?

[Vorondil28]

Can IPv4 and IPv6 coexist?
Yes, in fact they are expected to for around two decades. Can't seem to find the link to the RFC I read it int. Anyone?

When do the root servers transfer over? The root servers already support name resolution to IPv6 addresses. There was a /. story about it a while back.

If they can co-exist, what's the motivation for *everyone* to switch?
I guess we'll see. I think it will just be up to the vendors (read: Cisco ^_~) as to when they drop IPv4 support.

What happens to smaller countries that don't have the resources to make hardware changes to keep up to date.
Twenty years is a long time.

From a laymen's perspetive this seems a lot like Y2K in terms of the scope of changes required.
When you look at how much work has to be done, your right, but in this case, there's not a moment that we're approaching when everything will blow up if it's not switched over.

Re:Interestingly precise

[saskboy]

2-12 years is as precise an answer as Rummy can give about the Iraq insurgency lasting. If it's good enough for the main stream media, it's good enough for average joe six pack me.

Dick "Netcraft" Cheney: I think IPv4 is in its last throes.

This is NOT a technology problem

[glengineer]

It's a bureaucratic one. The manufacturers aren't going to spend time and money to make their products until it either makes business sense (Cisco, Microsoft) or they are forced to (TV stations that are having to support HDTV).

for anyone who can't tell wtf is going on

[s388]

TFA didn't help me get much of a clue. I tried reading it, and I said to myself: "aren't there one trillion possible IP addresses, available in principle? (minus 1)" just because of the 12-digit IP addresses i'm used to.

"The IPv4 address space has 32 bits, limiting it to an absolute maximum of 232 (roughly 4.3 billion) possible addresses. For both administrative and technical reasons (the latter in large part being related to routing), IPv4 addresses are allocated in blocks which are restricted to sizes which are powers of 2; this leads to many addresses being unused at any given time. In addition to this, substantial parts of the IP address space are not easily usable because of early technical decisions reserving them for private network use, loopback addresses, multicast, and unspecified future uses, which has resulted in some of these limitations being programmed into devices; working around these limitations will require substantial amounts of re-engineering to increase the amount of available address space. Finally, some of the IPv4 address allocations made early in the development of the Internet (in the 1970s), when only blocks of 224 possible addresses (called a /8 in IPv4 address terminology) were supported, led to some institutions that were involved in the development of the Internet having disproportionally large allocations. MIT, for example, has an entire /8 block allocated to it (224 addresses, about 0.39% of the whole internet address space) and various US Department of Defense agencies have several such blocks."

THANK YOU wikipedia.

Explanation requested

[dubdays]

Besides the huge amount of fully routable IP addresses IPv6 will open up, what are the benefits to the average end-user? I mean, will anyone accessing a 4 Mb cable connection through NAT really notice any difference by upgrading? Even large corporations, who also use private IP address space, (as far as I know) don't need fully routable addresses for every machine. So, what exactly is the major benefit? Just asking...

Re:Explanation requested

[gr8_phk]

I've been looking forward to a time when everyone gets at least one fixed IP address. Want to run a server of any sort? No? How about a mail server built in to your cable modem? Or do you like your email getting stored at your ISP? Then there are any number of handy p2p type apps that will benefit. VOIP comes to mind - without needing to subscribe to a directory service. Fire up gnome-meeting or whatever and enter your friends IP (well the software could remember it for you) - the same IP they have every time. Actually, fixed IPs for everyone reduces the role of the ISP to simply being a network connection like they should be. Also, it takes effort from developers to get software working through NAT, so the burden on them should be reduced.

Re:Explanation requested

[vertinox]

Besides the huge amount of fully routable IP addresses IPv6 will open up, what are the benefits to the average end-user?

Being able to get around NAT restrictions or trying to get UPnP working each time they want to play a particular online game, video conferencing, or transfer files directly with another person behind a NAT.

Most End Users may or may not notice it or understand it, but often when say a group of people use a NAT they are unable to connect direct to anyone else's computer who is also behind a NAT. UPnP kind of gets around this but it has limitations since it only knows what programs are expecting to be receiving and often times may or may not know which computer to forward this too.

Say, I wanted to play Age of Empires with another person who was behind a NAT because he was sharing his internet connection with his family and I was sharing my connection with three over of my own computers. We would both have to go online and look up what ports AOE uses and then set our routers to foward request to the specific computer running AOE. Its not that hard to do, but for the average End User it can be way to complex if you don't know anything about your own router. UPnP helps but like I said its not perfect.

IPv6 would give out of the box direct connections... End Users would be able to play direct connect games, video conference, and share files via AIM or Yahoo without having to futz with their router or call their more technically inclined friend asking why "x feature" won't work with "x program" when they bought their router?

Oh and a side note... If you are wondering why Quake, UT2k4, NWN, and Skype and other services work out of the box, it is because the connection is going to a server that is not behind a NAT. If you want to host an online game or have some type of VoIP service then you leave the box directly connected to the internet without a NAT.

Re:Explanation requested

[sploxx]

Will there be measures in place that prevent the massive privacy problems of a fixed IP? I mean, it sounds a bit ugly to have anything I'll ever search or browse directly and eternally linked to my name/IP, with every website operator knowing who does what when on their sites? (Apart from larger entities such as goverments, ...).
Right now, I can in most cases hide behind a /24.

This question is partly rhetorical, as I don't think that this will be the case. But if anyone here knows about recent developments in this area, I'd be glad to hear!

Re:Explanation requested

[FireFury03]

what are the benefits to the average end-user?

Well NAT is a huge pain in the arse for anything peer-to-peer - for example VoIP.

Lets take Skype (horrible system that it is) for example. You want to make a call:

1. Caller A places a call to caller B. This involves talking to the Skype directory server and ggiving caller A the IP address for caller B.
2. The system realises that caller B is behind a NAT so caller A can't start a connection to B... ok, no problem, we just get caller B to initiate the session instead.
3. Oh wait, A is also behind a NAT so B can't start a connection to A.
4. Lots of nasty NAT traversal hacks are tried to tick the NATs on both ends into allowing the traffic through.
5. Sometimes the NAT traversal works, lets assume in this case it doesn't. The only way to get traffic between A and B is to go via a third party server.
6. Another random Skype user's connection (which isn't using NAT) is hijacked - both A and B connect to this Skype user and use his connection to pass the traffic. This means that not only is it sucking the bandwidth and CPU time up on the third party's connection, but that connection may vanish at any instant and there is added latency caused by going via a connection of unknown quality.

Whereas without NAT that'd just be a case of A connecting to B and all would be good.

Also, being about to log into my video recorder from my cellphone and ask it to record something would be cool :)

New Allocation Schedule

[Kadin2048]

It will be interesting (and perhaps this has already been all worked out, I haven't looked into it much) how they allocate the IPv6 addresses. It seems fairly clear now that the life of the v4 address space was definitely shortened -- although by how much is not clear -- because of the very large chunks of space that were handed out and never fully utilized. (Class A allocations; IIRC IBM had a massive one and I'm not sure ever used much of it, and I'm sure they're not the only one.) Of course this wasn't viewed as a problem at the time because there were so many more addresses than anyone imagined there would ever be devices.

I just wonder how we're going to resist the temptation to do the same thing again, now that we have another glut of address space. On one hand we don't want to end up with vacant blocks of addresses, but we don't want to be too niggardly about it either, or else individual static addresses won't ever 'trickle down' to end users and we'll be stuck with the same mess of NAT traversals and subnets that we have now.

I'm sure that this issue has been addressed (or will be addressed) but I'm just curious how the IANA will find the 'balance point' between assigning enough high-level blocks to make sure end users can get static global addresses, while not overassigning. Perhaps there should be some sort of a periodic review process for high-level address block assignments to see how fully utilized they are, and either assign an entity more addresses or reallocate underutilized resources.

I predict that...

[C0vardeAn0nim0]

in 2 to 10 years lots of things will happen. some people will die, some will be born...

aw, c'mon...

in a month europe, brasil and a few other nations will force a global netsplit, so we'll have 2 "internets". double the address space for the same price, so this prediction is not only imprecise, it's useless!

my R$0,02.

Re:I predict that...

[NotoriousQ]

double the address space for the same price

No, there will not be a doubling of the address space, just the name space. Same internet, twice th ICANN. Now people will have to purchase domain names from two registrars to be listed on both DNS systems. And the moment this happens there will be a flurry of activity to develop rootless DNS systems, from which all will benefit.

All I know is

[Hershmire]

I have my IPv4 address. Why should I worry? Perhaps I can even sell mine to the highest bidder when the shite hits the fan.

Hell, maybe the address shortage will create this crazy new "Road Warrior" world where IP addresses are a rare commodity and people have to fight each other with mad overclocked computers just to get some packets routed. And then Mel Gibson can play an ex-help-desk-guy-turned-hero whose Mac was killed by software pirates in the movie version.

All I know is, I'm training my kids how to catch sharp boomerangs.

Nasty NAT hacks

[overshoot]

Hmmm -- I wonder how many machines have been saved from being owned precisely because of NAT?

I'd love to know the zombienet operators' take on the conversion to IPV6.

Re:Nasty NAT hacks

[nutshell42]

I'd love to know the zombienet operators' take on the conversion to IPV6.

United Zombienet Operators issued a press release today adressing fears about increased zombie activities following a theoretical switch to "Eye P-V6". Only one line long, it reads "Please remember the codewords are 'Klaatu Verada Snugglesworth'." Asked for an official statement a spokesdead of the Army of the p0WneD just said "Urgh...MUST...EAT...BRAIN". We will continue to report this story as it develops.

Home routers

[bozojoe]

Perhaps this is an AskSlashdot, but who is making a decent(affordable) IPv6 router for the home? And where can one locate documents on SIP/RTP in IPv6 land?

My cold, dead hands

[BJZQ8]

Until I absolutely HAVE to switch to IPV6, I will keep my much easier-to-remember addresses. Try to remember something like these:

fe80::02d0:c1ff:fe5c:0010/10

2002:c0a8:1122::5efe:0a01:0101/48

2001:7f8:2:c01f::2

I mean, DNS goes a long way towards turning that hex into something memorable, but as a sysadmin it does NOT make my life easier. Let's reclaim some of those /8 blocks allocated to people that barely use them, first. Does E.I duPont REALLY need 0.39% of the internet address space? Does Eli Lily? That is 16777216 addresses, for what? Does Eli Lily even have 16 million adressable devices? It seems to me that we have plenty of IPV4's, it's just the allocation stinks.

Re:My cold, dead hands

[Mondoz]

I'm with you. This scares the hell out of me.
Unless my host file grows to be the size of Montana...

Do host files and IPITAV6 work together anyway?

Besides, this is going to make my "There's no place like 127.0.0.1" shirt obsolete in 10 years!
I'll have to get one with colons in it!
Jeeze...

Re:My cold, dead hands

[mindriot]

2001:7f8:2:c01f::2

Why don't you try to remember v6-tunnel34-uk6x.ipv6.btexact.com instead?

I mean, that's why you have the DNS. You don't have to remember any addresses. Honestly, how many public IP addresses do you know and actually use? Even as a sysadmin, I think you'll manage. Seriously, the "difficult to remember" argument isn't really an argument. 99.9% of the Internet-using population couldn't care less if their address had 32, 128 or 1024 bits or were written using Babylonian numerals. Heck, most don't even know what this "IP Address" thingy is. And sysadmins will for the most part be clever enough to work with any notation.

Re:My cold, dead hands

[Just Some Guy]

Besides, this is going to make my "There's no place like 127.0.0.1" shirt obsolete in 10 years! I'll have to get one with colons in it!

Good point. Imagine the joy:

Cute girl: There's no place like... colon?
You: *sob*

Think maybe I'll pass on that one.

Re:My cold, dead hands

[rdenisc]

Indeend, RFC3363 specifies AAAA should be used. RFC3364 explains why AAAA is preferred over A6.

Re:My cold, dead hands

[shreak]

There are a lot more endpoints out there than you think. One of the major pressures to go IPv6 is coming from the wireless phone service providers (mainly out of Europe and Asia). ALL the phones they sell are IP enabled. That's LOTS of phones. It's a lot easier to just allocate them a static IPv6 addy than the constant DHCP traffic every time they access. We're talking MILLIONS of phones per service provider.

=Shreak

Re:My cold, dead hands

[Dolda2000]

why does it have all those funny characters? couldn't they increase the size by simply making the addresses longer?

Indeed, that is what they have done. They've just replaced dots with colons and decimal encoding with hexadecimal encoding. The only other trick is that you can replace a group of zeroes with a double colon.

The localhost address in IPv6 is 0:0:0:0:0:0:0:1 (or 0000:0000:0000:0000:0000:0000:0000:0001 if you're anal), but since it's almost all zeroes, you can write ::1 instead. In the same way, I can replace the address for one of my hosts, 2002:52b6:8514:0100:0000:0000:0000:0001 with just 2002:52b6:8514:100::1. It's just so that you don't have to type out all the zeroes.

I can't really figure out why they replaced dots with colons, though. I can only guess that it is so that the address is easily discernable from an IPv4 address.

Re:My cold, dead hands

[jxs2151]

Please explain how it is a benefit to be over allocated IP addresses by a huge margin?

Anything that is limited is valuable. Supply and demand. Think real estate. They aren't going to make more ip addresses, at least not in IPv4. That makes the ip addresses valuable and that's why MIT et al are not going to willingly give them up.

reserving address space for certain entities

When they were handing out addresses they had no idea that this thing would be wildly popular. Why ration (reserve) when you have no inkling that you would need to. Do you reserve water today from your grocery? Why would you, after all there is plenty of water. However, fifty years from now someone is going to wonder why we didn't. See how the idea of plenty works?

Who said anything about evil corporations?

Not you apparently. I got you confused with the parent. Now relax, this is just a discussion forum. No need to get mad at early risk takers just because they won't give up something willingly that they earned by taking an early risk.

transport ready, management a hassle

[puzzled]

  I've been playing with IPv6 off and on since 2000. My current IPv6 plant incarnation is a Cisco 2610XM tunneling traffic from btexact (best tunnel broker if you want to play), a Cisco 1605 that is sometimes online, and a FreeBSD box. I don't have a site up this time, just taking it slow and playing, doing this mostly because the CCIE lab has started requiring IPv6.

  The transport works just fine, the application support is still a hassle. If its a barrier for me after five years of dinking and nothing left to do Cisco wise except complete my CCIE ... well ... Joe MCSE is probably going to get chewed up by it.

  Moving to IPv6 from IPv4 is as much a change in mindset as moving from IPX to IPv4 was ...

Simple fix..

[MrJerryNormandinSir]

Don't use real IP addresses after the gateway. I do IP
MASQUERADING. I get only 1 ip address from my provider.
I've got a wireless webcam, a zaurus wireless pda, company assigned laptop, my linux development desktop computer, my Apple G3 running LinuxPPC (my gateway, web, imap server),
My oldest son't room with a Linux based AMD 64bit server, a
mini mac, a sharp zaurus, my 2 youngest boys room and thier
computer and a laptop up in thier room, my hombrew robot,
a hacked compaq IA-1 that runs linux that I use to monitor my firewall, email, etc.. All these devices get to the outside world on 1 ip address. I have multiple servers that
are accessed by the outside world via port redirection as
well.

My point is that we should be tighter with ip address allocation.

Re:Simple fix..

[BinaryCodedDecimal]

I do IP MASQUERADING. I get only 1 ip address from my provider.
I've got a wireless webcam, a zaurus wireless pda, company assigned laptop, my linux development desktop computer, my Apple G3 running LinuxPPC (my gateway, web, imap server), My oldest son't room with a Linux based AMD 64bit server, a
mini mac, a sharp zaurus, my 2 youngest boys room and thier computer and a laptop up in thier room, my hombrew robot, a hacked compaq IA-1 that runs linux that I use to monitor my firewall, email, etc.. All these devices get to the outside world on 1 ip address. I have multiple servers that are accessed by the outside world via port redirection as well.

That was a lovely story, but you could have just said, "I use NAT and port forwarding."

Also, what's the difference between IP masquerading and IP MASQUERADING? Is the latter more l33t?

Examples

[overshoot]

$FORMER_EMPLOYER has several Class B address spaces but keeps the entire internal network behind proxies and doesn't even support internet DNS lookups for machines in the intranet. Net result is that the entire company could present less than a Class C to the internet at large.

In general, corporate networks today are so completely firewalled that they might as well be behind NAT, and some (bless 'em) are -- Intel for one uses nonroutable addresses internally.

Paying extra for fixed IP

[3770]

So, today you have to pay extra to get a fixed IP. I can understand that, somewhat, because there is a limited number of IP-numbers.

Now, if we have an unlimited number of IP-numbers, then I will be pissed if they expect me to pay extra for a fixed IP. What is their explanation and motivation for a higher price for a Fixed IP?

So maybe one of the reasons that they are trying to delay the introduction of IPV6 is because they know they will no longer get the extra income from customers that are paying for a fixed IP.

Re:Paying extra for fixed IP

[program21]

They'll still charge for static IPs even with IPv6. After all, there's not much reason for cable and DSL providers not to offer them for free right now. Most cable and DSL modems are always on and occupying an IP address anyway, and there's never been any mention of an address crunch at any big ISP (Cablevision, Comcast, etc.), so there's no technical reason to avoid offering static IPs.

Charging for static IP addresses is pure profit for these companies. A small change to the DHCP servers to indicate that a particular modem should always get a particular IP is all it takes (and only needs to be done once), but the money for that keeps rolling in. Opening up more addresses isn't going to change that.

One Giant Honking DHCP Server

[Nom du Keyboard]

To make most efficient use of the 4.3 trillion possible IPv4 addresses, all we need is one giant honking DHCP server for the world to use. Of course, the USA should run it forever.

Waste

[Ed Almos]

If the IP 4 address space was properly allocated then we could probably get another ten years out of the system. We have for example BBN occupying three class A blocks and HP taking another two or three. Set against this is the continent of Africa which is assigned one block.

Ed Almos

Not any time soon.

[dills]

I have worked in the internet service business for over a decade now. I have seen a lot of things come and go, and a lot of predictions about when we would run out of IP space.

The bottom line is that the only people who realy WANT a rollout of IPv6 is Cisco. Why? Because the vast majority of their existing installed routers will not support IPv6 with anywhere near the same feature set and packet rate as those routers can handle with IPv4. Thus, IPv6 means people upgrading equipment that isn't really deficient.

Most people have no concept of:

a) How much IP space we have left.
b) How extremely inefficent we have been with a large percentage of the address space.
c) How much assigned, announced, and routed space is completely unused.
d) How much the rate of growth has flattened.
e) How wrong every prediction about when we run out of IP space has been thus far.

If you search the nanog archives, you'll see posts by myself going back many years stating essentially "Somebody tell me why we need IPv6 again?"

Do not hold your breath. We're 10-15 years away from IPv6, because it will take an even larger gross expenditure for the service providers to upgrade to support IPv6 than it did for the broadcast industry to upgrade to HDTV.

This is what industries that rely on revenue growth do when their customer growth flattens. They invent a new widget, come up with reasons why everybody needs it, market it, and hopefully everybody buys the product all over again. IPv6 is admittedly a good bit different; it was created by geeks in attempt to solve a perceived problem. However, it was siezed upon by the router vendors as a future "upgrade when growth flattens" path.

Don't buy into the hype. IPv4 is here to stay for a long time. Even when IPv6 starts to have some decent degree of market penetration, you will always find most of the devices on the net are IPv4 behind IPv6 to IPv4 NATs.

Network Operators thoughts on IPv6

[br00tus]

I went to a NANOG meeting in 1997, at which were many of the bigshots of network operation - Van Jacobsen (author of traceroute and Van Jacobsen compression, which you may recall as a checkable option on Windows 3.x's Trumpet Winsock), Paul Vixie (of BIND and MAPS fame), Kim Hubbard (of ARIN), Mark Kosters (of Network Solutions) and that type.

Anyhow, I myself was curious about if/when IPv6 would be rolled out. One of the talks was about how to deal with IPv4 space running out, and a lot of the talk revolved around such things as multiple web sites running on the same IP (which was very uncommon then) and other ways to use less address space. Some audience members gave other suggestions for conserving IP space such as ways to use Network Address Translation to limit public IP use. I would say the feeling in the hall was that this was not a problem, and that people had to go the route of IP sharing, and aside from the need for more IP sharing, everyone pretty much liked the situation as it was, which was in contrast to the prevailing attitude in the world outside the hall. One audience member rose his hand and said, "What about IPv6?" The response to this was the entire audience broke into laughter - it was the funniest thing they had heard that week. After that I began thinking about IPv6 more along the lines of projects such as MBONE (anyone remember the hooplah over that years ago?). Not that IPv6 will never be implemented, but this story that IPv6 was needed straightaway could have been written 8 years ago. I haven't seen much headway in it in the past 8 years, except for products promising they were IPv6 compatible, just in case. Not that IPv6 will never be rolled out on a large scale, but I'm not holding my breath.

NAT is about a lot more than low address reserves

[jjeffrey]

I don't think that IPv6 will see the end of NAT at all. NAT is a very quick and covenient technique for consumer DSL routers to use.

For a start, a lot of ISPs only offer one address, partly to encourage people to buy more expensive packages with multiple addresses, and NAT transparently solves that issue.

There is no reason to assume that increased avilability of addresses will cause ISPs to offer more addresses to consumers - after all if they anticipate 100,000 single PC broadband connections, they are going to find it hard to get approval for 800,000 addresses (to allow a /28), even with the increased address space. And even when you do have multiple addresses allocated, what about the users that have one more machine than usable addresses? Small company networks etc? Now matter how many addressed IPv6 supplies, we will run out eventually, and much sooner than we expect.

Also low end ADSL connections often force NAT upon a user, allowing the vendor to create a differentiator between it's commercial and domestic offerings.

In the end NAT offers security, independence of allocated IP space to available addresses, simplified network management with an excellent delineation point between vendor and consumer (the ISP dosen't have to worry about what is inside the end user network), and a reasonable form of security. It's great for a small internet connected network.

Oops, never mind.

[temojen]

That was my "link local ID"

the 10.x.x.x net is mine! Get off my lawn you kids

[infonography]

I have had 10.x.x.x addresses for a long time and I am gonna keep them. You varmits need to find your own, your not taking away my net addresses. Same goes for the 192.168.X net. That's mine too, it's just my summer home.

the biggest problem i see

[petermgreen]

is home nat routers. They effecively prevent you using either 6to4 or native IPv6 unless the nat router itself explicitly supports it.

and they are effectively closed devices so adding support requires the manufactueres cooperation.

RE: "I think IPv4 is in its last throes."

[infonography]

oh great, now we got to worry exploding IPs and routers. People shooting spam at us from every direction. You never know when your gonna step on a 419 and end up buying the "low rate M0RTgaT3".

Maybe we better give control to the UN after all.

Let the EU deal with it

[72beetle]

The EU is so hot and fired up to wrench control of the intarweb from the US, so let THEM deal with it. If we can't be trusted with the DNS system, seems logical to me that the EU would be much better off orchestrating and paying for the upgrade to IPV6.

Submarine Patents AHOY!!!

[ObsessiveMathsFreak]

Let's not forget that any rollout of IPv6 aware devices is going to be plauged by patent litigation. Turns out that just before its release, and lot of "Intellectual Property" "Firms" simply guessed the IPv6 standard, or parts of it, and bought^H^H^H^H^H^Happlied for corresponding patents from the USPTO rubber stamping office.

That means for around the next 20 years we'll have the whole RSA debaucle played all over again in the IPv6 sphere. Expect to see "Innovative Ideas" lawsuits gouging money from OS makers and especially makers of routers(esp consumer grade) and other networking devices.

Look on the bright side thought. With any luck, we'll run out of IPv4 addresses before the litigation finishes, and then someone really WILL have to do something about it!

It's going to be ugly

[digitalgimpus]

There are *millions* of Linksys, Netgear, DLink, routers and access points out there. Most of which don't support IPv6. And I doubt these vendors are going to update all that firmware.

Nor will consumers be into throwing out old hardware "to get more IP space"... that's not exactly going to work (marketing wise).

Nor will people with old OS versions, or other odd devices (IP cameras, etc. etc.).

IMHO this will need government pressure, similar to the digital switchover for TV. Some sort of a date for compliance of devices, and a clean switchover date.

Re:Embedded?

[abb3w]

I don't think they included the fact that lots of devices are including internet conectivity, and looks like they could be TheNextBestThing, and would increase the rate IPv4 address space gets used up

But will this increase the depletion of IPv4, or just result in home NAT starting to support the use of CIDR/16 chunks of of 172.16/12 instead of CIDR/24 chunks of 192.168/16? As an example, my Zyxel DSL Modem was pretty trivial to switch over to using 10/8 on the inside its NAT, and would have been easier if it was a model that the manufacturer intended to allow a normal sized NAT pool. (The Zyxel firmware tries to prevent use of spaces above CIDR/30 for non-router hardware.) While my five-year old router isn't thrilled at this sort of thing, my 1 yr old Belkin router is completely content with any IP space I want to assign it.

So the question is, how many of these devices will have Internet (as opposed to LAN) VISIBILITY (as opposed to merely connectivity) be a feature?

Excuses, excuses

[jd]

IPv6 address prefixes are defined up-stream. All you need to do is remember the one byte that indicates your router. The rest is imported. As for user machines, IPv6 addresses are automatically defined as being the router prefix + the MAC address. There is absolutely nothing for an administrator to do, with IPv6 networks, besides plug in the one byte designator and kick back.

The only admins who don't like IPv6 are those who are either ignorant of the way it works, or who are too hooked on being worked to death. Both need help, treatment and beer.

Tunneling is not good enough, no multicast!

[shapr]

I'm using 6to4 right now, but it's not good enough! One of the greatest benefits of IPv6, true multicast support, does not work, since the underlying IPv4 layer does not support multicast.

Many applications could take advantage of multicast if it were available.

Some examples:
Bittorrent is a cheesy IPv4 emulation of multicast.
Game servers could multicast 'common' data and save roughly 50% of the total bandwidth used.
Mirror sites could multicast their updates. Debian, Redhat, and other mirrors would use a fraction of their current bandwidth.

If you went the bittorrent way, files could be sent via looping multicast, no more slashdotting the Id games servers.

Basically, any duplicate TCP/IP streams could be a single stream that gets replicated at the router. I want it now!

Think of it, even spam could be more efficient with multicast emails!

Fossil fuels

[totallygeek]

Interesting, but is 2 - 10 years as precise as they can be?
8 years seems to be a long time, to me.

Yep, and thirty years ago they said that we would be out of oil in twenty years. Go figure...

Re:Fossil fuels

[dustmite]

Except, they didn't say that. "They" predicted that oil production would PEAK by (twenty years from thirty years ago) - "peaking" is completely different from "running out" - "peaking" means, basically, that you're at the top point of the production curve --- it means you've used up roughly half of the oil (i.e. you are only halfway), and that you will start running out ("start" meaning to be on the downward slope of the production curve - but you still have a LOT of oil at the point when you "start running out"). You're thinking of Hubbert's estimation (which was already in 1956, actually) that global oil production would peak in 2000. It was predicted that US oil production would peak by around 1970.

See this link for more information on peak oil theory.

Re: hardware limitations

[FlippyTheSkillsaw]

Sure, the hardware /supports/ IPv6, but if you try to do both IPv4 and IPv6 on the hardware, you take the load way up.

As long as IPv6 isn't required to get everywhere, they can save money by using smaller/fewer routers to do IPv4 work.

In terms of just memory, you almost double the use by having a separate table for IPv4 and IPv6.

ipv4 is underutilized

[austad]

We had an IT person in our london office at a previous job. When I was out there, I had mentioned that they were running out of IP's for the office and we'd have to assign a new block. She pulls out her spreadsheet which is fully poplated up to something like .253, and proceeds to show me all the empty space up to .999.

Obviously we are underutilizing the ipv4 space, no one seems to use anything above .255. We should just all follow her lead and go to .999. It's like a network that goes to 11 man.

For *business* customers maybe, for a price.

[Bob_Robertson]

I recently asked my cable ISP what their IPv6 gateway was. They said, "We don't provide that service. Maybe you should upgrade to a business account."

They only offer multiple client services on business accounts, so technically I'm already in violation of their rules because of using a router and NAT even though I run no "server", just a couple of PCs.

Yes, Cisco has a vested interest in replacing all those legacy IPv4-only cigar-box routers like mine. Yes, my IP provider would love a reason to raise rates or otherwise push me into a "business" account (and thereby charge me more).

Fact is, I won't be buying a new router, I'll just recycle one PC into place as a gateway and continue to hide behind NAT because I don't care to pay business rates for home PC use.

No matter how much I dislike IPv6 because of its "second system" bloat, I have yet to find a free IPv6 tunnel provider. Yes, it's my fault, people tell me they're out there I just cannot find them.

Bob-

Re:NAT is about a lot more than low address reserv

[alefbet]

Now matter how many addressed IPv6 supplies, we will run out eventually, and much sooner than we expect.

Based on my calculations, with the surface of the earth at 510 million square kilometers, and with IPv6 addresses at 128 bits (that is, about 256,000,000,000,000,000,000,000,000,000,000,000,00 0 addresses), there are about 300,000,000,000,000,000,000 addresses per square inch of the earth's surface. I don't think we need to worry about running out anytime soon. It's like realizing that eventually we'll have a Y10K bug, but none of our current hardware will be around for it.

Re:NAT is about a lot more than low address reserv

[Midnight Thunder]

Yup, this is a big issue. People want to have the liberty to do what they want in their own home. After all when you put a nail into your own wall, do you have to phone up the regional governing entity or pay to do so? Why should we have to do the same for our private computers?

ADSL IPv6 router - Re:Already rolled...

[new500]

Try a Cisco 87x router. These are sold in the UK, are fully IPv6, provide 4 10/100 ports in case your switch is v4 only, offer WLAN 802.11b/g option (does this carry v6? i dunno) and have lots of other nice features as well. Haven't had time to check compatability. Expensive - ish, see : http://www.broadbandbuyer.co.uk/Shop/ShopDetail.as p?ProductID=2277&CategoryID=325&ShopGroupID=78 (the top model in the series) but available now.

Data sheet : http://cisco.com/en/US/products/hw/routers/ps380/p roducts_data_sheet0900aecd8028a976.html

  IPv6 addressing architecture

  IPv6 name resolution

  IPv6 statistics

  IPv6 translation-transport packets between IPv6-only and IPv4-only endpoints

  ICMPv6

  IPv6 DHCP

Until the ISP backhaul is routing IPv6 it's still not native all the way, so A&A or whoever your ISP is doesn't. Ask for a allocation and tunnel to the 6bone. Until not so long ago NTT UK offered ranges and free peering, and there were other free v6 peering intiatives. coupl'a years since i cared much about this so forgive me if anything changed (save the ready availability of IPv6 capable routers). Hopefully POPs with lots of LLU will be the first to go native in the UK, so we can have v6 and >=8Mbps to cope with all that traffic from my fridge, cooker, clock, toilet, kitchen drawer, hallway light . . .

Re:ADSL IPv6 router - Re:Already rolled...

[Martz]

I have bought and installed several Cisco 837 ADSL routers for use with UK ISPs, and they have all been superb compared to the typical cheap ADSL and Cable routers made by the likes of Belkin, Linksys, SMC, Negear etc.

Don't get me wrong - with most of these other routers now there isn't anything really wrong with them, it's just the Cisco 837 is exceptionally stable and never requires a reset or a poke to awaken it, like some others I have mentioned above. YMMV.

Look out for the Cisco 837 SOHO version, and save a large wedge of money too! Expect to pay around £350 for the non-soho.

(I don't work, nor am I associated with Cisco :P Just a happy customer, for once)

Re: hardware limitations

[FireFury03]

As long as IPv6 isn't required to get everywhere, they can save money by using smaller/fewer routers to do IPv4 work.

I think that rather depends on how much of the network is IPv6 only - if there's a large chunk that's only on IPv6 then refusing to support it would be like telling the customers "we've decided to not route any of your traffic to the US anymore because that's cheaper for us". Customers would be leaving them in droves - they don't need to understand _why_ parts of the internet are inaccessible, it will just become known that this ISP is crap because they have "firewalled" off part of the internet in the interests of cost saving.

Re: who BBN are

[Medievalist]

They built this thing called "the Internet" that you might have heard of?

Testing this amazing new widget called a "router" required a fair amount of address space at one time.

Well, OK, actually they called it a "gateway" but that means something else now. :)

IPv6 denial and IPv4 forever

[Danathar]

It's funny to see that the people who keep shaking their heads left and right when "IPv6" is mentioned are mainly ALL in the U.S. Fact: China, Japan, Korea and MUCH of Europe will move to IPv6 first...and much sooner no matter what the U.S thinks. Control is the issue, those moving to v6 see it as an opportunity to move away from having to call a U.S. organization to get address allocation. Also..since DNS becomes REALLY important with v6 (try to memorize IPv6 addressess..) Europe could use it as a means of setting up their own root DNS servers to take control of the future address space. Whoever has the DNS servers that people use will get control, and if Europe/Asia defines that first they will have control.

Not an issue...

[cookiepus]

Sorry to be a ludite but this is really not an issue. Greanted we're placing more devices on-line, but so what? If I need to telnet into my toaster, I can just have my router forward a particular toaster port to it. He doesn't NEED his own IP. Similarly, do all the 1000-plus apartments in my building need to have separate IPs? Why? Most people read e-mail and look at websites, they don't need to host anything. We can all be on a LAN with a single internet IP, just like resnet in college was. Why not? if somebody needs an IP they can have their service set up that way but most of us don't give a shit.

I know, I know, there are more people in the world than there are IP addresses or whatever, but so what? I'd say that billions of people don't have a shot at owning a PC in their life anyway. Those who do can probably share IPs too.

It's a made-up crisis. There's nothing wrong with IPv6 but there's absolutely no dire need for it.

The cost of unsupport

[fm6]

Not necessarily. Many ISPs provide non-core services that they don't offer support for; for instance, my ISP runs an NTP server, but the only support they provide...

And policies like that just don't work. Maybe with ordinary schmos like you, your ISP help desk can hide behind "That's an unsupported service." But suppose a customer who buys a huge amount of bandwidth and pays them 6 or 7 figures calls up, and says, "I have a mission-critical ap running off your NTP server, and it's broken! Help me fix it or I'm jumping ship!" What do you think they're going to say?

I mostly work in tech pubs (when I'm working), and this has been a constant issue for me. At some badly managed companies, I've seen engineers add SuperKewl Features to the product without authorization, thinking they can just throw them over the wall to the customers and forget about them. Wrong. I have to document their damn features, and that costs. If I don't document their damn features, then tech support has to handle the resulting calls, and that costs even more. And if tech support tries to tell a big customer, "Oh, that's an unofficial feature, we don't support it," that really costs!