Slashdot Mirror
One Step Closer to IPv6
gbjbaanb writes "IPv6 came a step closer yesterday as ICANN added IPv6 host records to the root DNS servers, reports the BBC. 'Paul Twomey, president of Icann which oversees the addressing system, told the BBC News website there was a need to start moving to IPv6. "There's pressure for people to make the conversion to IPv6," he said. "We're pushing this as a major issue." The reason for the urgency, he said, was because the unallocated addresses from the total of 4,294,967,296 possible with IPv4 was rapidly running out. "We're down to 14% of the unallocated addresses out of the whole pool for version 4," he said. Projections suggest that this unallocated pool will run out by 2011 at the latest.'"
Its sad to look at the list of class a allocations and know that we're almost out. All this was done before NATs became popular. I think ICANN/IANA should work on wrestling some of those class As back from companies like Ford, Apple, HP, etc. None of those companies are going to ever have 16,000,000 hosts on public IPs. I know some of those companies have already made sub allocations. We could probably buy 5-10 years if they could reclaim just the 3, 9, 13, 17, 19, 20, 34 and 40 class As and get over 130,000,000 IPs back.
I mean, if those companies complain, who cares. They wouldn't get such large and prestigious allocations in an IPv6 network anyways. So what's the difference.
I know, I know, we should move to IPv6 anyways. Just a suggestion. Poor initial planning warrants changes down the road.
Just like how when we run out of oil, solutions will come along, when we run out of IP addresses, solutions will come along. The only problem is people don't get very motivated until we're really on the edge. I don't have much hope for IPv6 for another few years yet. Still, progress is progress.
-mrxak
Onions Will Kill You
Seriously, though, I have a feeling that IPv4 will be saved by an ingenious tech solution far in advance of the world running out of addresses.
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
Sadly, it can't Talk dirEctly to my Next-DOor neighbor, who runs an equally large neTwork.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Maybe we can finally get rid of the abomination that is NAT. Then all those Windows machines will become exposed to the Real Internet, and the false sense of security granted by their little home router will shatter the illusion of Windows stability once and for all.
Either that, or router manufacturers will start including SPI firewalls that aren't completely useless.
just switch to IPv5 until things get sorted out
So just because people waste IPv4 addresses by not using NAT and not recycling unused addresses, we want to force everyone to go to a solution that won't work correctly on existing devices that don't support v6, has a completely silly address, makes people get out from behind the elegant and awesome solution of NATs, and is basically poorly conceived, designed and executed?
/. LOVES change for the sake of change and anything shiny and new MUST be awesome, therefore I'll be modded down as an idiot and a troll for telling the goddamn truth.
Forcing v6 will be a disaster. It's better to force people to better implement v4 and take that time to design a system that will expand the address space while not causing so many issues.
This will be anonymous coward because I know almost everyone on
The only justification you ever hear for moving to IPv6 is address exhaustion in IPv4. There's a lot of other stuff built into the protocol that will make the net a much better place. Even if IPv4 had the same amount of addresses as IPv6 it would still be worthwhile to switch. Just give this a once over for an introduction
http://en.wikipedia.org/wiki/Ipv6#Features_and_differences_from_IPv4
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
They're not going to be very eager to give up their position as a gatekeeper of a limited resource just so their customers can frolick in a vast address space for free. Since most of them operate in a monopoly or duopoly situation, the proverbial "free market" won't force them to move off IPv4 either.
Have we reached Peak IP?
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
We've been hearing this 'addresses will run out by year x' for 20 years, and the predicted date has been wrong every single time. It's very hard to get enthusiastic about something that seems to be run by chicken little... Sure they'll run out eventually, and there's a network there to deal with it when it happens.. until then... zzzzzzz
If google, microsoft, redhat, CNN and the BBC (insert favourite site here) all go ipv6 (and by that I mean google starts indexing it too), that will be the year of ipv6. No way in hell it's going to happen before that.. I know of exactly zero useful ipv6 websites - I'm connected here but it's never been used.
Without any websites to actually *visit* on ipv6 ordinary users aren't going to go through the hassle, so ISPs see no demand and won't implement it (even though it would be a nice revenue stream for them - $10/month for 256 ipv6 addresses for example (and I really can't see them giving any more, seriously.. It's more likely to be 8 or 16 to separate the 'home' ($10/mo) users from the 'business' ($50/mo) users who get 256)).
Of course without any home routers that support it it's all moot anyway (hacked linkysys routers don't count).
This is all Al Gore's doing, I just know it. Go make the internet again, and this time do it right!
GCS/MU/P d- s:- a-- C++++$ UL++ P+ L++ E+ W++ N o K- w--- O M+ V- PS+++ PE Y+ PGP t+ 5- X R++ tv+ b++ DI++ D++ G+ e++ h-
IPv6 is not quite there yet, with some of the popular web sites still not accessible via IPv6.
If you are stuck behind a home router, with NAT then you will probably find yourself unable to access IPv6 sites. In the meantime there are two solutions:
- Teredo. If you have Vista this is standard. For everything else there is Miredo
- Aiccu. A litte more work and bureaucracy to get up an running, but a solution non-the less
Of course there is also Apple's Airport Extreme, which is one of the few home routers out there that support IPv6. I believe some of the third-party firmwares will do this too, but I don't think the IPv6 support is mature. As for Linksys, D-Link, et al. I think you are out of luck for the moment.
Also, if you running Apache, you will need a minium of Apache 2 and specify IPv6 support, using the configure script, prior to building it.
Jumpstart the tartan drive.
The sad part is, most of the IP addresses in question are... dark. Nothing there. Even though we're approaching 85% allocation, utilization is probably around 1-2%. No, I'm not kidding.
Try it yourself - hack up some script to randomly generate IPs and then ping sweep the network blocks. You'll probably be quite surprised at the result.
A while back, I wanted to have a way to detect if a host was "offline" so that it could modify its behavior. (EG: halt outgoing SOAP requests if the server's network connection was disrupted, preventing bogus error messages from entering the system)
My first thought was to randomly generate 10 IP addresses, then ping them to see if they were offline, guessing that at least 50% would respond. Basically, none did. So, then I tried randomizing addresses and keeping a list of only those that had, at one time, responded. Even that turned out to be unfruitful. So finally, I took a dictionary and randomly created domain names from 1-2 normal dictionary words, pinging those, and keeping a list. That yielded some 40% usable responses, allowing me to keep a list of fairly trustworthy ping hosts to determine the online status of the server in question.
Bottom line: The shortage in the global IP pool is an artifact brought on by grossly inefficient/incompetent management of the global IP pool. The idea that we're running out of addresses purely ignores the fact that the vast, vast majority of the addresses we now have are simply unused.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Wake me up when I can pull up the main page of Google using nothing but packets with IP6 headers.
That means that I can do a DNS query using nothing but IP6 packets - NOT IP4 packets.
That means that I can do an HTTP transfer from Google's servers using nothing but IP6 packets - NOT IP4 packets.
Hell, wake me up when there's a AAAA record for Slashdot.
This is a *baby* step towards IP6 being useful.
www.eFax.com are spammers
I've been waiting a while for Netgear, Linksys and that crowd to add 6to4 support to their home NAT routers as a way to help jump start IPv6 adoption. There would be no security issue if incoming connections were blocked by default and people could turn it off if they didn't want it. But 6to4 can be set up automatically by any machine with a publicly routable IPv4 address.
Well, I'm happy to say that my wait is finally over. They didn't make a big deal about it, so I don't know exactly when they did it, but Apple added that support to their Airport Extreme. So now when I go anywhere that has one of those, I can directly SSH into those inside machines that I've opened ports for without undue muss or fuss.
Apple has been a stalwart supporter of IPv6, from my observation. It's been possible to use AFP file sharing over IPv6 since at least Tiger and the built-in VNC stuff works over IPv6 too (though there is a naming lookup bug that requires you to connect using the IPv6 address literal if you use the command-K "Connect to" dialog).
So, Netgear and Linksys, what's holding you guys up?
I get a surprising number of IPv6 hits on my webserver at home. Most of these appear to be XP or Vista boxes with Internet connection sharing turned on that automatically assign themselves a 6to4 addresses when they have an interface with a public IPv4 address.
IPv6 with 6to4 is easy to set up, and I'd recommend it to anybody who has a static IPv4 address. You can use NAT-PT so all your IPv6 hosts can still get to the IPv4 network. If you have a couple of DNS servers, you can even set up reverse DNS for your IPv6 network just the way you want using this nice web interface from the NRO.
I maintain some good links to stuff about IPv6 on del.icio.us.
I hate NAT. And I think IPv6 can be just as secure. Partly because a 64-bit address space is really hard to effectively randomly probe working addresses and partly because it's fairly easy to configure a firewall to not allow incoming connections.
Need a Python, C++, Unix, Linux develop
So when IPv6 finally does become the norm, will there be any need for NATs on home routers, or will ISPs simply give you many addresses?
Lest anyone think this jackass is correct:
IPv6 barely supports firewalls or NATs, allowing any Joe Sixpack to see what your secured corporate network topology is like from anywhere.It is not up to the protocol to support the hardware. And anyway, all good firewalls support IPv6 already. NAT? It's there if you're dumb enough to want it.
It also does not support reserved IP blocks... change ISPs, and you are forced to re-ip your whole network.Step one: update your router to the new netblock.
Step two: sed -i'' 's/^old:net:block/new:addr:ess/' db.mydomain.com; rndc reload
Step three: laugh at people who go around changing ISPs all the time.
Of course, IPv6 has -zero- hooks for IP level encryption, so this has to be handled at the trensport or app level.If only it support IPSec, "the goal of [which] is to provide various security services for traffic at the IP layer, in both the IPv4 and IPv6 environments." Oh, wait...
Dewey, what part of this looks like authorities should be involved?
NAT is, well, better than nothing, which, currently, is your alternative. But I'd hardly call it an "elegant and awesome solution". IMO, ultimately, NAT sucks because you *do not have a globally routable address* for devices in your network. Sure, that gives some security benefits, but makes it a PITA when you do want to open connections directly to a computer or consumer electronic device in your network.
A few reasons you might want to have a public address inside your network:
* Direct VOIP telephony (SIP, Skype, various instant messenger clients, run a TeamSpeak Server), etc
* Running game servers, web server, mail server, etc
* Remote access (VNC, SSH, etc)
* Direct file transfer with a friend (I've, from time to time, run into problems with things like instant messenger client based file transfers not working behind a NAT - though they do seem to have somewhat alleviated that problem - I suspect by routing my file transfer through the IM network instead of directly to the other person), or P2P file sharing systems, like Bittorrent - yes, they can usually work behind NATs; but they work better if direct connections could be more easily made).
Yes, yes, I know about port forwarding. That's fine and dandy as long as you only have a single device per port that you want to allow incoming traffic to. Ultimately, IPv6 is a much better solution to the problem of address space limitations than is NAT. NAT usually requires software to do ugly hacks to get around the limitations of only allowing outbound connections. A simple firewall with every device having a global address is a better solution, because then I can open up as many ports to as many devices as I like, without having to worry about only allowing one device per port.
I've had a number of times where I've been extremely frustrated by NAT. Often times, if software isn't explicitly written with NAT in mind, and the problems it creates, then it won't work well in a NAT'ed network.
End-user netblocks are 2^64 addresses in size. If an attacker could ping a billion hosts per second, it would still take them 585 years to scan a single block.
So, again, NAT-as-security is even dumber on IPv6 than it is on IPv4.
As for the stated IPsec, it was a nice draft... but never made in the standard.From Wikipedia:
Wow. Guess you're wrong there, too.
Dewey, what part of this looks like authorities should be involved?
Do all of your machines need to be publicly accessible? Subnets for the win.
I see your informative link, and raise you a pithy comment.
I firewall ipv6 very nicely, thank you very much.
And you're last comment proves you're not a net admin.
There is nothing interesting going on at my blog
Is that going to be broken the British healthcare system, where I'll have to wait 2 years for an IP address? No thanks.
I called it a mighty Sperm Whale, she called it Finding Nemo.
http://www.ipv6.com/articles/military/Military-and-IPv6.htm
is just one example showing how the U.S. Military is required to be all ipv6 by 2012, in fact there's large chunks of the network that are supposed to be moving to IPv6 before then. So I'd say that's your "ball-rolling" starter. I have no idea how many networks and computers the U.S. Military represents, but considering they have an entire TLD, I assume they have a few. And I'd also be willing to bet that all the big router & OS vendors out there don't want to loose a big fat juicy customer like the U.S. Military, and therefore will do whatever it takes to get that network up and running.
You know in some senses, I think using the military as a guinea pig for things like this is a good thing for federal tax dollars to be spent on.
Sig 'em boy!
ocalhost (127.0.0.1) has a 32-bit subnet mask, so 127.0.0.1/32
/8 is valid is part of the loopback:
It may be setup this way on your computer's network settings but the RFC says the whole
http://www.faqs.org/rfcs/rfc3330.html
Pre-canned Evolution Links for all those Slashdot holy wars.