Slashdot Mirror


IPv6 Still Hotly Debated

inkslinger77 writes "A significant stumbling block to IPv6 adoption may be IPv4 loyalists who are keen to keep the old protocol in preference to the 'new improved' version, according to a Computerworld Australia article. The article covers the views of Cisco's senior technical leader for IPv6 technologies, Tony Hain and Geoff Huston, a senior Internet research scientist from Asia Pacific Network Information Centre (Apnic)." From the article: "Go to your favourite venture capitalist and say 'I want to be an ISP'. By the time he stops laughing and [finds you want to run] IPv6 - the discussion gets terminated. No one wants to hear this. IPv6 is well ahead of adoption in this market so everyone is deferring. No one is running IPv6, because there is no business case for it ... if we really wanted to leave a legacy to our children we'd review the crap we have today which is pretty ghastly ..."

87 of 639 comments (clear)

  1. Me too by Phroggy · · Score: 4, Insightful
    To be honest, IPv6 never really made sense to me either. I mean, OK, so we're running out of IP addresses and we need more... but as more and more companies are turning to NAT instead of using public IPs behind a firewall for internal services, some IP blocks are being freed up, and it looks to me like there are still a HUGE number of reserved subnets out there.

    But assuming we really do need more IPs, why IPv6? Why 128 bits instead of, say, 64? Why build the functionality of DHCP, which (mostly) works perfectly well* and is extensible enough to support cool stuff that hadn't been thought of when IPv4 and DHCP were invented (e.g. WPAD, netbooting), into IP? What's the deal with including your MAC address as part of your IP address?

    Going with the assumption that the problem really is as bad as people say it is (China has a gazillion people and more of them are getting online, and it'd be great if my refrigerator had a web-based interface I could access remotely without setting up port forwarding or a VPN, etc.)... I'm not convinced that IPv6 is the right solution to the problem. It just seems to be the only solution anyone has offered, and a lot of money has been spent bringing it closer to reality.

    So, convince me: why is IPv6 the right answer to the problem?

    * Off-topic, but can someone explain to me why (at least with ISC dhcpd) I can't assign IPs on two different subnets on the same physical LAN? Can this be done with a different DHCP server? Is there any kind of limitation to the protocol that makes this impossible, or is it just an implementation problem?
    --
    $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
    $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
    1. Re:Me too by mboverload · · Score: 2, Informative
      > Why 128 bits instead of, say, 64?

      Exactly what I'm asking. From wikipedia:

      The primary change from IPv4 to IPv6 is the length of network addresses, with IPv6 addresses being 128 bits long (as defined by RFC 2373 and RFC 2374). This corresponds to 32 hexadecimal digits, which are normally used when writing IPv6 addresses. Each hexadecimal digit can take 16 values (see combinatorics), resulting in a total of 1632 (340 undecillion) addresses. IPv6 addresses are usually composed of two logical parts: a 64-bit network prefix, and a 64-bit host-addressing part, which is often automatically generated from the interface MAC address. It is often argued that 128-bit addresses are overkill, and that the Internet will never need that many. However, it should be noted that the rationale for the 128-bit address space is not primarily to make sure that addresses never run out, but rather to ensure that routing can be handled smoothly by keeping the address space unfragmented. This is seen as an improvement over IPv4, where a great number of discrete netblocks are often assigned to one organization.

      I still think it's complete overkill

    2. Re:Me too by MightyMartian · · Score: 4, Insightful

      NAT really isn't anything more than a kludge, and despite a lot of work done to make some of the finickier protocols work through it, the point behind IPv6 is to create an address space sufficiently large that we don't have the provisioning problems that are evolving now. Is it overkill? Well, for 2005 there's no doubt. But IP4 was probably massive overkill in 1980. The point here is that these artificial limits we've set (640k, IP4, two-digit years) eventually lead to very big hastles, and if we're going to have to find some new way to enlarge the address space, why not do it right?

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    3. Re:Me too by cnlohfin3109 · · Score: 5, Insightful

      IPv6 gives us more then just more address space. The ip is designed heirarchally(sp) which will help _significantly_ with routing, decreasing tables etc. Not to mention not wasting time havening to check checksums all the time... cause there is none! Its silly if we get into the terabit speeds and still wasting so much time just tring to route the ethernet frames, not to mention the sheer processing power required by a router for those speeds.

    4. Re:Me too by exaviger · · Score: 4, Insightful

      Nicely put, just to stengthen your point - a little historical snippet "In the early days of mainframe computing, resources were at a premium. Memory was expensive, disk storage was limited and input devices constrained. Every programming method was used that made efficient use of each component. One of the methods used was to truncate the year value to a two digit number for entry, storage and processing. This saved space and saved on the associated cost of storage and processing. After all, why enter and store the century portion of the date when it will always be 19? Right? It would be decades before the year 2000. By then, all the programs and hardware being used would be obsolete and replaced with newer equipment and programs." Do we not learn from our mistakes? Calling IPv6 overkill is silly, why should we not overkill? Why not make sure that for the next century every electronic device will be able to have its own unique IP address. NAT is all good and well but what about the growing number of mobile devices, what about some services that dont work behind NAT? Who knows what will happen in 5,10,50 years. Soon every single vehicle, vending machine, traffic light and any other electronic device will require and IP address be it public or local. I am all for IPv6!

    5. Re:Me too by eric76 · · Score: 4, Interesting
      You realize IPv6 has more IP's then there are atoms in the universe, right?

      Just think of all these worms scanning blocks of IP addresses somewhat randomly for vulnerable machines. It's a target rich environment.

      Now imagine that we were using IPv6 instead. With a random approach to scanning, many of those worms would take years before they happened to locate an actual computer.

      Of course, those writing the worms would have to switch to non-random techniques. But someone who is reasonably careful (i.e. didn't use Internet Exploder and Outhouse Express), they could have a system wide open to exploitation without it ever being exploited.

    6. Re:Me too by Anonymous Coward · · Score: 2, Informative
      Found this on Wikipedia:

      It is often argued that 128-bit addresses are overkill, and that the Internet will never need that many. However, it should be noted that the rationale for the 128-bit address space is not primarily to make sure that addresses never run out, but rather to ensure that routing can be handled smoothly by keeping the address space unfragmented. This is seen as an improvement over IPv4, where a great number of discrete netblocks are often assigned to one organization.


      Seems reasonable to me.
    7. Re:Me too by Ancient_Hacker · · Score: 4, Informative

      Uh, no. The universe has around 10^85 atoms (plus or minus a few orders). 2^128 is approximately 10^38. A much smaller number. About 10^63 times smaller. You can only assign IP addresses to each atom in New Jersey.

    8. Re:Me too by nizo · · Score: 2, Funny

      Yeah but visitors from parallel universes need IP numbers too.

    9. Re:Me too by Kadin2048 · · Score: 5, Insightful

      This is a misunderstanding, and has been debated elsewhere: NAT offers no security by itself, it's because normally NATs have a firewall effect at the same time that they create the illusion (and in some cases reality) of security.

      There's no reason why using IPv6 with a firewall wouldn't be just as -- and probably more -- secure. Especially because you wouldn't have to spend time configuring the NAT functionality and could instead configure it as a single-purpose stateful firewall.

      It is possible -- although you probably wouldn't want to -- to create a situation using static NAT without any firewalling effect that leaves your computer just as open to attack as it would sitting on the public net. Likewise it's possible to assign every computer on a LAN a globally routable IP address and secure them using a properly designed firewall (that's actually how my company is set up).

      If your comment had just said you didn't want your fridge and toaster exposed to the internet without your trusty Linux firewall between it and the internet, I would heartily agree. Although I don't doubt some would argue for you about choosing Linux over BSD. :)

      --
      "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    10. Re:Me too by Jonathan+the+Nerd · · Score: 2, Insightful
      ...it lacks the ability to personally manage your host network address space with a memorizable number.

      You can still use DHCP with IPv6, and you can still assign specific addresses manually if you want to. It's just that, with IPv6, you can choose to do neither of these and all your computers will give themselves non-conflicting IP addresses automatically. The sheer size of the host portion of the address means that the chances that two different hosts will assign themselves the same IP address is essentially zero.

      --
      Disclaimer: The opinions expressed are not necessarily my own, as I've not yet had my medication today.
    11. Re:Me too by MicahStevens · · Score: 3, Insightful

      You can hack through a NAT, not being l33t, I'm unfamiliar with the exact practice, but I've seen security reports about this.

      My real point is though, If you have a device like your toaster on the internet, and it's vulnerable to an attack that a firewall fixes, the problem is with your toaster, not the internet. That whole example is totally weak.

      Why do you want to connect your toaster to the internet, so that you can connect to it, right? Or make connections out from the toaster. Either way, you need ports open. If someone can connect to ports that you don't want open, the software/hardware in the toaster is to blame. Not the absense of a firewall, or NAT. If your toaster can be hacked through the toaster port, then a firewall ain't going to help you.

      This overreliance on the firewall is disturbing to me, it makes people not fix the real issues. Granted with certain general purpose machines (i.e. your Desktop workstation) this is more difficult than others, but there's no reason why an embedded internet-aware processor can't be very secure with no firewall or NAT fo that matter. If it's not, fix the problem, don't mask it with a firewall.

    12. Re:Me too by gclef · · Score: 2, Insightful

      You know, every time I hear that argument, I want to ask this: yeah, but can your switch/router store that many incomplete arp entries for all the hosts that got scanned but aren't there? I suspect the first time someone really does a big sequential scan of IPv6 space (non-firewalled, like customer DSL or Cable space), you'll see some very unhappy network engineers trying to figure out why their big 6500's are running out of RAM.

    13. Re:Me too by Denis+Lemire · · Score: 2, Insightful

      The reason IPv6 uses such a large address space is to allow for the wasted IP addresses caused by the hierarchy based routing approach now in popular use to minimize the number of routes needed on the Internet's core routers.

      ie) Class C sized /24 netblocks are no longer individually routeable on the core internet routers. Instead larger blocks are delegated to large providers who then subdivide them down to the smaller providers and so forth.

      Subnetting in this fashion introduces overhead and wasted IP addresses. The huge address space of IPv6 makes this overhead and wasted IP addresses a non-issue.

    14. Re:Me too by jacksonj04 · · Score: 2, Informative

      Always thinking for the future...

      Quick math at the moment, if everything in my house that could concievably use IP addressing does so, then that's (In whatever order they spring to mind)

      6 PCs, 3 Laptops, 4 TVs, 2 Fridges, 1 Microwave, 2 Kettles, 1 Espresso Machine, 2 Toilets, 1 Shower, 1 Bath, 1 Boiler, 9 Light fittings, 10 Light switches, 2 DVD players, 1 DVR, 1 Video player, 2 CD players, 2 Radios, 4 Speaker systems, 1 Cooker, 1 Dishwasher, 1 Washing machine, 2 Outdoor lights, 1 Fishtank, 4 Mobile phones, 2 PDAs, 1 Pager, 5 Landline phone handsets, 4 Printers, 8 Clocks, 1 Burgler alarm and 2 Smoke detectors. And I've probably forgotten something.

      That's 88 IPs needed for a family of four, or 22 IPs per person. Obviously if you lived on your own/single partner this would vary. That is a lot of addresses, and I quite like the idea of being able to individually address my bedroom lightbulb from the other side of the planet.

      --
      How many people can read hex if only you and dead people can read hex?
    15. Re:Me too by eric76 · · Score: 4, Insightful
      Security by obscurity is not the answer

      I hate that phrase. While true, it is very misleading since obscurity does contribute to security.

      It should be "Security by obscurity is not the TOTAL answer.

      Security by obscurity is a necessary and vital part of security. By reducing the likelihood of computers being randomly attacked over the Internet, there would be an increase in security. It would not provide absolute security, but it would help.

      If you think about it, when you use passwords, you are using security by obscurity.

      For that matter, when you use a public key that is the product of two very large primes, you are using security by obscurity. With increases in techniques and hardware, that obscurity is greatly reduced overtime and the security suffers.

    16. Re:Me too by Cramer · · Score: 2, Insightful

      [see also: my recent comment]

      I do see that I said worst case. We don't have 2^20 route entries right now (and actually cannot with reserved space, multicast, etc.) Nor will we actually ever see 2^64 IPv6 prefixes. (certainly not within my lifetime, I hope.) The original commenter has missed the point of "more address space": more people will have globally routed networks. That means more prefixes, not less. Route aggregation will only go so far; depending on it is more of a "kludge" than IPv4 NAT.

      And routers will have to handle all 128bits in their tables -- there could be network tables and more detailed sub-network tables, but as the wizard says "that's another story" -- otherwise you've hardcoded the IPv6 landscape into a classful corner (and thus doomed yourself to repeating the lessons (not) learned from IPv4.)

      HAH! Planning a global routing hierarchy. Excuse me while I get the Dr. Pepper out of my nose. First off, you'll never get the entire world to agree on a numbering plan. And second, you'll never be able to enforce it. Besides, the IPv6 design already poopoo's on such things... address assignments are portable -- to avoid the issues of renumbering when changing ISPs.

    17. Re:Me too by lostboy2 · · Score: 3, Interesting

      Just for fun, I did some math:

      If there are 1 trillion people in the world and each of them is assigned 1 trillion new IPv6 addresses every day, it will take over 931 billion years to use up all of the possible addresses.

              3.4 x 10^38 / (10^12 x 10^12 x 365) = 9.315 x 10^11

      By comparison, the sun might swallow the Earth in 4 to 5 billion years.

    18. Re:Me too by Jimmy_B · · Score: 2, Informative

      Routers running out of RAM is an IPv4-specific problem, too. With IPv6 the IP address space should be almost completely uniform, so that even a core router can figure out which way a packet goes from only the first few bits of the destination address.

    19. Re:Me too by fbjon · · Score: 2, Informative

      Simple, don't store incomplete arp entries from sequential scans.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    20. Re:Me too by 21164 · · Score: 2
      Why every discussion on IPv6 always starts with the address space.
      What about mobility, security, routing optimization, better QoS support, etc.

      And please don't say a hammered solution like NAT is the way to go - I guess everyone from the VoIP/streaming/P2P worlds is familiar with the headaches of trasversing NAT devices.

      About using your MAC address to built a local automatic IPv6 is plain simple, MAC addresses (namely ethernet ones) are unique!
      IPv6 does not replace/obsoletes DHCP, that's why there's DHCPv6 - but DHCP is a service, autoconfiguration in IPv6 is meant to be automatic and not dependent in configured/maintened services.
      IPv6 was brought up by the same people who brought up and manage the Internet up to now - IETF! They made a good job the first time, do you think they lost it?

    21. Re:Me too by gunpowder · · Score: 2, Informative

      Put your toaster on fec0::/10 and it won't be routable. There you go: secure.

      Site-Local scoped addresses (FEC0::/10) have been deprecated as of September 2004 (see RFC3879).

  2. Something I don't get... by Analise · · Score: 2, Interesting

    Why the emphasis on NAT boxes saving the day? Why do people think they're so wonderful and with them, we don't need no stinkin' ipv6? I mean, yeah, they've been useful and I'm not disputing that, but I'm not sure they were ever intended as anything beyond a stopgap measure until something better could be found. Not to mention that, as I understand it, they actually impede certain methods of communication over the Internet (anything that needs a real end-to-end connection, I think).

    Yes, ipv6 still has a ways to go, but I honestly think it's a much better alternative than sticking with what we've got. We're going to have to do somethinga bout it anyway, since there are plenty of people already starting to use it, or will be in the future.

    --
    >insert witty sig file here
    1. Re:Something I don't get... by Daedala · · Score: 3, Insightful

      Sometimes, it's good that NAT impedes some forms of communication. Like, say, exploits.

      --
      What I say does not represent the views of my employers, my friends, my cats, or myself.
    2. Re:Something I don't get... by MightyMartian · · Score: 4, Insightful

      One does not need NAT to lock up vulnerable ports. I have a Linux-based firewall that covers my public IP Windows boxes, and it works fine.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
  3. "IPv4 loyalists" by FirienFirien · · Score: 4, Insightful

    What are the chances that the term "IPv4 loyalists" includes those who just have no reason to make the effort to shift to the new system? Considering the number of [people, admins, even that amusing case where MS didn't patch its own servers] who don't even download security patches - the shift to a parallel system while the old system still works fine just isn't going to happen in droves.

    --
    Browsing with +2 to insightful posts and a higher threshold makes the average post seen seem a lot more ingenious
    1. Re:"IPv4 loyalists" by Phisbut · · Score: 4, Insightful
      the shift to a parallel system while the old system still works fine just isn't going to happen in droves.

      The real question though is "Do we really want to wait until the old system finally breaks and nothing works anymore before making the change?". The old system still works, but we know it won't work forever, and we know we need to change it. Why wait till it breaks?

      (Obligatory car analogy) When you put gas in your car, there's still gas left in it, so it can still work. Yet you don't wait till you go dry to put some more gas in.

      --
      After 3 days without programming, life becomes meaningless
      - The Tao of Programming
    2. Re:"IPv4 loyalists" by jd · · Score: 5, Interesting
      Define "no reason".
      • Security: IPv6 mandates IPSec (which encrypts ALL streams, ALL of the time, so contextual information can't be used for cracking as it can with SSH or SSL streams, which are generally only used for specific segments of a transaction).
      • Authentication: X.509 within IPSec and the use of Extended Authentication protocols in IPv6 guarantee that all endpoints are who they say they are.
      • Fragmented Packets: Firewalls don't handle fragmented packets well, as there is no header to check for later fragments. Fragmenting and re-assembly also adds latency. IPv6 defines per-connection MTUs, guaranteeing ALL packets are the largest supported between any two endpoints without fragmentation.
      • Latency: IPv6 headers don't have as many entries and are heirarchical, which makes routing much faster and much simpler. The lack of fragmentation and the presence of auto-MTU also helps.
      • Multicasting: IPv6 mandates multicasting and has a decent range of addresses for it.
      • Anycasting: IPv6 mandates service location and resource location abilities, which means no more hunting for printers, routers, DNS servers, SMTP servers, POP/IMAP servers...
      • Autoconfiguration: IPv6 uses autoconfiguration for routing and addressing as a standard, in a manner (almost) guaranteed to be free of conflicts and absolutely guaranteed to be fully scalable.
      • Mobility: IPv6 mandates the ability for nodes or even entire networks to be totally mobile (ie: switch upstream routers without losing connectivity or existing connections) with upstream optimization of routing.
      • Advanced Headers: IPv6 allows an arbritary number of extended headers to be attached to packets, with controlled responses for unknown extended headers.
      • High Availability: IPv4's High Availability mechanisms require a lot of fancy manoevering, because the MAC address (used by switches) and the IP address (used by remote systems) are dissociated and ALL parties to a type of data have to agree on the failover for it to work. Hotswapping is extremely difficult and even hot standby is hard enough to be uncommon. IPv6 strongly couples MAC and IP addresses, both for autoconfiguration and mobility, allowing instantaneous, lossless failover with very minimal complexity or overhead and no patent problem.
      • Tunneling: There is no agreed method of tunneling in IPv4 and the de-facto method (GRE) is detested by many network admins. IPv6-over-IPv6 is to be a universal standard.
      • Clusters: Infiniband cooperates well with IPv6, making it possible for nodes within a cluster to directly access IP-based resources. Infiniband requires capabilities that are not guaranteed present in IPv4 stacks or IPv4 networks (such as multicasting) which means Infiniband cannot reliably treat IPv4 networks as extensions.
      • Reachability: IPv6 can reach all IPv4 nodes, with only trivial conversion to make allowance for the different header structure and the lack of intelligence in IPv4 networks, so any client-only machine or network could be converted tomorrow without anyone noticing. Small numbers of IPv6 machines can be exposed to IPv4, making it possible to have DMZ servers on an IPv6 network visible to IPv4, so any server could be converted tomorrow without anyone noticing. The backbone could be left as long as you like. Because IPv6-over-IPv4 is also defined, if both servers and clients are IPv6 then the backbone could be ignored forever without significant impact.

      All told, I'm not convinced that there are that many people who genuinely have "no reason" to shift to the new system. All I am convinced of, so far, is that there are plenty of people who have absolutely no reasons at all but plenty of excuses. Let's look at something, here. Say Comcast converted its entire cable network to IPv6, would you care or even notice? Probably not. Their routers hide their network from your computers, so your computers wouldn't see the difference. It would be

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    3. Re:"IPv4 loyalists" by Wesley+Felter · · Score: 2, Informative

      Does IPv6 have a equivalent function for NAT that is widely used now? Everyone is waving their hands saying it would be a good thing for eveyrone to use a "real" address on all equipment. But no one has discussed the processes that will be needed for an authority to pass out those addresses to ALL users.

      It's called DHCP Prefix Delegation. I might as well explain how it works.

      Right now the ISP is granted a block of addresses and they assign one of those to the end user. The end user setups a NAT firewall/router and puts all kinds of equipment behind it.

      In the Glorious IPv6 Future, the ISP will have a huge block of addresses, and then the user will plug in a v6 home router/firewall, which will be assigned one "upstream" v6 address using stateless autoconfig or DHCP. Then the router will use DHCP-PD to request one or more subnets from the ISP, and will advertise those subnet(s) on its "downstream" interface(s).

      And any good net admin knows that you ask for more than you currently need because things grow.

      In IPv6 all subnets are the same size (/64) and since they never fill up, you need exactly one subnet per LAN.

      So how fast is all that IPv6 addressing going to last with people asking for big chunks of addressing and companies asking for even larger portions?

      The plan is for each person to get 2^16 subnets; there will still be plenty of space left over.

      On top of that it is going to require a central organization (ICANN?) to pass out the address blocks. They are not going to do that for free.

      There already is a central organization to manage IP addresses (IANA/ICANN), and they already charge fees. But the fees are pretty small.

      So now the individual user that wants to setup an IPv6 network at home will have to pay an annual fee for his block of addresses.

      A large ISP in North America would pay no more than $36,000/year for IP addresses. Divided by a few million customers, it comes out to about zero per customer per year.

      And based on the previous message you would want to own your own block of addressing since in theory you can take it anywhere you want to go.

      Sorry; end users aren't allowed to own IP addresses.

    4. Re:"IPv4 loyalists" by anticypher · · Score: 2, Interesting

      What is with all the low /. IDs posting in this thread? I divide the /. world into those with lower IDs (the clued) and with higher IDs than me (the clueless n00bs). Just about every IPv6 article brings out all the old /.ers.

      who the hell uses GRE for tunneling any more??
      *ahem* no comment

      there are no websites on it

      There are starting to be more and more websites with dual v4/v6 addresses. You notice it more once you start using IPv6 all the time, because there are a lot of broken systems where the site admin had no clue that by enabling v6 in a v6 knowledgeable data centre, more work had to go into the apache config file. It also breaks things like PHP and MySQL in strange ways, not much of which has been fixed yet. One dual stacked website I know who is based entirely on IIS and .Net claims they've had no problems with IPv6 connections, which account for about 1% of their traffic.

      no ISPs that sell it

      My entire life right now is helping ISPs and data centres get IPv6 up and running, with everything from training up their main engineers, to getting the BGP announcements right. This is because one of the 800lb gorillas in the ADSL world in Europe (jnanqbb) has been quietly testing IPv6 internally, and sometimes their macintosh users notice they have IPv6 (but no connectivity outside of their ISP). When they get all their internal problems worked out and start up their peerings with IPv6, there will be a large marketing campaign to bash all their competitors around for being stuck on the old, obsolete internet. This has the more aware ISPs getting ready before its too late.

      most hardware doesn't work with it

      Which hardware is this? Cisco, Juniper, Foundry, Extreme? Nope, they've been supporting it for years. Maybe you are talking about the cheap-ass home router/NAT boxes? I'll agree with you on that, there isn't much on the home market which supports it. Even if you buy a linksys router, you still have to upgrade the firmware to get IPv6.

      maybe find a way to hack an extra byte on - rather than this overcomplex mess

      What, and have two upgrade nightmares to live through? No thank you, this one change will keep knowledgeable people employed for long enough. Ignorant luddites like yourself can fester in the IPv4 ghetto for all we care. IPv6 was 5 years in research (1990-1995), 10 years in development (1995-2005), and has now become an Internet Standard. Its here, deal with it.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    5. Re:"IPv4 loyalists" by quantum+bit · · Score: 2, Informative
      • Security: IPv6 mandates IPSec (which encrypts ALL streams, ALL of the time, so contextual information can't be used for cracking as it can with SSH or SSL streams, which are generally only used for specific segments of a transaction).

        Overrated. IPv6 mandates IPSec support, but it's still an overengineered protocol that's a bitch to configure. Works okay for VPN-like scenarios, but will never work with random hosts you've never talked to before.

      • Authentication: X.509 within IPSec and the use of Extended Authentication protocols in IPv6 guarantee that all endpoints are who they say they are.

        Overrated. See above. The PKI can-of-worms is bad enough with only servers, who's going to issue certificates for millions of end users and devices? How do you decide which root certificates to trust? How do you handle revocation?

      • Fragmented Packets: Firewalls don't handle fragmented packets well, as there is no header to check for later fragments. Fragmenting and re-assembly also adds latency. IPv6 defines per-connection MTUs, guaranteeing ALL packets are the largest supported between any two endpoints without fragmentation.

        Cool. Fragmentation sucked anyway, and per-host MTU makes it possible to use jumbo frames in mixed 100/1000 LANs.

      • Latency: IPv6 headers don't have as many entries and are heirarchical, which makes routing much faster and much simpler. The lack of fragmentation and the presence of auto-MTU also helps.

        Undetermined. Heirarchical routing makes things easier for the routers, harder for end-user sites (think renumbering when you switch ISPs). It's too early to tell how this will pan out in the real world.

      • Multicasting: IPv6 mandates multicasting and has a decent range of addresses for it.

        Cool, if it works. There's still a lot of issues to hammer out in this area before we see any multicast capable BitTorrent implementations.

      • Anycasting: IPv6 mandates service location and resource location abilities, which means no more hunting for printers, routers, DNS servers, SMTP servers, POP/IMAP servers...

        Very Cool. The all-zeros anycast address for routers means you don't have to worry about what your default gateway is. I'm eagerly awaiting standards for DNS over anycast, which can lead to all the service discovery features. The IPv4 anycast address for the closest 6-to-4 gateway is a neat trick, too.

      • Autoconfiguration: IPv6 uses autoconfiguration for routing and addressing as a standard, in a manner (almost) guaranteed to be free of conflicts and absolutely guaranteed to be fully scalable.

        Cool. The only thing missing is configuration of DNS servers; hopefully anycast will take care of that. DHCPv6 may help also, but is there even a complete implementaiton of it yet?

      • Mobility: IPv6 mandates the ability for nodes or even entire networks to be totally mobile (ie: switch upstream routers without losing connectivity or existing connections) with upstream optimization of routing.

        Overrated. I don't see how this can be practical on a global hierarchically routed network. The goals seem mutually exclusive. The work I've seen focuses on forwarding by an agent on your home network, which is horribly inefficient.

      • Advanced Headers: IPv6 allows an arbritary number of extended headers to be attached to packets, with controlled responses for unknown extended headers.

        Scary. Potentially cool, but I'll bet all of the cell phones and random devices people want to be IPv6 enabled will be full of security holes relating to header parsing. I don't care how clearly the spec is defined, they'll still screw it up.

      • High Availability: IPv4's High Availability mechanisms require a lot of fancy manoevering, because t

    6. Re:"IPv4 loyalists" by ysachlandil · · Score: 2, Informative

      # Security: IPv6 mandates IPSec

      And everybody knows what a broken piece of insecure crud that is. Give me SSL any day.

      # Authentication: X.509 within IPSec

      Ooh goody, I cannot wait to pay $300 per server to get my x509 certs.

      # Fragmented Packets:

      Path MTU not good enough for you?

      # Latency:

      one word - MPLS.

      # Multicasting:

      Too bad nobody has made a workable protocol for it yet.

      # Anycasting:

      Brilliant, but what happened to broadcasting?

      # Autoconfiguration:

      It's called DHCP. Oh, and why sacrifice 64 of the 128 address bits for it? Seems excessive.

      # Mobility:

      And is based on Mobile IP which works fine over IPv4.

      # Advanced Headers:

      But nobody except the endpoint can look at them. And the endpoint already looks inside the packet. So what is this good for?

      # High Availability:

      Oh? So multihoming is not a problem anymore? They fixed this already? Nope, because they cannot fix it. See shim6 for an example of an ugly hack...

      # Tunneling: There is no agreed method of tunneling in IPv4

      VPN? Okay, that uses IPSec so that doesn't count. SSL? Cannot connect a network to a network. Hmmm, maybe tunneling is a very generic concept and we need to have multiple protocols to get everything we want. IPv6-over-IPv6 doesn't do layer-II networking because IP is already layer-III. So there will always be a layer-II tunneling protocol as well. So there will not be a single tunneling concept in IPv6 as well.

      # Clusters: Infiniband cooperates well with IPv6

      Okay... nice corner case. Too bad most everything else isn't compatible with IPv6 yet.

      # Reachability: IPv6 can reach all IPv4 nodes

      And IPv4 cannot ever reach any IPv6 nodes. So a new business always needs IPv4 addresses to get to a sufficiently large client base.

      ---

      The biggest problem with IPv6 is that it is revolutionary instead of evolutionary. That is why overlay networks are already much more succesfull now.

      Iff IPv6 supports proper multihoming without nasty hacks, then I'll give it another look. Until then it's IPv4 for me.

      --Blerik

  4. What's in a name? by Nom+du+Keyboard · · Score: 2, Funny
    is well ahead of adoption in this market so everyone is deferring.

    Maybe it will be IPv7 by the time it's adopted.

    Better yet, why not name it IPv2005, so everyone will have to take it up by the end of the year lest they be left behind? Sure sounds better than IPvXP or IPvVista, doesn't it?

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  5. One Reason Alone is Enough by Nom+du+Keyboard · · Score: 5, Insightful
    One reason alone is enough to make IPv6 a "good idea." Permanent static IP addresses for everything.

    I, for one, will welcome the end of the NAT kludge.

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
    1. Re:One Reason Alone is Enough by denis-The-menace · · Score: 2, Insightful

      One reason alone is enough to make IPv6 a "good idea." Permanent static IP addresses for everything.
      I, for one, will welcome the end of the NAT kludge.

      And your ISP will charge you for each Address you use!
      NAT let's you use ONE IP from you ISP and have as many Internal IPs as you which without being gouged.

      --
      Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
    2. Re:One Reason Alone is Enough by hey · · Score: 2, Insightful

      That's what firewalls are for. Not NAT.

    3. Re:One Reason Alone is Enough by operagost · · Score: 2, Interesting
      And your ISP will charge you for each Address you use!
      In a scheme where there are enough available addresses to give one to every grain of sand, the laws of supply and demand suggest that the value of each IP address will approach zero.
      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    4. Re:One Reason Alone is Enough by David+Greene · · Score: 2, Insightful
      the laws of supply and demand suggest that the value of each IP address will approach zero.
      Except that the "laws" aren't laws at all and are in fact closer to myth. The supply of an item does not determine its price. The price people are willing to pay determines its price.
      --

    5. Re:One Reason Alone is Enough by jafiwam · · Score: 2, Insightful

      As far as repelling random unsolicited traffic is concerned, NAT is the equivalent of a firewall already.

      NAT and simple port forwarding for those rare hosted services are all that 99.5% of the population needs. ISPs and businesses are all different. But even probably 80% of the businesses I deal with, NAT with NO port forwarding works just fine.

      Of course if you are allowed and able, running a mail server at home is fun.

      But get serious, NAT is an effective firewall for most people. Just like the random Chevy is good enough for most people. Saying "but but but it's not a porsche!" all the time just makes you look like an elitist geek.

    6. Re:One Reason Alone is Enough by Jerrry · · Score: 2, Interesting
      NAT and simple port forwarding for those rare hosted services are all that 99.5% of the population needs.

      Right. And 99.5% of the population didn't need more than 640K of RAM, or needs to drive faster than 65 MPH, etc.

      Stop engineering things to the lowest common denominator and do it right. For once. Please.

    7. Re:One Reason Alone is Enough by diamondsw · · Score: 2, Insightful

      Yup, I got a bit pissed an deserve the flamebait moniker on that. I'll chill next time. However, after reading the same reason over and over from people who haven't set up "real" networks (enterprises, hosting, datacenters) it gets VERY tiresome. Maybe I'll just write up a decent reply and save a copy for the next time this comes up...

      The ISP problem is one of artificial scarcity, which is exactly what IPv6 relieves. The only reason they charge in the first place is that IP's really are a limited commodity, and they can't give them out to every device. With IPv6, this is no longer an issue, and static addressing would be the norm (probably still managed by DHCP, but it would never change). Every piece of equipment worth anything has supported IPv6 for a long time now. Anything that doesn't (in 2005!) deserves not to work, home networking equipment included.

      The amount of pure pain that NAT causes for network administration is incredible. I went into all of the routing problems in another post (asynchronous routing, excessive static routing, firewall problems, etc). Don't keep saying "we don't need to do things right, my kludge works fine (mostly)", just do it right already!

      It *mostly* works for home networks, but still causes problems even there. It is still responsible for software having things like "this won't work unless you configure your router to forward these ports here", which also results in your being able to only use one of a given service "normally" on your network. Try to set up two web servers on your home network, both on port 80. With IPv6 and static addresses, you can; with NAT, you can't. P2P would be even easier (and probably more commercialized) if you could install the app and have it just work, but no, you have to forward a different range of ports for each protocol. None of this would be necessary if you had IPv6.

      The only reason I've seen on this whole discussion to keep NAT is that it does allow your network to be completely abstracted from your ISP's address space. Agreed, that is certainly a benefit. However (you knew this was coming), it would be better still if instead of doing a one-to-many NAT, you did a one-to-one NAT. Keep your addresses abstracted, but avoid all of the problems and messiness of NAT (or PAT, as I probably should be calling it).

      --
      I don't know what kind of crack I was on, but I suspect it was decaf.
  6. Market Forces by bizitch · · Score: 5, Insightful

    Just like anything else, market forces will dictate when this gets adopted.

    Are we really running out of IPv4 numbers? The market will tell us.

    Is there a killer app for IPv6? The market will tell us.

    Can we ram IPv6 down everyone's throat? The market will retailiate and hit back.

    BTW - what's with this "wont somebody please think of the children" bullshit about? If we need to get to IPv6 - we'll get to it - relax already!

    --
    ---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
    1. Re:Market Forces by tenchiken · · Score: 2, Informative

      A few things to remember, this isn't the first time that technical purists have tried to change the underlying protocol for the internet for logistical reasons. The first Attempt at replacing TCP/IP internet wide was far more braindead then IPv6 (packet size of 53 bytes? Yeah, let's ship everything around in a packet size that not only is not a power of two, it's a large prime number! Oh and for traffic control, let's just drop everything into a leaky bucket!)

      However, it's been clear ever since IPv6 was introduced that it was signficantly larger and more complex then it needed to be. Not only is it not a sensible extension of IPv4 (which has proved it's durability over and over) it is requiring a whole new round of experience so we don't run into the same problems we hit in 88 and 89 before Van Jacobson fixed TCP/IP.

      I think that NAT and CIDR have removed the need for IPv6 until the next iteration of technology requires it. It does not make any sense to migrate to the new technology before then.

  7. Three Items: Vista, Home Autmation, and Search. by CDPatten · · Score: 5, Interesting

    Windows Vista will make IPv6 the protocol of choice. You can bind IPv4 and IPv6 in different orders on the NIC and it will enable great support for the protocol. They are even talking about having it running as part of the default install.

    MS is developing Vista to enable programmers to push Home Automation. One thing they are doing is adding in that area is the functionality for IP's to securely be handled like a plug and play device. This isn't for printers on a network; it's for all the appliances in your house. IPv4 just doesn't work well for home automation. Also another sign is the majority of GE prototypes all are geared towards IPv6 not IPv4.

    The regional specs that come with IPv6 are also huge things for MSN, Google, and Yahoo. It will allow your search (and Ads for that matter) results for a "pizza place" to give you the ones in your area without any additional info.

    Vista will start the ball rolling, and the other two items will make the transition come very quickly. Security is also nice, and will help stop allot of traditional hacking, but the end user doesn't get excited about that. They will get excited about the other stuff though.

    Two years from now we will start to see IPv6 becoming very common.

  8. Two reasons. by khasim · · Score: 3, Insightful

    #1. It allows you to run multiple boxes at home WITHOUT having to pay extra for a "family" connection plan.

    #2. Cheap and easy way to block worms and such.

    1. Re:Two reasons. by Kadin2048 · · Score: 3, Insightful

      Neither of these points are really arguments for the current system, if anything they're good arguments against it, and in favor of IPv6.

      #1 is nothing but a direct consecquence of the current shortage of IPv4 addresses. Under IPv6, there'd be no reason why every device on your network couldn't get a separate "real" address. The way they're handed out -- using a hierarchy instead of finite blocks -- would allow your ISP to let your home DHCP router hand out globally addressable IPs if it was set up correctly. Assuming your ISP doesn't suck, that is, and that's really not the fault of the IP system, one way or the other.

      #2 is pretty frightening, because it shows a misunderstanding of what NAT is and a certain amount of laziness about security in general. That said, there's no reason why you couldn't get a 'firewall in a box' that would provide just as much (or as little) security without the NAT facility. It's just that right now when you go and buy a "home firewall" from Linksys, it almost always includes NAT by default (because of point #1, the pressure by ISPs on home users to only have one IP address due to limited supply). There's no reason why this needs to be true, however, and the security comes from the firewall effect and not the address translation itself.

      --
      "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
  9. The IPv4 scarcity issue is a myth by Snarfangel · · Score: 4, Funny

    There are plenty of addresses in northern Alaska that aren't being used. "Peak IPv4" indeed.

    --
    This tagline is copyrighted material. Please send $10 for an affordable replacement.
  10. Geoff Huston's changing story by wayne · · Score: 3, Interesting
    Geoff Huston is the one mentioned in this article that IPv4 address exhaustion isn't a problem. It isn't a problem because scares IP addresses lets ISP charge more. I'm not sure that consumers would agree with this logic.

    In July 2003, Geoff said that IPv4 addresses will run out in two decades.

    About two years later, Goeff says that IPv4 addresses will run out in just one decade.

    So, if even very anti-IPv6 folks are saying that IPv4 addresses will run out sooner than expected, I think it is time to start preparing to the conversion.

    --
    SPF support for most open source mail servers can be found at libspf2.
  11. NAT Separation Good??? by imunfair · · Score: 2, Informative

    Correct me if I'm wrong, but isn't NAT and the separation of networks a good thing, security wise? (Obviously there are other measures needed, but it plays a part..) Even if we had IP6 it seems we'd still want DMZs and the like. Maybe I'm getting the wrong impression from the articles, but it seems like they're emphasizing everyone being able to have an IP address on a common network essentially - instead of the Internet being a network connecting a bunch of private networks. I don't know about you, but I feel much safer having my computers on a private network connected via one IP and a router than I would having all of them exposed.

    1. Re:NAT Separation Good??? by hpa · · Score: 2, Informative
      NAT and firewalling are completely separate things. Since they're done at network boundaries, they are usually combined in one device, but they don't have to be.


      NAT is a pretty bad thing. Unfortunately the IPv6 people haven't considered the requirements for managing that large of an address space except by hierarchy (which breaks as soon as you want to have a backup link to another ISP), so I fear we'll still have to have NAT in an IPv6 world.

    2. Re:NAT Separation Good??? by cnlohfin3109 · · Score: 2, Interesting

      this point keeps being brought up over and over agian here. NAT devices are not firewalls NAT destroys the end-to-end connectivity, its just a kludge on kludge to allow limited protocol transparency - not a solution -

  12. Why doesn't Slashdot support it yet? by caluml · · Score: 4, Funny
    calum@www1 calum $ ping6 www.slashdot.org
    unknown host
    calum@www1 calum $
    Cmon, Slashdot. insmod ipv6.o
    1. Re:Why doesn't Slashdot support it yet? by Slowping · · Score: 4, Funny

      which leads to the question... if Slashdot converts to IPv6 and only accepts IPv6 connections, how quickly would the rest of the Internet get changed?

      --
      (\(\
      (^.^)
      (")")
      *beware the cute-bunny virus
    2. Re:Why doesn't Slashdot support it yet? by spinfire · · Score: 2, Informative

      There is no need to convert to *only* IPv6. Dual stacked service is available today in many data centers! This means you can simply give your interface an IPv4 and IPv6 address, and give it A and AAAA DNS records. IPv6 enabled clients will use the IPv6 address and IPv4 clients will use the IPv4 address. Simple transition.. and it can be as long as it needs to be.

  13. NAT is not the answer! by kasparov · · Score: 4, Insightful
    Anyone who has to deal with SIP absolutely hates NAT. SIP is a VoIP protocol that is pretty much where everything is headed. Some instant messenger clients/servers even use it. And it is most definitely not NAT-friendly. In SIP, the call setup information and the media can travel differnt paths. This means that endpoints can comunicate directly without having to send media through a central location. Since the SIP message contains a description of what ports to expect the audio to arrive on in the body of the packet, NAT boxes will generally block the media coming from the other device. 90% of the problems that VoIP providers end up having to deal with is NAT-related.

    You have to go to all kinds of lengths (using special session border controllers, media proxies, etc.) to be able to support SIP calls where one or both parties are behind a NAT. It is awful. NAT is a hack--a useful one in certain situations, but still a hack.

    --
    There's no place I can be, since I found Serenity.
    1. Re:NAT is not the answer! by MikeB90 · · Score: 2, Interesting

      Sorry, it seems to me that SIP came way after NAT was widely deployed.

      So it was an omission/flaw in the specification NOT to take NAT into account. Period.

      Are things much easier without relayers, etc to get past NAT - sure is. But in the Real World almost everyone is NATTED.

      SIP will remain insignicant in VOIP and Messaging deployment until some one (I'm sure someonme has) hacks around the NAT issues. And it is a weakness of the RFC that it did not speciically state how to do so. IN so doing, they

      a) marginalized SIP
      b) made messy kludges that weren't officially blessed and thus possibly not interoperable a way of life.

      Bad job SIP committee!

    2. Re:NAT is not the answer! by Cramer · · Score: 2, Insightful

      I've said it before, and I'm saying it again. EVERY problem that has cropped up with protocols not working through NAT has been attributable to the protocol being designed as though it authoritatively know things that it cannot authoritatively assess.

      I see the problem with SIP after 30s of reviewing the RFC. Right there in Fig. 1... it tells the remote end how to connect back. That will not work reliably - period. NAT or not. The SIP client is picking an interface/hostname (at random) and feeding it to the remote client. For any machine that has more than one NIC, there exists the possibility the client will pick the wrong interface.

      I have never seen an application with the necessary logic to correctly determine what INADDR_ANY should be for a remote client. Most simply pluck the hostname from the system (and to my surprise, not always with gethostname()!) and either send that or lookup the address and send that. Those that try (and fail) to be smart and fetch a list of interfaces, never bother to look at the route table to use the correct interface. (on linux they'd have to look through any rules as well.)

      NAT is not the evil here. The protocol itself demands clear, unobstructed communications between peers. This is extremely unlikely on the internet. And that's not going to change. If your NAT and/or FW device is not SIP aware, you will have problems. It's not NAT or the firewall's fault the protocol was designed this way. The designers of the protocol are to blame for not concidering the existing medium through which it would have to work -- NAT and firewalls have been around much longer than SIP. (the truth is, SIP was never intended to cross these network boundries.)

  14. Two big issues by augustz · · Score: 2, Insightful

    One is, despite the claims that IPv4 will run out in the next "x" years and companies will be screwed, that never happens.

    Worst case, folks will figure out how to get by on 1-2 ip addresses, or pay more than the $1/month or so to get an extra. There are TONS of unused, unrouted addresses out there through the entire hierarchy, from subnets, class b's etc.

    Second, IPv6 and you can what? If I run IPv6 only, I need to at some point tunnel to IPv4 (and often get an IPv4 address anyways) to connect to the rest of the net. If I run just IPv4, I can connect to everything, and the first person who develops google that is IPv6 ONLY is going to have very few users.

    In other words, the business case is flat out not there.

    Also, I never understood why IPv4 wasn't just a subset of IPv6? Why can't my existing IPv4 addresses also be IPv6 addresses with a standard prefix? Maybe this has changed, but when IPv6 came out it looked like that wasn't part of it.

    If my address was a subset, my ISP could create IPv6 endpoints for my address along with the IPv4 routing, even if I hadn't upgraded. They'd just strip the prefix and forward to me.

    1. Re:Two big issues by hpa · · Score: 2, Informative
      Also, I never understood why IPv4 wasn't just a subset of IPv6? Why can't my existing IPv4 addresses also be IPv6 addresses with a standard prefix? Maybe this has changed, but when IPv6 came out it looked like that wasn't part of it.

      They are, the prefix is ffff::/96. In addition, there is 6to4, which lets you use your IPv4 address as a 48-bit IPv6 prefix, 2002:<IPv4 address>/48.

      The problem is... who will deploy the first IPv4-unreachable Internet service?

  15. IPv6 Considered "Production Grade" by netrangerrr · · Score: 5, Informative

    At Tuesday's IETF meeting in Vancouver the vote for consensus was many for and none against elevating the IPv6 Protocol Standards from "draft Standard" to "Internet Standard" and make them part of the everyday production Internet. The IPv6 WG is even shutting down as it has accomplished its mission and designed a good working protcol. The wired and wireless networks provided for the engineers at the IETF is running IPv6 and we are regularly using it to get information from our working group colloboration sites like: www.v6ops.euro6ix.net/

    Don't fear, the IETF V6 Operations (V6OPS) team and the IPv6 Forum will continue work to better clarify how to deploy IPv6 and to help build new network services around the new features. Most of the new network services groups in the IETF are basing new services on the features of IPv6 - early examples are Mobile IPv6 (MIPv6) and Network Mobility (NEMO) both of which are being extended to offer IPv4 access through IPv6 tunnels in order to get IPv4 native service through IPv4 NAT.

    If you actually have useful comments or design alternatives for IPv6, bring it up in IETF working group mailing lists [http://www.ietf.org/html.charters/wg-dir.html%5D. If you don't understand because of FUD, please read up on our North American IPv6 Task Force website website [ www.nav6tf.org/ ] or the similar European/Asian sites.

    --
    "As for the future, your task is not to foresee it, but to enable it." - Antoine de Saint-Exupery
  16. Legacy? Lol! by Mantrid · · Score: 2, Funny

    Yeah because protocols are what we'll be remembered for!

  17. Market? Or cynical manipulation? by DoctorNathaniel · · Score: 5, Insightful

    "The death of IPv4 has not really killed the Internet. In fact, far from it, we've managed to make an industry around it."

    In other words, by keeping IPv4, we can sell NAT boxes (which we're already selling in huge numbers.. the wireless network hub in my den is a prime example.) Cisco has a big investment in building hardware to take care of IP space limitiations.

    "You will still be able to get addresses, if you pay for them, because a market will appear."

    In other words, this damned internet isn't making us enough money, because IP addresses are free. We want people to start trading them, so we can get commissions on the sales.

    It's clear that this is "good buisiness" for the big internet companies: why invest in a new system that will make users's lives cheaper and easier when we can continue to sell patches on the old stuff, and make a market so that we can start charging the freeloaders?

    It's also clear to me that the only way IPv6 will get adopted is if public bodies start using them and demanding their use. For instance, if Internet2, the US military, or all of .gov start adopting, then it will get off the ground. Of course, this is unlikely to happen because Cisco doesn't sell IPv6 switches.

    I'm no expert, but to my cynical eye it looks not like market forces, but like the usual problems with capitalism exploiting a local maximum and avoiding short-term risk.

    ----Nathaniel

  18. Re:Here s abetter question, for you by Trevahaha · · Score: 2, Interesting

    Because your recommended solution is a patch for the problem. So what if you don't want it, maybe I do want a public IP address for a fridge that I want everyone to have access to. Having IPv6 doesn't destroy NATs - you can still do it.

    It's a matter of people saying "but I don't want to change!"
    I'm excited that I could have a chance to reserve a person IP range for myself. I'm excited that the cost of IP addresses would fall because they are no longer a commodity. Why can't we realize that this gives us more options, it doesn't destroy the old ones.

  19. So get this... by Whafro · · Score: 2, Funny

    Even my stupid IT Director thinks that IPv4 is sufficient...what a loser.

  20. The Real Truth by Nom+du+Keyboard · · Score: 4, Interesting
    The real truth is that IPv4 addresses currently have value due to scarcity. An IPv4 address range has a tangible value that can be sold, rented, leased, or hoarded. With essentially unlimited IPv6 addresses the value of IPv4 address space loses virtually all of its value, static IP addresses shouldn't command any premium anymore, and the barrier for entry of new ISP's is diminished. Certainly the current power structure likes things just as they are.

    "We happen to work in an industry that survives on complexity, address scarcity and insecurity," Geoff Huston, senior Internet research scientist at Apnic, said. "This is where the margins come from, and we are not innovators in this industry any more. We've learnt that optimism doesn't create a business case. All those people disappeared along with the dotcom boom," he said.

    That is a stupid statement. It would be more accurate to say either "limps along" or "thrives" instead of "survives" in this context. The steam engine industry undoubtedly felt the same way about the internal combustion engine when it was first proposed.

    Of course, Ipv6 isn't enough. It's not enough until every atom in the Universe can have it's own unique IP address, after which we can discuss the strings that create them.

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  21. Supply and Demand by norminator · · Score: 2, Interesting

    the laws of supply and demand suggest that the value of each IP address will approach zero.

    Except that the "laws" aren't laws at all and are in fact closer to myth. The supply of an item does not determine its price. The price people are willing to pay determines its price.


    It's not really a myth, it's a valid model of economics. The question you're bringing up is more about who is providing the supply, and how freely they make it available. If everyone could just give themselves an IP address, then yeah, each address would be worth very little. But when your ISP controls the addresses you get, you have to have one to use the Internet, and they can market each additional address as a feature, then there is still a demand, and they are aritficially limiting the supply. It's like the diamond industry: DeBeers owns most of the supply, and there's lot of diamonds, but they don't let more on the market than the market demands to make sure that people will have to pay a lot for diamonds.

  22. Oh, so many comments.... by slappyjack · · Score: 4, Interesting

    IPv6 vs. NAT
    These are two distinctly different things. Nat takes one public IP address and translates it to many private IP addresses. THese are not two competing technologies, and you can use NAT with an IPv6 address. In reality, there isnt a debate here. Its a weak argument for those that want to keep things whe way they are.

    IPv4 addresses an a commodity
    Greedy Fuckers. Pure and simple. The basic interenet and all its various little noodly bits were created but university and governmetn organizations and then just loosed on the planet essentially for free. Yes, you had to buy some hardware to use it, but the shit works without you having to pay for a damn thing but your connection.

    I have nothing against the idea of capitalism where you get paid for something you create, but hoarding a commodity that is out there for the collective good as a whole is just shitty. In very few cases is there a justification for the belief that "I must make ALL of the MONEY and IT MUST HAPPEN RIGHT NOW and YOU CANNOT HAVE ANY."

    As an added bonus, this sort of behavior helps keep the "have nots" in the "have not" category, which just generally pisses them off unnecessarialy.

    needing a publically available address
    No, obviously we all do not have to have public IP addresses - not yet, anyway. Saying you don't now or never will shows a pretty big lack of foresight. You don't KNOW that there wont be an application that needs publically available addresses to work well andd that NAT just won't cut it. Why don't you know? Becuase someone will eventually come up with sommehting new, and it'll be good and important. People always do, eventually.

    I realize that if you really wanted to have everything you own connected to the internet you could just use NAT and then if you wanted to talk to your refridgerator you sould just use "the fridge port" but its adding a level of complexity that could possibly get in the way of something on down the line.

    This would slow down address scanning worms, neh?
    if a worm's gotta look at giant chunks of addresses to find other victims, wouldnt this just slow down their epread a little?

    then again, what the fuck do i know?

  23. IPv6 never caught on? by spacemky · · Score: 2, Funny

    "Hey, could you ping me? My IP is: 5F05:2000:80AD:5800:0058:0800:2023:2F8E. Thanks"

    --
    640YB ought to be enough for anybody.
  24. Re:IPV6 128 bit addresses make no sense by Jerry+Coffin · · Score: 4, Informative
    I don't see why IPV6 needs to have 128 bits for addresses.

    128-bit addressing isn't really necessary -- but it makes life really simple. With IPv4, you have a subnet mask (that AFAICT, 90% of people never quite understand) that tells how much of your address is devoted to the local subnet, and how much isn't. With IPv6, this has simply been fixed at 64 bits apiece, so using it, nobody ever has to figure up a subnet mask again.

    A better question would be to turn this around: what would we really gain by reducing the addresses from 128 bits to 64 bits? We'd save 128 bits per packet. Even over a 28.8K dialup line, that's approximately 4 milliseconds per packet. However, IPv6 increases the maximum packet size you can reasonably use, so unless you really need to send lots of tiny packets, its addressing overhead may well be lower than with IPv4. In most cases, you gain a bit, and even in the worst case you lose very little.

    If you're doing things like VoIP, IPv6 helps a lot more: in IPv4, QoS was hacked on after the fact (and has never really worked very well), but in IPv6, it's part of the base protocol.

    Personally, I think we need to consider the source of TFA: Cisco and APNIC. Cisco is the leading provider of IPv4 routing (etc.) equipment by a wide margin. APNIC derives it "power" largely from the scarcity (and therefore value) of IP addresses.

    A shift to IPv6 gives other router manufacturers a much better chance of gaining market share over Cisco -- about the best Cisco can hope for is to maintain their current position, but in reality they're likely to lose at least a little. Cisco has only to look at what happened to Lucent when the market shifted from ATM to IP to see how badly a technology shift can hurt even a huge market leader.

    APNIC stands to lose even more: rather than a chance of losing market share, they face a near certainty that a large part of their power base simply ceases to exist.

    Looking at it from this (admittedly cynical) direction, what are the chances that they were going to write an article in favor of IPv6, regardless of its merit?

    --
    The universe is a figment of its own imagination.

    --
    The universe is a figment of its own imagination.
  25. Re:Backwards compatible? Er... yeah. by Jearil · · Score: 4, Interesting

    I'd like to reiterate what the parent says about v4 compatible v6 addresses. I've had to study RFC2373 (http://www.faqs.org/rfcs/rfc2373.html) and the people who designed IPv6 didn't do it without consideration of the current system and how a transition would go. In fact, a lot of effort went into making it possible to transition to a larger address system while using both systems at the same time.

    It's actually similar to how the x86 archetecture has advanced. When we moved up to 32-bit CPUs, in order to access the upper bits, new registers were created to address those upper bits while the lower ones stayed. An older 16-bit program would merely only use the lower bits, ignoring the upper ones since it wasn't designed to use them.

    IPv6 allows for the last 32 bits to be used as an IPv4 address. You can even write out an IPv4 compatible IPv6 address using a combiniation of both hex and dotted decimal. eg: 0:0:0:0:0:FFFF:129.144.52.38 which in IPv6 can be compressed to ::FFFF:129.144.52.38 and which an IPv4 device would see it as merely 129.144.52.38. The idea being, when transferring over, only devices that actually need IPv4 compatibility would have an IPv6/IPv4 address. Quick example using NAT technology:

    Say I have an office with 500 devices that need net connections. Now I also have a remote office with another 200 devices. These devices all like to connect to each other.. with various servers and services on each that make using NAT translation a PITA, but also buying 700 IPv4 addresses is mighty expensive. Now most of these devices are for internal use.. (I'll get to that). Now we do have 5 web servers that need to be accessed by people outside of the company (sales servers with web pages to sell stuff or show off our company). We give all 700 devices IPv6 addresses so that they can access each other over the internet. We give those 5 that need to be seen by everyone IPv6 addresses that have IPv4 mappings so that everyone can see them. We can get a few IPv6 addresses with IPv4 mappings to act as a NAT-like access point for internal devices to get to external IPv4 places for say viewing web pages or the like from internal machines.

    But now one has to think.. why would we need 700 externally accessable devices? Isn't that a security nightmare? Managing all of them so that they don't get hit by a worm or such could really suck... but why do those devices have to be computers? What about VoIP phones or something similar?

    I currently manage a VoIP setup that I implimented and support myself, and let me tell you.. NATs SUCK for VoIP. SIP hates it.. works half the time and the other half no go. If two devices are behind NATs, plain and simple they cannot talk to each other. If they have external addresses on most phones you can just dial straight to the IP address of another VoIP phone without even needing an intermediate server.. which can be handy at times.

    It's just a minor example and I'm sure it can be picked apart and made to work on IPv4 (I've been doing such). But the time/cost savings of IPv6 along with just the mirade of possibilities it brings shouldn't be thrown aside because it would be "too hard" or "too expensive". The cost isn't as high as a lot of people think.. most are just afraid because they don't know anything about IPv6 and what you can do with it in reguards to IPv4. And of course no one knows, because no one is going to train in an area that has no use currently, which will remain that way until people educate themselves in it.

  26. Re:So how do I get PI addresses for IPV6? by MrGushi · · Score: 2, Informative

    Same way you'd get them for v4. Apply for an ASN, get them from ARIN. (Assuming you're in the Eastern Hemisphere). Otherwise, I've had good luck with tunnelbroker.net

  27. Re:Anti-IPv6 people don't realize something import by Oid.Surin · · Score: 2, Insightful

    In the past I was very pro IPv6, until I gave it some serious thought. True, IPv4 probaby will not hold up forever, even with CIDR and NAT/PAT, but those definately do extend it's life span signifigantly. If all the organizations with unused address space would turn in unused addresses, we would be in an even better position. If organazations not yet using NAT/PAT would do so, we would be even better yet. I am a big supporter of NAT anyways though, I do not feel that every machine in the world needs a live IP address. How many windows boxes are protected from worms simply because they are not on a live IP? Yes, there are some issues with NAT, but there will be issues with the conversion (and use) of IPv6 as well. My current distaste of IPv6 may partially be due to a lack of knowledge on it, but in a lot of ways it seems illogical, and unnecessary. 128 bit address space, when we are limited to 48 bits of MAC addresses. Illogical in that, with IPv4, it is fairly simple to know that a block of addresses belongs to Company X. But that is just my 2 cents, please, correct me if I am wrong on anything...

    --
    ~oid
  28. Re:So how do I get PI addresses for IPV6? by nsayer · · Score: 2, Informative

    Anyone with a single globally routable IPv4 address can have a /48 IPv6 prefix right now, today. Check out 6to4.

  29. No, wrong. by Kadin2048 · · Score: 2, Informative

    I beg to differ. I question whether you're serious or a troll, but I'll respond anyway and give you the benefit of the doubt.

    Lots of companies which are big enough to have their own Class-A allocations assign all of their clients globally routable addresses. I can tell you this from personal experience.

    They don't use personal firewalls, obviously, and I have no idea why you think this is related. Using a personal firewall at the client level has nothing to do with IP address allocation or NAT. You can assign every user on a subnet a globally unique IP address, and then still use a stateful firewall for security. This is what these companies do: you get the benefit of not having your applications negotiate NAT with the protection of firewalls separating the internal networks at various facilities from the global network.

    As far as the cost thing, if you're big enough to have a Class A block, you're not paying individually for IP addresses, so there's no difference in cost between a client that has a unique address and a NAT one. In fact the NAT one is probably slightly more expensive because the NAT routers are probably more maintainance and support-intensive than a straight firewall.

    In short, I don't think you know what you're talking about. You might be correct when it comes to small or medium businesses, who are buying their connection from an ISP who is going to charge them more for a lot of static IPs than a few dynamic ones that they can use with NAT, but this issue isn't relevant to IBM, Ford, Apple, or the rest of the Class A companies.

    --
    "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
  30. Are we ready to surrender anonymity on the net? by schwaang · · Score: 4, Insightful
    What's the deal with including your MAC address as part of your IP address?

    Yeah this looks like a serious privacy issue that most people haven't woken up to yet.

    A MAC address is (usually) a globally unique identifier. How long before someone big builds a database relating MAC to user identity (Microsoft, your ISP, law enforcement, whoever).

    At that point, no matter where you connect your laptop from, your traffic can be identified as yours. Be it for the purpose of advertising, tracing communication, or other data mining.

    So the question is, are we ready and willing to surrender anonymity on the net?
    1. Re:Are we ready to surrender anonymity on the net? by Halo- · · Score: 3, Insightful
      A couple of points:

      1) With a static IP, especially if you have a DNS name to go along with it, you leave just as big of a footprint, if not more. (Since I've only got the one directly addressable IP, I might as well get a name to go with it, right? And then use something like DynDNS? Well, unless I register by proxy, I have to give my name, address, phone, etc...)

      2) MAC address, while theoretically static, can easily be changed in most OSes and hardware. For example, my LinkSys router has an option to "clone MAC address" in the setup. The problem with changing your MAC address is that the prefixes indicate the vendor, and that might get you in trouble with someone who "owns" that prefix. (I doubt it though)

      3) There is nothing preventing you from NAT'ing IPv6, and I suspect some people probably will simply for the quasi-deny-all-in firewall effect. Moreover, if you really want to be anonymous, IPv6 makes it much easier to implement things like "onion routing" because it's a lot easier for individuals to set up persistant servers.

      The point is, you can control the "MAC" portion of the address, and the "public" portion is just as visible (or not) as with IPv4. Hell, you could change your MAC address every coupla minutes for a REALLY long time without ever repeating one if that's what you wanted. (Persistant connections be damned...)

  31. Hope you're not an aircraft mechanic. by Kadin2048 · · Score: 2, Insightful

    But the more appropriate analogy is: You don't take
    your car in for complete engine rebuild if the engine
    is running fine.


    While this may be true for your car, it's definitely not true of a helicopter, or a generator at a power plant, or any other important piece of machinery.

    Would you still fly on an airline if that was their attitude towards maintenance? "Nah, we're not going to tear down that turbine...it hasn't failed yet!"

    I think perhaps you should reevaluate the importance of the Internet to our society today. I think we've well surpassed the relative importance of a car to an average driver.

    --
    "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
  32. Re:Reasons to use NAT by Tony+Hoyle · · Score: 2, Informative

    Given how hard it is to get an ISP to give you reverse DNS... how in the hell are you going to persuade the them to start updating routing tables!

    All the ISPs I've found charge *per month* per IP for *zero* effort - it's just a cash cow. IPV6 won't change that... they'll charge you per month for a block of 256 or something instead. Then change their TOS so you're not allowed to run servers (if they haven't already).

    All this is academic... IPV6 has been around for years and not a single ISP has shown any interest at all in implementing it. The old 192.88.99.1 'anycast' address no longer works I notice... it did 2/3 years ago, so IPV6 adoption is going backwards not forwards.

  33. It's supposed to be Overkill by Pii · · Score: 4, Insightful
    Overkill is exactly the point.

    The previous poster asked Why 128 bits instead of, say, 64?

    The amount of work required to jump to 64 bit addressing or 128 bit addressing is identical. Since you're going to have to re-write everything anyway, you may as well figure in a ridiculously large address space, because not doing so saves you nothing.

    Additionally, the routing table saving offered cannot be understated. With huge swaths of continguous address space, you can (hypothetically) represent an entire continent as a single aggregated routing entry (The more granular routing information would only be seen locally.), and the number of unique addresses within that range would be virtually inexhaustable.

    Overkill is a good thing when it doesn't cost you anything.

    --
    For those that would die defending it, Freedom
    has a sweet taste that the protected will never know.
  34. "The IPv6 Mess" by Flwyd · · Score: 2, Informative

    IPv6 fans ought to read D.J. Bernstein's excellent article on the subject. In short, the main problem is that the two protocols aren't easily interoperable, so investment in IPv6 infrastructure is without short-term return.

    --
    Ceci n'est pas une signature.
  35. Not me too by mwood · · Score: 3, Insightful

    Is there an echo in here? "We'll never run out of [2^N for any value of N] addresses". Yes we will. There are people who are scheming to put every bloody light switch and kitchen appliance on the Internet. There are people designing applications to run on microscopic hosts that will be scattered like seeds, by the thousands or millions.

    It's 128 bits instead of 64 so we don't have to go through this again in five years.

    Remember, the Internet *core* used to run over 56kb/s lines -- the same speed as those $20 modems that individuals are throwing away by the basketful today because they're unbearably slow for *personal* use. It's *hard* to plan well for that kind of growth. Better to waste a couple of bits than have to waste the whole thing and do it over.

  36. Security through obscurity is NOT the answer! by Anonymous Coward · · Score: 2, Informative

    No, security through obscurity is not and never should be any part of the answer. The reason is that you should not rely for security on keeping things secret that you can't easily change if they should become public.

    For example, you keep your cryptographic keys secret, and if they should be divulged, you change to new keys. But you should generally not rely on keeping your cryptographic algorithms secret, because if they get divulged, it would be a lot harder to issue new programs or machines using new algorithms. Coming up with new cryptographic algorithms is a highly non-trivial process, whereas anybody with access to a decent random-number generator can come up with new keys.

    This is known as Kerckhoffs' Principle, and is applicable much more generally than just in cryptography.

  37. Re:IPv6 is good, but so is NAT by rpresser · · Score: 3, Insightful

    NAT is actually solves a secondary problem: allowing individuals to have their own home network without having to register each of their computers with some sort of central authority. Almost all IPv6 advocates say that NAT won't be supported as part of the protocol, which is not such a bad thing if you see NAT simplay as a solution to solves address space issue, but it isn't if you see it as a solution allowing individuals to allocate their own addresses, without having to go through the bureaucratic process of registering each one. I feel that in missing this fact is actually a real issue and one that needs to be dealt with - if there already is a solution to this, then no one I have asked has yet provided me with one.

    **You have missed the point entirely**

    Forcing everyone back into the bureaucratic process is exactly what the designers want to do. Imagine how much less money would be made by cell phone companies if you could pick up any phone and it would automatically choose a phone number, then register your name with a decentralized directory so anyone who wanted to reach you could. Instead, you have to pay that $50 activation fee, plus a sizable portion of every month's cell phone bill, just for the privilege of being told when and where you can make telephone calls. That is the ideal that our IPv6 overlords are shooting for. I for one welcome them.

  38. No, they aren't. by j1m+5n0w · · Score: 2, Informative
    MAC addresses are carried in IP packets.

    No, they aren't. IP packets are incapsulated in ethernet packets for local hops. Ethernet packets contain the mac address in the header, but these aren't delivered end-to-end unless both ends of a connection are in the same subnet.

    In IPv6, it is envisioned that machines could use their mac address for the last 48 bits of their IP address so that they can claim a unique address within a subnet without a dhcp request, but this is only one possible convention. The truly paranoid could use a randomly generated number instead.

  39. IPv6 and NAT by MightyMartian · · Score: 2, Interesting

    Well, I don't see any reason why a NAT router couldn't be used that translated a public IPv6 address into a private IPv4 address space, but I will certainly defer to the experts on this.

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  40. Patents by Alan+Cox · · Score: 2, Informative

    Its all horribly horribly simple. No large investor or large vendor wishes IPv6 to happen in the mainstream until all the bogus submarine patents filed around it have expired. Until then its not in the interest of Microsoft, Cisco or anyone else to ship large amounts of IPv6 and get shot at.

    Nobody will say that in public because the US doesn't like industries apparently conspiring together against a patent holder but you will hear it in private.

  41. Peer routing by jd · · Score: 2, Informative
    Peer-to-peer routing is interesting with IPv6. The usual rules apply - the most specific prefix is always used first on routing decisions (and, because of the nature of IPv6 addressing, you should never get two addresses with the same prefix anyway) and if it stopped there, you'd be right. The router tables would be a mess.


    The topology helps, as the IPv6 backbone developers have realized you can't have a horrible design and expect it to work.


    The problem is not with customers of a peered network (as their prefix MUST match that of the peered network), but with peers of peers, where prefixes may differ. Because you have more levels of peering, the problem is theoretically reduced (as lower levels MUST share a common prefix and are - generally - not permitted to peer between branches in the hierarchy) but that is more human policy than technology.


    There is some confusion with regards IPv6 and backbone connections. IPv6 was originally designed NOT to support default routes. The ::0 route was not actually prohibited, it was however considered undesirable. Later on, this was relaxed and is now pretty standard. There have also been many changes in routing protocols - originally, transparency was the watch-word and Telebit came up with a nice protocol that hid layers. BGP4+ and Protocol Independent BGP became the standards, however, and that's what we live with today.


    So how does all this help? It helps because details are kept hidden as far as possible. IPv4 is bad on routing, because the layout is crap, too much is visible and has to be learned, multiple specific routes may need to be learned for a given prefix, corporations buy large blocks of addresses then share them with multiple sites using different providers, etc. IPv6 doesn't permit a lot of that and policies agreed upon don't allow the rest.


    In the end, routing requires that you know every possible route you need to follow to get to where you want to go, in the most general form you can store it. There's no escaping from that. The trick is to ensure that absolutely everything is (more or less) equally general and no specific exceptions are needed. It is the exceptions that are the killer, not the rules.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)