Slashdot Mirror


IPv4 Address Crunch In 2 Years, IPv6 Not Ready

An anonymous reader writes "We've known for ages that IPv4 was going to run out of addresses — now, it's happening. IPv6 was going to save us — it isn't. The upcoming crisis will hit, perhaps as soon as 2010, but nobody can agree on what to do. The three options are all pretty scary. This article covers the background, and links to a presentation by Randy Bush (PDF) that shows the reality of the problem in stark detail."

539 comments

  1. FUD by Anonymous Coward · · Score: 0, Troll

    n/t

    1. Re:FUD by RobGeek · · Score: 1, Interesting

      Totally Agree! WOLF WOLF WOLF WOLF and now we are supposed to believe that there is really a "shortage" that we are to worry about? Oh heavens! The whole Internet will collapse!

    2. Re:FUD by Brian+Gordon · · Score: 3, Interesting

      NAT will solve the problems, but why live with that when we can actually come up with a viable solution- IPv6? It will be expensive to implement because, like always, past engineers haven't planned for their 1970s technologies to ever go out of date, and whiny slashdotters will finally have to upgrade their windows boxes to Vista because XP has 1990s networking support (read that pdf if you don't believe me). But we'll end up with a significantly better Internet than if we just keep expanding NATs around more and more IP addresses to free up address space.. the way we're going, eventually (and keep in mind that "eventually" in computing usually turns out to be in less than a decade) you're going to have to be a multibillion-dollar conglomorate representing thousands of web hosting companies just to bid for a single 5-address block of address space... though the way inflation's going, little billy and his friends might be able to pool their allowance and come up with that kind of money :) But can you imagine how horrifying the architecture of the internet will be if the solution is NAT, NAT, NAT? Development in router design is already unable to keep up with traffic growth. How are you going to pay for a $100 million server farm just to manage the American Eastern Seaboard NAT, and can you imagine what the latency would be to go through a 10 terabyte NAT table? Might as well upgrade to IPv6, save yourself the trouble of trying to stay v4.

    3. Re:FUD by Divebus · · Score: 1, Insightful

      First, pull the plug on all those AdSense garbage and "Domain Parking" sites. That'll free up a bunch.

      --

      Most of the stuff on /. won't survive first contact with facts.
    4. Re:FUD by Anonymous Coward · · Score: 2, Informative

      You do realize that a single server with a single IP can host thousands of those websites?

    5. Re:FUD by spikedLemur · · Score: 1

      First, pull the plug on all those AdSense garbage and "Domain Parking" sites. That'll free up a bunch.

      Not so much. The vast majority of those sites are on shared web hosting that use one IP for a potentially unlimited number of hosts. And since most of those servers also host legitimate sites, getting rid of them wouldn't change address utilization at all.

    6. Re:FUD by spikedLemur · · Score: 1

      Actually, IPV6 in it's current form could make things a lot worse. At least NAT forces organizations to manage their internal address space and keeps some of the routing burden off our backbone. It also provides some extra security by keeping all those soft targets (client workstations) off the big bad Internet, even when people make a mess of their firewall.

      Now think about that fact that IPV6 bumps up the address space 2^96 times. Imagine the burden that will place on routing tables. Imagine how many more nodes will pop up when you consider that people don't feel the need to hassle with NAT. Think about the routing overhead and the security nightmares that could result.

      Without very careful consideration IPV6 could knock the Internet back a decade. It makes sense when you consider that it was designed to meet the problems of a decade ago. Now, I'm not saying it's bad, but it certainly has the potential to go that way. So caution is certainly warranted.

    7. Re:FUD by Divebus · · Score: 1

      You do realize that a single server with a single IP can host thousands of those websites? Yes, but do they actually? There are millions of those sites and I'm also interested in getting rid of those... and free up some domain names while we're at it.
      --

      Most of the stuff on /. won't survive first contact with facts.
    8. Re:FUD by MightyYar · · Score: 3, Informative

      Yes, but do they actually? Oh, yeah.

      Here's a completely random example: slashdt.org (obviously getting typo hits from slashdot...

      According to This web site, that domain shares an IP with over 14,000 other domains!
      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    9. Re:FUD by Divebus · · Score: 1

      Yes, but do they actually? Oh, yeah. Damn.
      --

      Most of the stuff on /. won't survive first contact with facts.
    10. Re:FUD by casualsax3 · · Score: 1, Informative

      Not if you want to use SSL.

    11. Re:FUD by Anonymous Coward · · Score: 0

      According to that same service, my IP address hosts 5 domains, which is 4 short of the actual number of domains I'm hosting, so it's even possible that the number provided is a serious understatement.

    12. Re:FUD by smilindog2000 · · Score: 1

      You mean https? You can host as many as you like, with real certificates. I host starterpbx.org with a cert on billrocks.org. No problem.

      I have to agree the article is a bit of fud. Except for geeks like us and corporations, who needs a real IP? A billion sounds like plenty.

      --
      Beer is proof that God loves us, and wants us to be happy.
    13. Re:FUD by general_boy · · Score: 1

      However many of those sites can share a wildcard SSL cert, can run from a single IP address.

      The kind of thing I've seen for some merchant sites is the (HTTP) storefront runs as www.merchantdomain.com and the SSL parts as merchantdomain.sharedprovider.com, using the *.sharedprovider.com SSL cert. Security-wise I don't like it at all, but there it is.

    14. Re:FUD by MightyYar · · Score: 1

      Yeah, that service tends to underestimate in my experience... but it's free! The pay ones seem to be more accurate - but I didn't want to pay :)

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    15. Re:FUD by daniel23 · · Score: 1


      said service only sees a limited range of TLDs excluding ccTLDs

      --
      605413? Yes, it's a prime.
    16. Re:FUD by toadlife · · Score: 2, Insightful

      "At least NAT forces organizations to manage their internal address space and keeps some of the routing burden off our backbone. It also provides some extra security by keeping all those soft targets (client workstations) off the big bad Internet, even when people make a mess of their firewall."

      NAT is a causes more headaches than it solves. For corporate clients that you don't want on the internet, firewalls which are no less complicated to configure than any NAT setup, can be used. It would takes less configuration and less processing power to do plain SPI with public addresses than do NAT + SPI.

      Now think about that fact that IPV6 bumps up the address space 2^96 times. Imagine the burden that will place on routing tables.

      Current routing hardware can handle it just fine.

      Without very careful consideration IPV6 could knock the Internet back a decade

      You speak as if that would be a bad thing. A decade ago, the internet was made up of peers. Today it's come to the point where a select few actually participate and the rest are only allowed to consume. Everyone being able to participate in the internet again would indeed set the internet back a decade.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    17. Re:FUD by tyler_larson · · Score: 4, Insightful

      That'll free up a bunch.

      First of all, break up the "LEGACY" Class-A allocations. http://www.iana.org/assignments/ipv4-address-space. That'll free up a bunch.

      All of the following companies have a full 16.7 Million addresses assigned to them. Level 3 might use theirs, (they actually have 2 blocks), but Halliburton? DEC? Amateur Radio Digital Communications? Do they all really need more than 16 million IP addresses?

      This short list accounts for 654 million IP addresses -- over 15% of the address space.

      003/8 General Electric Company
      004/8 Level 3 Communications, Inc.
      006/8 Army Information Systems Center
      008/8 Level 3 Communications, Inc.
      009/8 IBM
      011/8 DoD Intel Information Systems
      012/8 AT&T Bell Laboratories
      013/8 Xerox Corporation
      015/8 Hewlett-Packard Company
      016/8 Digital Equipment Corporation
      017/8 Apple Computer Inc.
      018/8 MIT
      019/8 Ford Motor Company
      020/8 Computer Sciences Corporation
      021/8 DDN-RVN
      022/8 Defense Information Systems Agency
      025/8 UK Ministry of Defence
      026/8 Defense Information Systems Agency
      028/8 DSI-North
      029/8 Defense Information Systems Agency
      030/8 Defense Information Systems Agency
      032/8 AT&T Global Network Services
      033/8 DLA Systems Automation Center
      034/8 Halliburton Company
      035/8 MERIT Computer Network
      038/8 Performance Systems International
      040/8 Eli Lily & Company
      043/8 Japan Inet
      044/8 Amateur Radio Digital Communications
      045/8 Interop Show Network
      047/8 Bell-Northern Research
      048/8 Prudential Securities Inc.
      051/8 Deparment of Social Security of UK
      052/8 E.I. duPont de Nemours and Co., Inc.
      053/8 Cap Debis CCS
      054/8 Merck and Co., Inc.
      055/8 DoD Network Information Center
      056/8 US Postal Service
      057/8 SITA
      --
      "With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
      RFC 1925
    18. Re:FUD by spikedLemur · · Score: 1

      For corporate clients that you don't want on the internet, firewalls which are no less complicated to configure than any NAT setup, can be used.

      This statement leads me to believe you've never looked at a corporate firewall policy, much less an actual ruleset. I've seen a few dozen, from medium to large enterprises. And I can't count the number of times I've seen rules that would leave them wide-open were it not for their NAT to a private address space. In all cases this was accidental, as it left some number of internal hosts exposed. However, it had slipped through because of old rules or some typo.


      Current routing hardware can handle it just fine.

      I'm not so certain of this. However, I'd like to see the information you are basing your assessment on.


      A decade ago, the internet was made up of peers.

      Yes, and the traffic (and security threats) were trivial compared to now. That's why I'm saying that an IPV6 migration requires very careful consideration.

    19. Re:FUD by toadlife · · Score: 1

      This statement leads me to believe you've never looked at a corporate firewall policy, much less an actual ruleset. I've seen a few dozen, from medium to large enterprises. And I can't count the number of times I've seen rules that would leave them wide-open were it not for their NAT to a private address space. In all cases this was accidental, as it left some number of internal hosts exposed. However, it had slipped through because of old rules or some typo. Though it's not my job, I do have access to our PIX for emergency reasons. Our ruleset is a complete mess, and on many occasions I've requested that old rules (mostly private*-*public translations) be discarded.

      But I don't see this as an excuse to keep NAT around. Because we use 100% private addressing inside our network, our PIX configuration is twice as big as it normally would be, since public*-*private translations along with actual port rules have to be configured for every internet facing server.

      As for routing performance, I tried to find a link to a IPv6 vs IPv4 routing comparison I read a year or so ago, but I was unable to find it. The result was that Ipv6 routing was only very slightly slower on the same hardware. Ipv6 contains some improvements like fixed header size and the elimination of checksums and fragmentation that supposedly serve to increase routing performance. As for routing table size, I think Ipv6's hierarchical addressing scheme prevents routers' routing tables from having to grow to outrageous sizes.

      Here is one Cisco article I found. not sure how useful it really is, as it seems to double as a brochure for various Cisco routers.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    20. Re:FUD by BeanThere · · Score: 1

      XP has 1990s networking support (read that pdf if you don't believe me)

      Christ, you made me read the whole PDF: Wouldn't it have been easier to just state the reason mentioned is "Windows XP doesn't have IPv6 DNS lookup support"? Oh, right, because then you couldn't have vastly exaggerated the problem with hyperbolic vague and sweeping statements like "XP has 1990s networking support" (that people would be unlikely to refute because that PDF is so long) ... if DNS is the only thing that doesn't work, that's a friggin TINY issue, and could be resolved with a small patch.

    21. Re:FUD by Anonymous Coward · · Score: 0

      That's ok, some day webbrowsers will bother to upgrade from SSL to modern TLS and catch up to where email and ftp was years ago. Then they can use the starttls handshake to switch to an encrypted session after establishing what virtual host they wanted to talk to.

    22. Re:FUD by pcmanjon · · Score: 1

      "And I can't count the number of times I've seen rules that would leave them wide-open were it not for their NAT to a private address space. In all cases this was accidental, as it left some number of internal hosts exposed. However, it had slipped through because of old rules or some typo."

      So poor sysadmins would not be able to hold a job and it would allow more room for those of us who know what we're doing to work in the job market? It looks like it's only a win-win to me. Companies wouldn't risk hiring some guy for 12k a year to manage their firewall. They'd want someone who is at least qualified.

    23. Re:FUD by colinrichardday · · Score: 1

      NAT will solve the problems, but why live with that when we can actually come up with a viable solution- IPv6? It will be expensive to implement because, like always, past engineers haven't planned for their 1970s technologies to ever go out of date, and whiny slashdotters will finally have to upgrade their windows boxes to Vista because XP has 1990s networking support (read that pdf if you don't believe me).

      And I thought that whiny Slashdotters used Linux or BSD.

    24. Re:FUD by Koutarou · · Score: 0

      Actually, IPV6 in it's current form could make things a lot worse. At least NAT forces organizations to manage their internal address space and keeps some of the routing burden off our backbone. It also provides some extra security by keeping all those soft targets (client workstations) off the big bad Internet, even when people make a mess of their firewall.

      Now think about that fact that IPV6 bumps up the address space 2^96 times. Imagine the burden that will place on routing tables. Imagine how many more nodes will pop up when you consider that people don't feel the need to hassle with NAT. Think about the routing overhead and the security nightmares that could result. ipv6 should actually be able to reduce routing table size by reducing the number of prefixes that need to be advertised. For instance, my employer advertises 2 /17s, a /16 and a bunch of legacy /24s and we will probably be at least doubling that before the v4 address space runs out. Our single ipv6 /32 allocation, even if it doesn't last until the heat-death of the universe, should at least suffice until the great disaster of 2038.
    25. Re:FUD by multi+io · · Score: 1
      Christ, you made me read the whole PDF

      You could have used your reader's search function :-P

    26. Re:FUD by sjames · · Score: 1

      You talk as if each individual address has to be in the table. An organization that is doing NAT now with a single IP will instead get a single /64 assigned out of a /48 or a /32 assigned to the provider.

      What could knock the net back by a decade is sticking everyone behind a NAT. NAT takes a lot more router resources than simple routing does.

    27. Re:FUD by Malevolyn · · Score: 1

      And AdSense is Google. Google pays (probably a pretty penny) for their IP blocks.

      --
      Your ad here.
    28. Re:FUD by BeanThere · · Score: 1

      Not really, not every potential possibility can be found via a few keywords.

    29. Re:FUD by Anonymous Coward · · Score: 0

      IPV6 in it's current form

      "its".

  2. Well duh by n3tcat · · Score: 5, Insightful

    It's not hard to figure out why we haven't solved this problem. It costs MORE to fix it now than it does to wait.

    So just wait until it costs more to live with IPv4 than to migrate to new systems. Then EVERYONE will be working on a solution.

    1. Re:Well duh by John3 · · Score: 4, Insightful

      It's not hard to figure out why we haven't solved this problem. It costs MORE to fix it now than it does to wait.

      So just wait until it costs more to live with IPv4 than to migrate to new systems. Then EVERYONE will be working on a solution. This is true of technology in general. Government and industry debate global warming and peak oil but do very little to actually address the issue since it costs so much to implement solutions. The IPv4 issue is daunting to be sure, so it's no surprise that IPv6 progressed so slowly. I did a quick search back to 2000 on Google News and industry and tech journals were shouting warnings even back then. So eight years later there is no solution.

      The problem will be fixed when the p0rn sites can't get new IP addresses. The adult entertainment industry has driven many of the Internet and web innovations in the past (streaming video, credit card processing) and they'll likely lead us into a bright new future of unlimited Internet addresses. :)
      --
      "We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
    2. Re:Well duh by PrescriptionWarning · · Score: 4, Interesting

      That sounds like an "if it ain't broke, don't fix it" argument to me. Which in fine and good for simpler technologies, but can be disastrous for more modern technologies. Just think what would happen if you didn't change your car's oil until the car simply refused to run. What would happen if we all decided not to curb our oil consumption habits until we either ran completely out of oil reserves. You see its the shortsightedness that in the long run costs you WAY MORE than if you simply keep the options in mind and work towards a solution.

      So in two years when they can't add any more addresses, the only ones to blame will be those who stuck they feet in the mud and wouldn't budge. Besides, they can always just start taking away all those spam sites that offer no real content and just distribute those to other who actually need them, I'm sure there's at least another 2 years worth of those.

    3. Re:Well duh by whyloginwhysubscribe · · Score: 1

      It's a false economy though, isn't it?
      It is going to cost more in the future to fix it than it does now.
      If only the executives would listen to us geeks...

    4. Re:Well duh by CRCulver · · Score: 4, Funny

      It's not hard to figure out why we haven't solved this problem. It costs MORE to fix it now than it does to wait. So just wait until it costs more to live with IPv4 than to migrate to new systems. Then EVERYONE will be working on a solution.

      On the other hand, some people will wait until the last minute and then spend time and energy towards solutions that might have spent towards other things had a more gradual migration takes place.

      In fact, the looming IPv4 address crunch reminds me a little bit of the Y2K issue. Maybe some journalists will start presenting it to the public as a countdown to doomsday? We could have manuals like Hyatt's old The Y2K Personal Survival Guide telling us how to stock up on food and generator fuel for when civilization ends due to the sudden lack of new IP addresses. There would be religious figures and conspiracy theorists claiming that the Antichrist/UN/black helicopters/NWO will take advance of the chaos surrounding the IPv4 address crunch to institute their reign of fear. It'll be like 1999 all over again.

    5. Re:Well duh by debrain · · Score: 1

      So just wait until it costs more to live with IPv4 than to migrate to new systems. Then EVERYONE will be working on a solution. True. Now, let us remark upon and observe how some will expand the problem from IPv4 to a problem of piracy, privacy, and net neutrality.
    6. Re:Well duh by KiloByte · · Score: 4, Funny

      Besides, they can always just start taking away all those spam sites that offer no real content and just distribute those to other Actually, the spammers/phishers are already doing their utmost to stop eating new IPv4 addresses, and conserve them by using existing IPs of random Windows boxes. See, who's the bad guys now?
      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    7. Re:Well duh by eln · · Score: 5, Insightful

      The problem is that Y2K was handled so well, and as a result the consequences of it were so ridiculously minor, that most people in the general public feel that it was all overblown hype. Yes, there was a lot of hype, but the fact is a lot of programmers worked a long time to make sure things that needed to be fixed got fixed.

      However, since most people feel that Y2K was overblown and the money spent on it was wasted, they're unlikely to take seriously any new "crisis" in IT, and will simply refuse to spend any money on it.

    8. Re:Well duh by Himring · · Score: 1

      Let's apply that logic to another, known future crisis that was understood years in advance, and that everyone waited to happen to actually do something about it:

      So just wait until it costs more to live with the levies breaking in New Orleans and rebuilding the city than to actually build a new levy system. Then EVERYONE will be working on a solution.

      --
      "All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
    9. Re:Well duh by argiedot · · Score: 5, Funny

      Absolutely, reminds me of an old joke:

      • Visitor: If there's quicksand in this part near the town why don't you put up a sign?!
      • Man: We did, but nobody was falling in so we thought it was useless.
      Ha ha.
    10. Re:Well duh by somersault · · Score: 4, Funny

      It's time for a new breed of man. One who isn't afraid to get his hands dirty, but can also wash them when it's time to meet the management. Someone who can make time to shower and shave every morning. Someone who's novelty geek mug will be understood by even those who think that having spyware makes them a secret agent. Ladies and - oh wait, scratch that. *ahem* Gentlemen! Today I introduce a new template class - the Geexecutive! Get implementing!

      --
      which is totally what she said
    11. Re:Well duh by orzetto · · Score: 4, Insightful

      This is true of technology in general. Government and industry debate global warming and peak oil but do very little to actually address the issue since it costs so much to implement solutions.

      Society is not an amorphous blob with a clear will and an appreciation of its own good. Society is made up by people, and what the decision makers think is "good" is not necessarily good for society; both because the decision makers might be wrong, and because their own interests may be different from those of society (you don't get to be president because you're Joe Average from Missouri).

      In the case of Ipv4, as in the one of energy, the interest of society is to fix the problem. The interest of the decision makers, however, is not to fix it, because they are now sitting on a critical asset that is always in demand and that is getting increasingly scarce, and therefore more expensive. The near-disaster scenario is in their interest, because that way they will maximise their returns. It's like the owner of an oasis in the Sahara: rain and rivers would be bad for business, drought is more people depending on you.

      I would expect China or India to come up with a solution first: they don't have many IP addresses to begin with, they have growing economies that will sooner or later require more IP addresses, and they have the means to kickstart a major project.

      --
      Victims of 9/11: <3000. Traffic in the US: >30,000/y
    12. Re:Well duh by shakotah · · Score: 1

      Or we can delay it a few more years if we all start implementing Server Name Indication (SNI), as described in section 3.1 of the http://www.ietf.org/rfc/rfc3546.txt. This would let hosting companies share 1 IP with several domain names and still be able to use https because the certs would have multiple domain names. It should be much cheaper (only certs are extra cost) and requires almost no hardware changes (some ssl accelerators might need upgrades).

    13. Re:Well duh by eln · · Score: 1

      Until I got to the line about the novelty geek mug, I thought you were trying to sell us a new brand of underarm deodorant.

    14. Re:Well duh by upside · · Score: 2, Informative

      Never mind pr0n, how about industry leaders with deep pockets like Google, Yahoo, Sun and Microsoft? Not one has an AAAA record for their web servers. It's pretty pathetic.

      --
      I'm sorry if I haven't offended anyone
    15. Re:Well duh by Yvanhoe · · Score: 1

      No solution ? I think that most equipment sold today are IPv6 ready, what is missing in the chain ?

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    16. Re:Well duh by Sancho · · Score: 1

      Perhaps it's a problem with corporate culture? Stockholders won't like an expenditure to prepare for IPV6. It's money going out without any perceived benefit. They'd rake over the coals any manager who approved such a thing.

      Once there's a benefit, however, things will be different. Even if it means spending three times as much in the scramble as you would have if you'd prepared earlier on, people will understand that it's vital to expand the IT interests.

      You see this all the time in corporate America. The goal is to get gains no matter the cost. Long-term plans don't fly because, simply, they're not fast enough. They don't get that stock to go up RIGHT NOW. If your stock's not going up, people are going to be selling.

      I don't think it's a fundamental problem with the stock market, however. I think it's what happens when you get greedy people buying stocks.

    17. Re:Well duh by somersault · · Score: 1

      *googles "define:underarm deoderant"*

      --
      which is totally what she said
    18. Re:Well duh by A+beautiful+mind · · Score: 3, Interesting

      While I appreciate the point you're trying to make, but there are quantitative differences between the thinking of a country like Japan and for example the USA. In Japan, they did have the foresight to make their systems IPv6 ready, so maybe just our expectations are too low? I'd rather tell people what to do than to make excuses in the technology/politics field referring to Joe Sixpack who allegedly wouldn't understand or care.

      --
      It takes a man to suffer ignorance and smile
      Be yourself no matter what they say
    19. Re:Well duh by newrisejohn · · Score: 1

      I would expect China or India to come up with a solution first: they don't have many IP addresses to begin with, they have growing economies that will sooner or later require more IP addresses, and they have the means to kickstart a major project.

      All the more reason for the US to get something set up first. I don't think the Chinese controlling/influencing the next big step in the Internet architecture will sit well with the US government.

    20. Re:Well duh by m50d · · Score: 1
      So in two years when they can't add any more addresses, the only ones to blame will be those who stuck they feet in the mud and wouldn't budge. Besides, they can always just start taking away all those spam sites that offer no real content and just distribute those to other who actually need them,

      I don't think they're a big source of IPs, since they're mostly 10000 sites hosted on the same server with the one IP.

      --
      I am trolling
    21. Re:Well duh by 4D6963 · · Score: 1

      The problem will be fixed when the p0rn sites can't get new IP addresses.

      I get your point but you know that's bullshit. The web won't be so much affected as ISPs and their users. You can put a thousand of different websites on one IP, but Internet users like you and me need their own IP address.

      By the way, if we did nothing to fix the problem, what would really happen, I mean besides everyone getting behind their ISP's NAT and thus buying us at least another decade? This being said, I would hate to live in a world in which I can't run a home server without paying a premium (here in France ISPs don't NAT people).

      --
      You just got troll'd!
    22. Re:Well duh by cmat · · Score: 1

      This is true of technology in general. Government and industry debate global warming and peak oil but do very little to actually address the issue since it costs so much to implement solutions. --SNIP--

      I have decided top refuse to believe this particular line of reasoning until I actually see/read something written by an economist providing a concrete argument (with data!) that the line "global warming costs too much too address" has any root in truth. I would urge that until one can provide such backing references, that we not perpetuate this argument since we as techies certainly are not qualified to endorse it.
      --
      -- Humans, because the hardware IS the software.
    23. Re:Well duh by Anonymous Coward · · Score: 3, Informative

      you don't get to be president because you're Joe Average from Missouri

      Harry Truman.

    24. Re:Well duh by plague3106 · · Score: 1

      The cost to fix it is the same now as it will be in the future. You're not going to be doing more work now than you would, its just people not seeing the risk is faster approaching, and some don't see a risk at all.

    25. Re:Well duh by Anonymous Coward · · Score: 3, Funny

      Why don't we send intel a bill of $1 per each of their 72,000,000 IP4s, and DEC, and IBM, ... each year, and let them lead the way to IPV6.

    26. Re:Well duh by Yvanhoe · · Score: 2, Informative

      Ok, should have RTFA. The fact that most equipment is IPv6 compatible would be a myth.

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    27. Re:Well duh by Bazman · · Score: 4, Funny

      Yeah it's the pr0n sites' fault. Now, google search for the article by Randy Bush.....

    28. Re:Well duh by shawn(at)fsu · · Score: 1

      While you guys are arguing about how to fix it I'm working on keeping my DCHP address active. They can have my IPv4 address when try pry from my cold dead router! They way I see it IPv4 running out of address is only a problem for the people who don't have one. Suckas!

      (yes it was a joke)

      --
      500 dollar reward for tip(s) leading to the arrest of the person(s) who stole my sig.
    29. Re:Well duh by CastrTroy · · Score: 1

      All the 10 year old backbone routers which would cost millions (or more) to replace.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    30. Re:Well duh by SnarfQuest · · Score: 4, Insightful

      What would happen if we all decided not to curb our oil consumption habits until we either ran completely out of oil reserves.

      I remember when I was younger, we were down to 10 years of oil underground. This was some twenty years ago. We did a few minor changes, slight improvement in gas mileage, but not much. We also greatly increased the number of cars on the road. Too bad for you youngsters, you now have only 10 years of oil left underground.

      --
      Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
    31. Re:Well duh by John3 · · Score: 1

      This is true of technology in general. Government and industry debate global warming and peak oil but do very little to actually address the issue since it costs so much to implement solutions. --SNIP--

      I have decided top refuse to believe this particular line of reasoning until I actually see/read something written by an economist providing a concrete argument (with data!) that the line "global warming costs too much too address" has any root in truth. I would urge that until one can provide such backing references, that we not perpetuate this argument since we as techies certainly are not qualified to endorse it. Oh, I agree 100%. I don't endorse the belief that the solution costs more than the problem, but it's clear that the current US administration, coal burning electricity producers, auto manufacturers, Dick Cheney, etc. disagree with me.

      --
      "We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
    32. Re:Well duh by Tony+Hoyle · · Score: 3, Informative

      Certainly on the home side... go into the average store, and it's easy to count how many home routers are ipv6 enabled. none at all.

      Some can be adapted - my wifi router can route ipv6 but not talk it for example. No way all that hardware is going to be replaced within two years.

      OTOH we've been hearing the doomsday scenarios from the ipv6 zealots for 10 years now, and I'm not seeing it - it's still easy to get a block of IP addresses (I asked for 8 and got given 16 'just in case' for example).. we're not seeing the beginnings of a shortage yet.

    33. Re:Well duh by Anonymous Coward · · Score: 1, Insightful

      So just wait until it costs more to live with the levies breaking in New Orleans and rebuilding the city than to actually build a new levy system. Then EVERYONE will be working on a solution.

      The obvious difference being that nobody drowns if I am unable to reserve an IP block for a few servers. Or do they?!?

      (No. No, they do not.)

    34. Re:Well duh by TMB · · Score: 1

      Oh man, to have mod points right now... I just snorted out coffee.

    35. Re:Well duh by Tony+Hoyle · · Score: 1

      I'm surprised this isn't in the standard already.. I'm sure I've overloaded IP addresses for https before.. hmm..

      For standard HTTP there should be one IP address per company of course, and for a lot there is.. it's been standard practice for a while. The days of profligate use of IP addresses have passed naturally - a normal company network will be behind a firewall and NAT (leaking IP addresses is still information leak - which is why there's provision for NAT in IPV6) so the number used has been dropping anyway.

    36. Re:Well duh by samkass · · Score: 3, Insightful

      I remember when I was younger, we were down to 10 years of oil underground.

      It all comes down to yours sources. 20 years ago, they were still finding more oil each year than was being consumed, so the "10 years left" folks weren't the responsible people. The opposite is true now. 20 years ago it wasn't economically feasible to pump the sludge out of Canada's shale, but now it is. It wasn't economically feasible to put a platform in the middle of the Gulf of Mexico and drill a mile down, but now it is. But all those sources are limited, as well. We have a much more accurate picture of how big the problem is now than we did 20 years ago.

      --
      E pluribus unum
    37. Re:Well duh by Gorbag · · Score: 2, Interesting

      You see its the shortsightedness that in the long run costs you WAY MORE than if you simply keep the options in mind and work towards a solution.


      Actually it's an insurance problem. There are an infinite number of possible future disasters, and we'd all be broke in the stone age if we tried to address all of them. Like lazy evaluation, sometimes putting off actually solving the problem makes a lot of sense because the problem may never even materialize, or by the time it does, there are better and cheaper ways to fix it.

      Climate instability (nee 'global warming') may be a case in point. It's not clear that CO2 is the cause, and even if it is part of the problem, sequestering it is getting cheaper (certainly a lot cheaper than having everyone stop driving or using electricity). There are other "problems" that seem to be more excuses to spend massive amounts of money relative to the actual risk (anything from worry about near earth collisions, to the "health care crisis")

      Adam Smith's invisible hand will take care of many things. While I certainly am not arguing against research, I don't think rushing to implement half baked solutions is ever a good idea (though it seems to be the only way things get done in Congress).

      This too, shall pass.
      --
      -- I speak only for myself
    38. Re:Well duh by shakotah · · Score: 1

      This has been out there for a while, but just recently did apache and openssl get patches to implement this. Most browsers say they support it (my initial tests confirm this). most https sharing is done by .providerdomain.com using a cert for *.providerdomain.com, the problem is for the 100 companies that want the URL only to show their own company name.

    39. Re:Well duh by Bert64 · · Score: 2, Informative

      Altavista used to... Back when it was run by DEC.

      See:
      http://www.ipv6.org/v6-www.html

      Microsoft research have a v6 site too...

      My site (www.ev4.org) is also available on v6, just incase anyone cares.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    40. Re:Well duh by zippthorne · · Score: 1

      Besides, they needed that money for rocks that ward off tigers.

      --
      Can you be Even More Awesome?!
    41. Re:Well duh by emarock · · Score: 1

      The adult entertainment industry has driven many of the Internet and web innovations in the past
      Oh, man, that's so true! Maybe this time the right song could solve the problem...
    42. Re:Well duh by anticypher · · Score: 4, Insightful

      There are no 10 year old backbone routers still in service on any backbone. Anywhere.

      Growth of the IPv4 routing table has left all them obsolete. Big routers from 10 years ago have all been migrated towards the edge, where they no longer fulfill a backbone role. Or they've been scrapped for being too costly, slow, power hungry and un-upgradable to modern interfaces.

      For all that old kit that tosses IPv6 traffic to the CPU to be routed, it will still be usable for the next few years until IPv6 traffic starts to become more prevalent. By then, the current IPv6 backbone kit will have been migrated out from the core towards the edges. There is no problem with old kit, at least at the routing and switching level.

      All the major backbone router manufacturers have included IPv6 natively for at least the last 3 to 6 years. Any internet company that has done a major upgrade to deal with ever increasing traffic levels and customer demands now have IPv6 capable hardware in service in the backbone. Some manufacturers may still charge more to turn the capability on. The ones that don't are seeing increasing sales because all their major clients don't like have a tiered system of features, where the only set with all the needed features is the most expensive one.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    43. Re:Well duh by Bert64 · · Score: 1

      IPv6 is not new, it's been around for years... Some 10 year old kit does support it fine.
      Backbone routers from 10 years ago however, there aren't too many left, at least on major backbones... What was considered fast 10 years ago is pretty slow these days, major backbones have long since upgraded.

      As for what supports V6, most enterprise level kit does, most consumer oriented routers etc, don't.. Every major OS now supports V6 too.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    44. Re:Well duh by Bert64 · · Score: 3, Insightful

      Really they need to take back the large ipblocks that were allocated to companies years ago, but which aren't even being used . Ford has a /8 ipblock (16777216 addresses) that they use internally and dont route to the internet, why cant they use 10.0.0.0/8 internally like everyone else?

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    45. Re:Well duh by Boronx · · Score: 1

      What's your point? Some crackpot 20 years ago spouted bullshit about oil reserves, so sensible people shouldn't be concerned?

    46. Re:Well duh by PrescriptionWarning · · Score: 1

      "I don't think rushing to implement half baked solutions is ever a good idea"

      certainly true, in my eyes Hybrid vehicles are the half baked solution towards going either hydrogen and/or all electric cars because they still rely on gasoline and their CO2 cost of producing the batteries is high as well. The thing is that those half baked solutions are often created to bridge the gap to the real solution. Sometimes though, the intermediate bridge just isn't good enough.

    47. Re:Well duh by smellsofbikes · · Score: 1

      This isn't really about "if it ain't broke, don't fix it" as much as it's about a large number of companies, which are each individually saying "if we invest money to fix this, it will impact our short-term profitability compared to other companies which aren't fixing it, so we're not going to do it."
      Everybody's making the decision they think they have to make to stay competitive, and, as a group, they all move in lock-step towards a major problem. I don't disagree with your summary: it will cost way more than if they addressed things earlier. But nobody can afford to do that unless everyone does it at the same time, and nobody's going to unilaterally take a chance on that.
      The classical solution to this is government regulation.

      --
      Nostalgia's not what it used to be.
    48. Re:Well duh by gad_zuki! · · Score: 2

      Its also worth noting that its very easy to cherry-pick sources from the past to make a certain point of view look silly. The GP is playing the 'all predictions about this are wrong' card but if you were to make a sincere effort to look into what people and studies showed about the economics of scarcity, you'd see it wasnt so cut and dried. This is usually a dishonest rhetorical trick.

    49. Re:Well duh by pherthyl · · Score: 2, Informative

      Well there's definitely something going on. Look at the OPEC oil production over the last few years: http://en.wikipedia.org/wiki/Image:GlobalCrudeOilProduction2001-mid2007.png

      Since 2005 it's been flat. And yet prices have skyrocketed in that time. In 2000, OPEC promised to adjust production to keep prices around $22-$28/barrel. Then in 2007 they said prices would stay around $50-$60/barrel until 2030. Well it's one year later and prices are at $100. All this time OPEC hasn't increased production, and they may even reduce production at their next meeting in the spring (no solid source for that one, just what I heard on the news). So they have every reason to increase production, and have had every reason to do so for years, but they've done nothing.

      That to me is very suspicious. Either there is a massive conspiracy to hike up the cost of oil (incredibly unlikely) or they just can't keep up with the production, despite their claims. The latter is pretty much the only likely solution.

    50. Re:Well duh by Tony+Hoyle · · Score: 2, Informative

      Just RTFA'd myself.. That PDF sums up 100% what is wrong with ipv6 right now.

      Didn't know that XP couldn't do DNS lookups over ipv6.. that's new. They did't mention that active directory doesn't work with ipv6 (important to companies, and a biggie, because as they say.. if one part of the infrastructure can't support it, it doesn't happen).

    51. Re:Well duh by Anonymous Coward · · Score: 0

      What would happen if we all decided not to curb our oil consumption habits until we either ran completely out of oil reserves.

      We are about to find out. Peak Oil is coming. Olduvai! Back to the cave!!!!

      OMG!

    52. Re:Well duh by Frank+T.+Lofaro+Jr. · · Score: 1

      I didn't know George Bush posted here! :)

      --
      Just because it CAN be done, doesn't mean it should!
    53. Re:Well duh by Kabuthunk · · Score: 1

      Yeah, of the three options they listed... the only really viable one is option 3... move everything to IPV6 as fast as possible. The other two options are only delaying the inevitable... and only by a few years tops.

      --
      Planet Zebeth - Metroid with a twist
    54. Re:Well duh by Anonymous Coward · · Score: 0

      Not for nothing, but there is no need for people to be working on a solution... you just upgrade to IPV6. Enterprising network Guru's should be able to experiencing their own version of the Y2k software boomlet by providing consulting services to the small and medium size business that do not have the expertise to handle this in-house. Enterprising network programmers can write software for legacy systems to support IPV6 and sell it so a company does not have to replace all of their old hardware. It should be noted that Linux, and XP, and to some extent win2000 have support built-in, and if you bought a router within the past 10 years, you probably require only configuration changes.

      Its expensive, but IPV6 has been "coming around the bend" for well over a decade. If you haven't planned for it, you really have no one to blame but yourself.

    55. Re:Well duh by SanityInAnarchy · · Score: 3, Insightful

      The problem is, the cost may not be measured in dollars.

      Right now, although my ISP only gives me one IP address per subscription, I control it. I can run a private web server, mailserver, etc. I can basically run a website on $10/year (the cost of registering a domain) unless I suddenly get popular. ($30/year if I pay for an SSL cert.)

      If we stick with IPv4, this will no longer be possible. IPv6 would bring plenty of improvements on the current scheme, but sticking with IPv4 till it runs out means more NAT, and at the ISP level. And that means a higher barrier of entry to being a web server. It means the Myspaces and Livejournals of the world get to control everything anyone wants to publish.

      This is not a cost that we can measure in dollars, though. It's a cost to society.

      --
      Don't thank God, thank a doctor!
    56. Re:Well duh by ArsonSmith · · Score: 2, Insightful

      Yea, it's always cheaper to rip out a century old established economy and replace it with a completely new untested one.

      --
      Paying taxes to buy civilization is like paying a hooker to buy love.
    57. Re:Well duh by Loke+the+Dog · · Score: 1

      That doesn't neccesarily mean anything. I can think of many ways to get a free meal, that doesn't mean food has no value or that supply is higher than demand for food. It just means some think it's a good idea to give me a free meal.

      The fact is that where I live, there is a real lack of IP addresses. I basically only have one ISP available (and some others that offer identical services, except customer support) and they only give out one IP per customer, no exceptions. If IPv6 was real, this would never happen, because no one would even consider giving just one IP to each customer, it would be silly in this day and age.

    58. Re:Well duh by Tracy+Reed · · Score: 4, Informative

      China, Korea, Japan etc. use lots of ipv6. I've been there, seen it, helped set some up. There is a whole Internet out there full of asian language websites out there that we don't even know about because our english only Internet doesn't link to it. Go to a cyber cafe in Hong Kong, Beijing, Seoul, and you'll see what I mean.

    59. Re:Well duh by PitaBred · · Score: 1

      Ok, so that "solves" https. What about the fact that we can't NAT a whole lot more than we already are, especially with the explosion of P2P apps and massively interlinked websites?

    60. Re:Well duh by epine · · Score: 1

      OTOH we've been hearing the doomsday scenarios from the ipv6 zealots for 10 years now, and I'm not seeing it - it's still easy to get a block of IP addresses (I asked for 8 and got given 16 'just in case' for example).. we're not seeing the beginnings of a shortage yet. What worked for New Orleans, will work for me.

      Living in a stadium thinking "if I had just noticed 30 minutes sooner, I could have made it out" is a nice way to pass the time. But the phone rang, and the dog barked, and the coffee filter collapsed and had to be poured out and brewed again ... and by then, it was too late.

      Personally, when I'm walking through the park and some "playful" pitbull makes an aggressive lunge in my direction (which happens often because I'm large, male, and walk with a force of purpose that a Texan would define as a trot) I'm not entirely mollified when the owner informs me "don't worry, he's friendly". As if my having a choice in the matter was entirely irrelevant.

      I've one of those people who would like to pull out a gun and cap the pit bull at the last moment where I can reasonably prevent it from biting me. I'm not one of those people who wants to stand there and wait until the answer comes back "not friendly".

      I'm just saying, my personal standards of brinkmanship are quite different than yours.

      I also live in a fault zone, but we haven't felt the big one yet, so no worries. I just opened my tap, and fresh water is still gushing out.
    61. Re:Well duh by madsenj37 · · Score: 2, Informative

      Harry Truman was a Free Mason...

      --
      Choosing the lesser of two evils is a choice for evil.
    62. Re:Well duh by jim3e8 · · Score: 1

      Of course! All we need do is drill for new IP blocks in the previously unexplored 355/8, 356/8, and 357/8 tar sands.

    63. Re:Well duh by HexaByte · · Score: 1
      Some can be adapted - my wifi router can route ipv6 but not talk it for example. No way all that hardware is going to be replaced within two years.

      Not all have to be. If 10% switched to IPv6, that gives us 10% more v4 addresses. Then, as prices come down or, more likely, v6 is built in to all the new home routers, all new people and everyone replacing an old one will go v6, freeing even more v4 addresses.

      Now, I, personally, have to learn v6 soon, since one of my clients (Fed Gov) is making the switch, but most of my clients aren't and won't until it's too expensive not to.

      --
      HexaByte - he's a square and a half!
    64. Re:Well duh by jZnat · · Score: 2, Informative

      At the rate that IPv4 addresses are being used, even if all the /8's given to companies that got on the Internet first were freed for general use, that would only buy us a few months before we ran out of IPv4 addresses again. It'd be better to just move on to IPv6 where it's impossible to run out of addresses.

      --
      'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
    65. Re:Well duh by gbjbaanb · · Score: 1

      Hmm, well I'm rather surprised Microsoft isn't a huge supporter of forced migration to IPv6 then. If not being able to connect to the internet using XP isn't a reason to upgrade to Vista, I don't know what is!

    66. Re:Well duh by Shulai · · Score: 1

      RTFA. IPv6 routers will need to work as dual stack devices, and have both IPv4 and IPv6 addresses, if you ever want to comunicate to the existent, IPv4 only Internet. At least until mostly everybody is into IPv6, then you don't care about being IPv4 able anyway.

    67. Re:Well duh by LaskoVortex · · Score: 0

      It'd be better to just move on to IPv6 where it's impossible to run out of addresses.

      That's what they were saying about IPv4 15 years ago.

      --
      Just callin' it like I see it.
    68. Re:Well duh by Anonymous Coward · · Score: 0

      IPv4 behind a NAT is not a problem, the Internet facing broadband modem/router/firewall is the only part of a home network that needs to be IPv6 ready. But until they are, the service provider can shoulder the problem.

      For non-commercial users, the ISP could put them all behind NATs and allocate private addresses (dial-up too). Remember, only Internet available services need a public IP address, and the majority of consumer users really have no need for (and would be safer without) a public IP address. For those few home users who do have a legitimate need, we've just defined a new service tier.

      We've been profligate and sloppy with address allocation, because we could afford to be. Past time to tighten up.

      It was always expected that IPv6 would be deployed from the backbone out, IPv4 tunneling across IPv6 was part of the original design.

    69. Re:Well duh by Cramer · · Score: 1

      There are no 10 year old backbone routers still in service on any backbone. Anywhere.
      ABSOULTELY, 100%, wrong. You've obviously never worked for an ISP. They do not go around replacing their entire infrastructure every few years. The Teir-1 providers won't even think about installing anything until it's been throughly tested -- a process that can take years. For example, you won't find hardware Cisco just started manufacturing on UUNet's backbone.
    70. Re:Well duh by drmerope · · Score: 1

      All the major backbone router manufacturers have included IPv6 natively for at least the last 3 to 6 years. Any internet company that has done a major upgrade to deal with ever increasing traffic levels and customer demands now have IPv6 capable hardware in service in the backbone. Some manufacturers may still charge more to turn the capability on. The ones that don't are seeing increasing sales because all their major clients don't like have a tiered system of features, where the only set with all the needed features is the most expensive one.

      This is what's so frustrating to hear. It isn't enough for the router to have a checkbox, "supports IPv6". If you start using IPV6 in your routing tables, suddenly either your table capacity or your cycle-time decreases by a factor of 4. This is a BIG deal. IPv6 hasn't been adopted widely in part because IPv6 is a bad standard. Stupid ideas like bloating the address-space to 128 creating the aforementioned problem. Stupid ideas like trying to eliminate DHCP by using prefixes but ignoring the need for hosts to acquire OTHER configuration information. Stupid ideas like making the IPv6 header so large, you actually bloat the size of TCP SYN frames that otherwise could have fit within an ethernet minsize frame. etc, etc, etc.

    71. Re:Well duh by The_Quinn · · Score: 2, Insightful

      There is no "interest of society". Society as such does not have interests. Only individual people have interests. If you try to claim that it is in the interest of every single person in society that IPv4 be upgraded to IPv6, then, frankly, you watch too much Looney-Tunes.

    72. Re:Well duh by mpe · · Score: 1

      At the rate that IPv4 addresses are being used, even if all the /8's given to companies that got on the Internet first were freed for general use, that would only buy us a few months before we ran out of IPv4 addresses again.

      The amount of time depending on what size pieces those /8's get chopped into and probably exactly who gets them.

    73. Re:Well duh by mpe · · Score: 1

      certainly true, in my eyes Hybrid vehicles are the half baked solution towards going either hydrogen and/or all electric cars because they still rely on gasoline and their CO2 cost of producing the batteries is high as well.

      Hydrogen dosn't make a good vehicle fuel, either you need to store it highly compressed or use some reversable reaction to have it bond to a solid. Fuels which are liquids at normal temperatures and pressures are in comparison a lot easier to handle. They also don't have to be produced from petroleum, using food (or agricultural land which could otherwise produce food) probably isn't a smart idea.
      All electric cars would need batteries too, unless you had an internal combustion engine driving a generator powering electric motors. Something which appears to work better for trains than cars/trucks/buses/etc.

    74. Re:Well duh by fbartho · · Score: 1

      And they'll reply with the amount they had to pay to make the internet (and their block of IP-addresses) active and a commercial boom. They'll have to of course adjust it into today's dollars, and add a convenience fee, and you'll end up owing them instead of the other way around.

      --
      Gravity Sucks
    75. Re:Well duh by onion_joe · · Score: 1
      A large part of the "peak oil" scenario also has to do with specific locations where we as a society are willing to drill for oil. There are huge reserves off the east coast of the United States, but the nation as a whole has decided that the potential environmental cost is too high.

      The issue as I see it is not that we are going to run out of oil any time soon, but that the environmental and sociological costs associated with obtaining this oil will exceed our willingness to extract it.

      Or not. Perhaps oily sludge on the beaches of Florida is a reasonable price to pay for plastic and cheap gas.

      --
      sig sig sig siggy sig
    76. Re:Well duh by GigaplexNZ · · Score: 1

      Uh... if it would only take a few months to consume all the /8 blocks that are being wasted, we are likely to run out of addresses sometime next week if we don't (see, I can exaggerate too). And since when was it impossible to run out of addresses on v6?

    77. Re:Well duh by neil-ngc · · Score: 1

      Haven't you learned yet not to use the word impossible. Never discount the power of mismanagement. Somehow, some schmuck, probably someone who works for the government or some sort of regulator, will find a way to use up all the addresses.

    78. Re:Well duh by Timmmm · · Score: 1

      Bullshit. There were few problems because most programs store and manipulate dates as seconds since 1/1/1970, *not* as day-month-year triplets. That runs out in 2038.

    79. Re:Well duh by misleb · · Score: 1

      Or not. Perhaps oily sludge on the beaches of Florida is a reasonable price to pay for plastic and cheap gas.


      I, for one, welcome our bikini clad, oiled up, spring break taking overlords!
      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    80. Re:Well duh by anticypher · · Score: 2, Insightful

      True I've never worked for UUNET, but given their reputation I could believe they still have cisco 7500s in their core. And I wouldn't count UUNETs carrier core as an ISP.

      Around here most of the core kit installed in Tier-1 and Tier-2 backbones is Juniper M and T series, Cisco 3700, 12000 and CRS-1, Nortel optical DWDM carrier components, and Foundry MLX and XMR series. There is now starting to be more Alcatel-Lucent and Huawei kit seen in lower cost areas.

      I never said that core kit was entirely replaced every few years, but as the core components get upgraded, the lesser capable machines get pushed out towards edge functions. Top of the line kit from 2000 just isn't going to be able to handle today's routing tables, MPLS functions, or new 10G, 40G or OC768 interfaces. But that older kit will do fine feeding less demanding clients.

      Migration of old kit is a constant, slow and absolutely necessary function in any well managed carrier network. There are also buy-back programs from the big manufacturers, and plenty of reselling of older machines to finance purchase of new kit. I can believe what you have seen in Tier-3 ISPs with a few hundred or few thousand customers could be a decade old, but that's not what I consider backbone.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    81. Re:Well duh by klui · · Score: 1

      Do these new viable sources offset the peak of oil production in 1972?

    82. Re:Well duh by zonker · · Score: 0

      Uh oh, Mom was the last to get an IP and she broke the intarweb!

    83. Re:Well duh by Poromenos1 · · Score: 1

      Who cares about the shortage? I lament the fact that we still use IPv4 whenever I try to send a file to a friend and we're both behind a NAT, or when I have to tell my friend he has to take three extra steps in his configuration to be able to play a game with me through the internet.

      --
      Send email from the afterlife! Write your e-will at Dead Man's Switch.
    84. Re:Well duh by Lorean · · Score: 1

      Good information is the key. Of which I have a lot of. Once our oil supplies are depleted, the oil company execs go live on the moon.

    85. Re:Well duh by foxylad · · Score: 2, Insightful

      Go and Google "the tragedy of the commons", then tell me society has no interests.

      --
      Do as you would be done to.
    86. Re:Well duh by Anonymous Coward · · Score: 0

      How much you think it would cost for a company like Ford to re-IP their entire internal network?

    87. Re:Well duh by sjames · · Score: 1

      I'm on IPv6 at home right now and it cost me 10 whole minutes of my time one afternoon. No extra equipment.

      With 6to4, there's no need to wait for your ISP to join us in the 21st century.

    88. Re:Well duh by sjames · · Score: 1

      All the more reason for the US to get something set up first. I don't think the Chinese controlling/influencing the next big step in the Internet architecture will sit well with the US government.

      Too late, the U.S. missed the boat. China is doing a big v6 rollout for the Olympics. Several of their Universities already run internal services on v6.

    89. Re:Well duh by sjames · · Score: 1

      Remember, only Internet available services need a public IP address, and the majority of consumer users really have no need for (and would be safer without) a public IP address.

      Since absolutely nobody ever uses p2p or VoIP. And of course, the ISPs can't wait to cough up the cash for enough extra firewalls to rewrite all those headers.

    90. Re:Well duh by sjames · · Score: 1

      Perhaps impossible is a bit overstated, but it IS practically impossible. Consider, the minimum prefix is a /64. Each such /64 can support more ethernet devices than have ever existed in the world. There are enough IPv6 addresses to assigm more than 1000 for each square foot of the Earth's surface (oceans included).

      Meanwhile, there are currently more people than there are v4 addresses.

    91. Re:Well duh by BadOPCode · · Score: 1

      I agree. There is a lot of people in the US and Europe saying everyone needs to jump on board with IPv6 and/or IPv6 doesn't work and yet very few in US and Europe have even bothered trying to migrate. I'm thinking a lot of the nations of the world are trying to get with the program as they don't have the resources and money to waste on premium IPv4 node numbers. Who needs to have a fire lit under their butts is US and European ISP's. Thats where the slackers TRULY are. Want a door step to wave pitchforks and torches... try AOL.

    92. Re:Well duh by BadOPCode · · Score: 1

      I agree. Ethanol made from corn via processing plants powered by coal is definitely the solution! Just think you can power coal mining equipment with the Ethanol and have created perpetual motion. Politics needs to stay out of science. We have no clue what the truth is. Not only is the problem of global climate a huge complicated task involving all the sciences but now we have politicians on both sides of the fence that are monkeying with the facts. Personally I always assume anyone who is preaching hail and brimstone to be a wacko.

    93. Re:Well duh by John3 · · Score: 1

      I agree. Ethanol made from corn via processing plants powered by coal is definitely the solution! Just think you can power coal mining equipment with the Ethanol and have created perpetual motion. I'm assuming you are being tongue in cheek here. The economics of ethanol leaves a LOT to be desired.

      --
      "We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
    94. Re:Well duh by LaskoVortex · · Score: 1

      There are enough IPv6 addresses to assign more than 1000 for each square foot of the Earth's surface (oceans included).

      In terms of pure quantity, your statement is almost as absurd as mine was, but I doubt if you were attempting humor like me. So I'm going to have to respond (1) to show you that you how your statement is absurd, and (2) more importantly, because some humor-challenged moderator modded my original note down, probably because said moderator was also math challenged and couldn't identify the absurdity of my original comment, and hence missed the humor of it.

      How absurd was my comment (how funny was it)?

      Well, there are 2**128 ipv6 addresses, or 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses (or more than 10**38). That's a lot! Now, how much surface area does the earth have? In the old days, I would calculate this, but these days, its easiest just to google "surface area of earth": 510,065,600 square kilometers, or 5,490,300,425,045,295 square feet. So, each square foot of earth's surface gets 61,978,824,577,369,303,539,367 ipv6 addresses. That's far more than 1000 (61,978,824,577,369,303,539 times more, to be correct). In fact, 61,978,824,577,369,303,539,367 is a number that is far too big for most people to even imagine.

      So maybe I should put 2**128 in different terms, so that we may begin to understand what 2**128 means in terms of address allocation. First, let's assume that every person on earth is as fat as the average American male (arguably the fatest people on the planet) at 86 kg. Let's also assume that people are, on average, as dense as water, and so that 86 kg has about as many atoms as in an equivalent mass of water. So the average person is made probably no more than 2.27 * 10**27 atoms. Currently, the population of the earth is about 6,653,000,000. So, there are 6.81 * 10**37 atoms making up all of the people of the earth. So, 2**128 ipv6 addresses means that we could assign about 7 ipv6 addresses to each of the 6.81 * 10**27 atoms of each of the 6,653,000,000 people on earth.

      So now it should be clear that I was trying to be absurd and thus humorous in my last post.

      --
      Just callin' it like I see it.
    95. Re:Well duh by Walter+Carver · · Score: 1

      This moded funny. It should be modded as insightful.

  3. The obvious solution is IPv5 by Anonymous Coward · · Score: 2, Funny

    If IPv4 runs out and we can't use IPv6, then I guess we split the difference and use IPv5

  4. Dupe by suso · · Score: 5, Informative

    Here is the story from a few weeks ago

    And as I said before, the solution is to take back some of those huge class A blocks from companies like HP, Ford and GE, which are not using all the space. That would buy a few years.

    1. Re:Dupe by Silver+Sloth · · Score: 4, Informative
      RTFA - which says

      ... there are ideas for managing the address space more efficiently by introducing auction and other pricing mechanisms to encourage better use (people who don't need their allocation will flog them off rather than hoarding them, while new uses will be parsimonious in their approach), but the developing world sees this as unfair in the extreme. You can see their point.

      There are other problems: how do you route IP addresses when the existing hierarchy breaks down due to address spaces moving through the network? Who's responsible for managing an increasingly incoherent network? Who foots the bill when your address space is sold from underneath you? In any case, it doesn't solve the basic problem - it merely makes it increasingly expensive to innovate. so it's not quite that easy...
      --
      init 11 - for when you need that edge.
    2. Re:Dupe by Anonymous Coward · · Score: 4, Funny

      Not dupe! That story is titled "One Step Closer to IPv6"... This one is "798 steps to go"

    3. Re:Dupe by IBBoard · · Score: 4, Interesting

      And we need to retrieve some from the Vatican as well!

      Looking at the information here then the Vatican has far too many IPs per capita. Ditto for the other tiny nations of Gibralta and Monaco. I'm sure it'll buy us at least a week!

      And for anyone geeky enough to care (who isn't geeky enough to have it bookmarked already) here is the assignment list. Each of the companies mentioned owns an entire top level block (e.g. Ford own 19.xxx.xxx.xxx) and some like the Defense Information Systems Agency (whoever they are) own multiple blocks! That's an awful lot of addresses.

    4. Re:Dupe by kellyb9 · · Score: 1

      Does the IANA still lease class A addresses? I thought they went to a classless system.

    5. Re:Dupe by Anonymous Coward · · Score: 1, Interesting

      And as I said before, the solution is to take back some of those huge class A blocks from companies like HP, Ford and GE, which are not using all the space. That would buy a few years. I feel a pang of guilt here since we have a full class C block at my business. We use about a dozen static IP's (mail and web servers) but we've had the full class C block for 10 years or more from our original contract with uuNet. I think over the years they just forgot we had the block of addresses, and with the change from uuNet to Worldcom/MCI and now Verizon it's a wonder they can keep anything straight.

    6. Re:Dupe by thegameiam · · Score: 1

      The presentation was at NANOG, which just concluded on Wednesday of this week.

      If all of the class-A space allocated to companies was revoked (there are actually some companies which really DO use their whole class-A, and the legality of revoking it would be pretty questionable (they don't have a contractual relationsihp with ARIN, for instance), that would buy about another year given the current burn rate. No matter when it runs out, it's running out, and we should be prepared for it.

      -David

      --
      Need Geek Rock? Try The Franchise!
    7. Re:Dupe by kellyb9 · · Score: 2, Interesting

      2^24= 16,777,216 addresses for each of those companies seems excessive. If there was a major crisis, I would wager to bet they would begin leasing out these addresses to private consumers at a premium. Regardless, I've heard so many estimates about when this is going to happen, I find it difficult to believe any of them.

    8. Re:Dupe by Kamokazi · · Score: 1

      I agree...no need to stop there though. I work for a medium-sized company, and we have at least 50 static IP addresses we aren't using. We need a respectable number for coordination between our overseas facilities. I would think there would have to be thousands of other companies like us with extra addresses that are not needed at all.

      --
      As our way of thanking you for your positive contributions to Slashdot, you are eligible to disable Slashdot 2.0.
    9. Re:Dupe by gclef · · Score: 1

      And you would be wrong. We burn through 2-3 /8's every few months. The effort to reclaim the legacy /8's would take longer than the time we'd gain from reclaiming them.

    10. Re:Dupe by KiloByte · · Score: 1

      Not dupe! That story is titled "One Step Closer to IPv6"... This one is "798 steps to go" And what is the number of step "AAAA record for slashdot.org"?
      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    11. Re:Dupe by Spad · · Score: 4, Interesting

      This is a much prettier depiction

    12. Re:Dupe by Anonymous Coward · · Score: 1, Interesting

      heck, I used to know a private company with ~100 employees that had gotten a "Class B" because the owner had known someone on the allocation board "way back when".

      The company doesn't exist anymore, but it wouldn't surprise me to know the ex-owner was still hanging on to the Class B (he had mentioned that he'd been offered lots of money for it quite a few times, but preferred to have it for the prestige value).

    13. Re:Dupe by suso · · Score: 1

      They did. Those class As are just legacy. Maybe they have tried to get those blocks back from the companies but the companies are saying no. Honestly, I would just tell the companies "tough" because if we switch to IPv6, they won't have the vanity of having such a large block anyways. I'm going to write to IANA about this.

    14. Re:Dupe by AceJohnny · · Score: 1

      And as I said before, the solution is to take back some of those huge class A blocks from companies like HP, Ford and GE, which are not using all the space. That would buy a few years. (emphasis added)

      Those are corporations, their goal is to make money. They're sitting on a pile of valuable allocation space. What prevents them from renting them away, just like any other ISP?
      --
      Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
    15. Re:Dupe by gclef · · Score: 2, Informative

      We allocate 10-12 /8's every year, and that rate is increasing. Reclaiming legacy allocations is not going to help.

    16. Re:Dupe by physicsphairy · · Score: 1

      You cannot resolve what is ultimately an order of magnitude problem by reallocating the existing IP space. That's like trying save a sinking ship by organizing a bucket brigade which goes from the lower deck to the captain's quarters.

      If the blocks become a valuable asset the companies will auction them off themselves, seeing as making a profit by selling assets is WHAT THEY DO. No need to deal with all of the political an economic fallout from a government usurpation of the property.

      Simply consolidating the existing resources by use of NAT, dynamic IPS, etc. will accomplish infinitely more anyway.

    17. Re:Dupe by Anonymous Coward · · Score: 0

      but preferred to have it for the prestige value... or waiting for a LOT MORE money as the available ip space goes down.

    18. Re:Dupe by raind · · Score: 1

      Noticed the early date with certain company named: Halliburton and even earlier: Defense Information Systems Agency
      Hmmm

      --
      Get up!
    19. Re:Dupe by suso · · Score: 2

      And you would be wrong. We burn through 2-3 /8's every few months. The effort to reclaim the legacy /8's would take longer than the time we'd gain from reclaiming them.

      Where do you get this information? I'm not sure that even makes sense. A /8 is over 16 million addresses (not to insult your intelligence) and at a rate like that, I'd think we'd already be out of addresses a year ago. But if it really is being consumed that fast. Then you are right, the only solution is to switch to IPv6. And to do is right away.

      Of course, there is something to be said for keeping the number of available addresses constant and keeping more idiots off the net. But that's a pipe dream. ;-)

      As usual, wikipedia has a good article on IPv4 exhaustion.

    20. Re:Dupe by gclef · · Score: 2, Interesting

      I get that info from here which is looking at the actual allocation rates from the RIRs.

    21. Re:Dupe by anticypher · · Score: 1

      Even if all that early allocation /8 space were to be reclaimed without any fights, that would buy us between 17 and 23 months until exhaustion.

      Apple makes extensive use of their 17/8 space, when you go into Apple stores you get a nice, non-NAT but firewalled, connection. They aren't even wasteful, when I visited several Apple stores last year, I noticed they had netmasks of either /26 or /27 being handed out to machines getting on their wireless network. So they are making an effort to conserve.

      I've seen similar use inside of HPuq, extensive use internally of non-NAT space, and their network admins remain (for the most part) blissfully unaware of the horrors of trying to support a NATed network. They've heard of the horrors, but I'm sure they are quite happy to not really have to deal with the extra overhead of NAT.

      I've heard stories from friends who went from working in a non-NAT environment to one with NAT, and they couldn't believe the loss of productivity and usefulness in those poorly connected places.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    22. Re:Dupe by Anonymous Coward · · Score: 0

      Somebody has already done the math on this and discovered that taking back those addresses will only buy a few months.

      Which means that those companies just need to tie up a case in the courts for a couple of years and it will be too late to make a difference.

    23. Re:Dupe by suso · · Score: 1

      Thanks. That's pretty cool. From reading the Wikipedia article, I can see that people have investigated what I was proposing and you are right, it would take more time. Well, I guess IPv6 here we come.

    24. Re:Dupe by MT628496 · · Score: 1

      Can anyone tell me what all those blocks assigned to whois are for?

    25. Re:Dupe by IBBoard · · Score: 1

      Yeah, that is always a prettier one to show people. I like the IPv6 map they have on that page as well!

    26. Re:Dupe by CastrTroy · · Score: 1

      Oh, they can have an even larger block. It just won't mean much, because it's be such a small slice of the pie.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    27. Re:Dupe by nicklott · · Score: 1

      That's cool. I wonder if someone's done a dynamic "you are here" version?

    28. Re:Dupe by Tony+Hoyle · · Score: 1

      And what is the number of step "AAAA record for slashdot.org"?

      heh. Gotta love it.

      (TBH though AAAA for google, MS, BBC, CNN, etc. etc. is more important).

    29. Re:Dupe by nicklott · · Score: 1

      ha, google FIRST, post second...

    30. Re:Dupe by Anonymous Coward · · Score: 0

      Back in the day when every week brought the failure of yet another ISP, people were losing their connectivity/address space on a regular basis. It was handled like this:

      "Dear Sir

      You will lose Internet connectivity in 30 days because we are bankrupt. You need to find another provider before our network goes dark at that time. Thank you for your business to date."

      So it really is 'that easy' and as for who foots the bill - duh.

    31. Re:Dupe by Anonymous Coward · · Score: 0

      not easy? sure it is:

      a) restructure so the owners of a-class blocks become ip range leasors,
      b) let the registars resell these new addresses
      c) profit!

      see, both easy and amazing, eh!

      personally, i'm always amazed by an awesome display of the power of mismanagement

    32. Re:Dupe by Bert64 · · Score: 1

      And despite the pair of /8 blocks HP have, they still use significant sized blocks outside of these blocks too:
      www.compaq.com has address 161.114.23.244
      And they used to have all their webservers outside of the main /8 blocks too...

      Apple also, used to have most of their stuff outside but it seems now at least their forward facing stuff has been moved to 17.x.
      Then theres companies like GE and Ford who only use the IPs internally, and don't route any part of their /8 blocks to the Internet.
      dns005.ford.com has address 136.8.159.21

      etc... Their website is hosted by akamai now, but i'm sure it had a 136.x address when i looked before.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    33. Re:Dupe by jhol13 · · Score: 1

      the only solution is to switch to IPv6. And to do is right away. You are so right it hurts.

      One thing the opponents forget that the change to IPv6 is not going to happen in a year. It will take at least five, most likely ten years. So even if we started to move to IPv6 today we would be late.

      The question is not when (we hit the wall), the question is how hard.
    34. Re:Dupe by Anonymous Coward · · Score: 0

      Isn't that the ipv4 analogy of saying 'the solution to depression is to kick somebody in the balls really hard, because it will make you laugh for a bit'...

    35. Re:Dupe by cstdenis · · Score: 1

      Reserved or sub-allocated.

      --
      1984 was not supposed to be an instruction manual.
    36. Re:Dupe by Phroggy · · Score: 1

      Unless I miscounted, it looks like there are 41 /8 blocks that remain unallocated. That's over 600 million IP addresses. I don't think we need to ask Ford to give up theirs until we've allocated most of the other 41.

      It doesn't sound to me like we're running out of IPv4 addresses at all. It's a routing table problem, not an IP address problem. Calling it an IP address problem is why people aren't taking it seriously.

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
    37. Re:Dupe by Anonymous Coward · · Score: 0

      Also, Apple. Somehow, they got left off the list of IPv4-hogging corporations. Then again, this is /.

    38. Re:Dupe by Anonymous Coward · · Score: 0

      Now THAT's what I'm talking about!

      I'll take 37.xxx.xxx.xxx for $1000, Alex

    39. Re:Dupe by Anonymous Coward · · Score: 0

      It's simple: only give IPv6 addresses to development countries. That would solve the IPv4 problem over there and also make us western world invest in the infrastructure to support routing our packets there (and back).

    40. Re:Dupe by Anonymous Coward · · Score: 0

      Defense Information Systems Agency (DISA) is responsible for managing most US Defense IP networks. They are also responsible for managing most of the US DoD's IP address space. Address space with their name on it is used by a wide range of US DoD organisations/sites/activities. There isn't much mystery about who they are or what they do.

    41. Re:Dupe by Anonymous Coward · · Score: 0

      DISA, if you had simply taken the time to Google for even a quarter of a second, is the living, breathing, entity that manages and directs communications worldwide for the Department of Defense and all branches of the United States military.

    42. Re:Dupe by Anonymous Coward · · Score: 0

      If they are making enough money from the scarce resource they control then they can afford to keep it.

      The policies on allocation of address space need to be effectively enforced by the registries. Big companies are not audited after allocation. All the checks are done to justify the allocation but are never confirmed after allocation. Those who justified their need over a decade ago should be subjected to an audit according to current allocation policies.

      The large corporates that waste the space are not forced to use their space efficiently through financial pressure. ISP's have a legitimate use for large address space and can pass on their costs in proportion to their space usage so could easily tolerate an increased fee for unreachable public addressing.

      Why should everyone wear the cost of resource abuse by a few?

    43. Re:Dupe by Anonymous Coward · · Score: 0

      And who pays to have those companies re-address their entire networks? Do you have any idea how much money you are talking about here? Who is going to pay for that? The company? Why should they have to? They didn't break any rules when they set their network up. They asked for addresses, got addresses, and used the addresses. They didn't do anything "wrong". Why should they pay a crapload of money now for such a project?

    44. Re:Dupe by IBBoard · · Score: 1

      I got the impression they were some US military organisation, hence the reason I didn't bother wasting my time searching for them and instead put a rhetorical "whoever they are" in there.

    45. Re:Dupe by Anonymous Coward · · Score: 0

      Looking at the information here then the Vatican has far too many IPs per capita. Ditto for the other tiny nations of Gibralta and Monaco. I'm sure it'll buy us at least a week!

      Hah, nice way to ignore that the USA are actually number 2 on that list - and keep in mind that this is IP addresses *per capita*, so don't give me any bullshit about "we're such a large nation, so of course we need/deserve/have more IP addresses than others"! Before looking at the less than fifty thousand IPs owned by Monaco, maybe you should take a look at the 1.3 *BILLION* IP addresses owned by the USA.

    46. Re:Dupe by magister · · Score: 1
      --
      -magister-
  5. Tell MIT and IBM by Anonymous Coward · · Score: 0, Insightful

    To hand over the bazillion address they have lock away. Problem solved for a few more years.

    1. Re:Tell MIT and IBM by hool5400 · · Score: 2, Insightful

      If they consider these addresses to be an asset that other people want, then there is going to be lawyers and dollars involved.

      --

      Remember, it takes 42 muscles to frown and only 4 to pull the trigger of a sniper rifle.
    2. Re:Tell MIT and IBM by thegameiam · · Score: 1

      Do you have any idea how big either one of them are? They do actually USE those addresses, you know.

      Also, that doesn't buy much time - it's a lot of work for very little benefit.

      --
      Need Geek Rock? Try The Franchise!
    3. Re:Tell MIT and IBM by beuges · · Score: 3, Informative

      As a commenter above posted, each of those companies with top-level blocks actually owns 16,777,216 IP addresses. These companies include IBM, MIT, Ford, DEC, AT&T, Apple and Xerox.

      As big as IBM and MIT may be, do you really think they need almost 17 million IP addresses?

    4. Re:Tell MIT and IBM by Twisted+Willie · · Score: 1

      They do actually USE those addresses, you know.

      And that's the problem. I can't say much about IBM or MIT, but I can say something about HP as I've been one of their employees. IIRC, they have 2 blocks, the second one came from their taking over of Compaq (which had it from when they took over DEC).

      The problem is that they use a lot of those adresses for internal machines, that should really be using NAT for. I mean, I would setup a VPN tunnel from home and get a 15.x.x.x adress assigned. So yeah, they use the addresses, but what's the point?

    5. Re:Tell MIT and IBM by heffrey · · Score: 1

      Are there any companies outside USA that owns top-level blocks? I know the Internet was invented in USA, by Al Gore I believe ;-), but it's not really in the long term interests of the USA to hoard so many addresses.

    6. Re:Tell MIT and IBM by fmobus · · Score: 1

      Yes, they're big, but I doubt they have so enough public-facing machines to justify that many adresses.

      Funny noone mentioned yet: the map of the internet. Pardon my ignorange, but why can't we use some of those "green" blocks?

    7. Re:Tell MIT and IBM by gclef · · Score: 3, Informative

      God damn, I'm tired of fighting this meme. Look, as I mentioned in another response, we allocate 10-12 /8's every year, and that rate is increasing. Reclaiming MIT & IBM's /8's would buy us at approximately 2 months at our present allocation rate. The negotiation to make that allocation possible would take far longer. Reclaiming space is not a useful activity at this time.

    8. Re:Tell MIT and IBM by hjf · · Score: 1

      A class-A netblock has 16 million IP addresses. I seriously doubt MIT has 16 million computers, routers, phones etc. The same for IBM, even counting all their datacenters around the world.

    9. Re:Tell MIT and IBM by phoenix.bam! · · Score: 1

      Proper routing is the point. NAT breaks the internet in a horrible horrible way.

    10. Re:Tell MIT and IBM by Tony+Hoyle · · Score: 1

      No it doesn't. It breaks *servers*. Most people aren't running servers.

      If you're running services behind a firewall using NAT is an extra layer - stops information leakage.. you can't target an internal machine from outside through a NAT (or even know it exists).

      There's a reason why ipv6 has NAT as well. Everyone will be using it for the same reason.. I don't want anyone to know how many machines are on my network, or guess which ones are internal servers and which ones are desktop machines... even with ipv6 all my traffic will come from one address. This is even more true on corporate nets, some of which are so paranoid they have *multiple* NAT layers between departments.

      If you need direct access to a machine you VPN in and authenticate yourself properly. Otherwise you don't need to know it exists, ever.

    11. Re:Tell MIT and IBM by sholden · · Score: 1

      Yes.

    12. Re:Tell MIT and IBM by Tony+Hoyle · · Score: 1

      http://www.bgpexpert.com/addrspace2007.php

      Whilst the fact that we allocate 10 /8s every year is true, that's a tiny percentage of the overall use. The figures break down that we're using 69.7% of the available addresses now, up from 64.9%. The doomsday scenario is simply not here yet.

      This two year thing is yet another in a long line of doomsday prophecies, but the stats don't back it up. The space is running out, but in 2 years? No gonna happen. At the current rate of consumption try 10 years.

    13. Re:Tell MIT and IBM by weave · · Score: 1

      When HP bought Compaq/Digital they got their class A address as well. So now HP has two of the things. They should turn one of them back at least. Gessh.

    14. Re:Tell MIT and IBM by Wesley+Felter · · Score: 1

      Pardon my ignorange, but why can't we use some of those "green" blocks? Those blocks are available today but will all be allocated by 2012. The question is what to do after that.
    15. Re:Tell MIT and IBM by gclef · · Score: 2, Informative

      Really? Using your own link, there were 12 /8 blocks allocated in 2007, leaving IANA with 43 available. Assuming we continue on the present allocation path of 10-12 per year, that puts IANA out of addresses ~ 2011-2012 with no growth in allocation rate. The problem is our allocation rate is increasing, especially in ASIA (responsible for 7 of the 12 /8 blocks last year). So, even with the data in your link, IANA will be out of addresses to assign to the RIRs in 2-3 years.

      Yes, the RIRs will still have addresses to allocate to end sites when that happens, but the clock will have started ticking...if they need more, they're screwed.

    16. Re:Tell MIT and IBM by Wesley+Felter · · Score: 1

      The problem is that they use a lot of those adresses for internal machines, that should really be using NAT for. Imagine that FooCorp and BarCorp both decide to be "responsible" Internet users and configure their networks to use 10.0.0.0/8 internally and use NAT to access the Internet. Now FooCorp and BarCorp merge and decide to merge their networks to "optimize IT efficiency" or whatever. Except they can't merge the networks without renumbering because they have duplicate addresses everywhere. This is just one scenario where unique internal IP addresses are useful.
    17. Re:Tell MIT and IBM by crymeph0 · · Score: 1

      If only there were some way to use names instead of numbers to identify computers on a network, and when the number behind the names changed, it would be transparent to the end user. Such a foolish dream, I know.

      Seriously though, while you may have a point about the trouble of renumbering your internal networks, you have the same problem in IPV6, except in IPV6 you have to renumber every time you change ISPs.

      --
      It should be illegal to say that freedom of speech should be limited.
    18. Re:Tell MIT and IBM by Wesley+Felter · · Score: 1

      Seriously though, while you may have a point about the trouble of renumbering your internal networks, you have the same problem in IPV6, except in IPV6 you have to renumber every time you change ISPs. Large organizations don't renumber because they get PI addresses.
    19. Re:Tell MIT and IBM by thegameiam · · Score: 1

      AT&T, definitely (how many customers do you think AT&T has?)
        DEC -> Compaq -> HP... possibly - they do a LOT of stuff

      MIT? Yes.

      IBM? Also yes.

      So that leaves Apple, Ford and Xerox as possibilities.

      The current burn rate chews through about /6 per year, so even if everyone in that list besides AT&T and IBM (who are in fact ISPs) gave back theirs, that buys about an additional year.

      Not enough to make a meaningful difference...

      --
      Need Geek Rock? Try The Franchise!
    20. Re:Tell MIT and IBM by thegameiam · · Score: 1

      IBM also uses those addresses for their partners, of which there are zillions. They may not need a /8, but they probably need at least a /9, which means that any actual renumbering and give-back wouldn't net very much

      --
      Need Geek Rock? Try The Franchise!
    21. Re:Tell MIT and IBM by thegameiam · · Score: 1

      The "green" block in the upper right is 240/4 "class E" space, which was and is IANA-reserved for "experiments." The problem is that most computers currently in use cannot either accept one of these addresses or route to it. Go ahead - try, and see how it works. (NANOG had a long thread about reclaiming that space, and the net of it was that it wasn't worth the effort).

      Public IP space is not only important for public-facing networks - it's when it absolutely needs to be globally unique: think network management, or when you acquire a bunch of other companies - 3 and 4 layer NAT really sucks.

      --
      Need Geek Rock? Try The Franchise!
    22. Re:Tell MIT and IBM by PitaBred · · Score: 1

      It also breaks the Internet. With only 65,536 ports that you can use you run out of ports to dynamically swap around and still provide network services to all the NAT'ed IP's. You can only get a couple hundred machines behind each world-routable IP and still have them be able to access the outside world without running any servers on them. NATing isn't magic... it takes resources, it's just "invisible" as far as most people are concerned. So far. If you NAT a NAT, you're going to run into major issues with limited port allocation. We still need world-routable IP's, and they ain't making any more of those.

  6. Will get solved when needed to be solved by Danathar · · Score: 2, Insightful

    People will move and applications will get ported to IPv6, but only when they HAVE To move to IPv6 OR when there is some benefit that outweighs the cost.

    Simple.

    1. Re:Will get solved when needed to be solved by Anonymous Coward · · Score: 0

      IPv6 sole benefit is that it has a bigger address space than IPv4.

      IPv6 does not support NATs (well, it does but its a stretch), which allows Joe Haxxor to easily find what your network topology is, check up on an outstanding zero day bug list, and start a cracking. Also, having your internal network visible probably goes against a lot of corporate regulations, which means IPv6 has to be deployed carefully, or the SEC will be bringing guys with suits and handcuffs for IT staff and officers should a break in occur.

      IPv6 barely supports firewalling or QoS. Open corporate networks for all.

      IPv6 has no IP level encryption. Its in the standard, but no software or hardware implements it yet.

      Change ISPs? Guess what. You have to re-IP your whole inside network because your IP range is solely defendant on a subset of your main provider.

      Then, there is the fact that IPv6 is not battle tested, so you will be experiencing the joys of the late 90s all over again, with similar attacks like pings of death, to teardrop and land attacks. Expect one (if not more) of the major operating systems out there to have a bug in the IP stack allowing anyone to send some currently unknown packet and get kernel level access from anywhere on the Internet.

    2. Re:Will get solved when needed to be solved by crymeph0 · · Score: 1

      IPv6 does not support NATs (well, it does but its a stretch)

      Maybe I'm just not looking smart enough, but I don't understand why IPV6 doesn't support NAT well? I even Googled, with the phrases "ipv6 nat" and "why doesn't ipv6 support nat", and could come up with no detailed explanation. Sorry if I'm being stupid, but could you please explain why NAT wouldn't work in IPV6?

      It seems like NAT would be useful if you don't want *any* external sources connecting directly to most of your internal nodes - most offices fit this definition, there's maybe an email server and web server exposed to the outside, but no public services running on any workstations. If would also be nice not to have to change all your internal IP addresses every time you change ISPs.

      --
      It should be illegal to say that freedom of speech should be limited.
    3. Re:Will get solved when needed to be solved by Danathar · · Score: 1

      NAT is not supported because it's not needed under IPv6.

      There is no shortage of addresses, and if you want to "protect" your network you just firewall like in IPv4.

    4. Re:Will get solved when needed to be solved by ciggieposeur · · Score: 1

      AFAIK NAT is not visible at the IP layer, e.g. you can't look at a packet and say "that packet has gone through a NAT box somewhere". So I don't see why NAT requires "support" in IPv6 to work.

    5. Re:Will get solved when needed to be solved by ciggieposeur · · Score: 1

      IPv6 barely supports firewalling or QoS. Open corporate networks for all.

      What extra support does firewalling need from the IP layer?

      IPv6 has no IP level encryption. Its in the standard, but no software or hardware implements it yet.

      This looks like a configuration guide to enable IPSec over IPv6 on Cisco routers. And over here it says that Linux does IPSec over IPv6 since 2.4.28 and 2.6.9.

      Change ISPs? Guess what. You have to re-IP your whole inside network because your IP range is solely defendant on a subset of your main provider.

      That's definitely true for IPv4, but I thought the whole point of site local addresses was to avoid this issue in IPv6.

      Then, there is the fact that IPv6 is not battle tested, so you will be experiencing the joys of the late 90s all over again, with similar attacks like pings of death, to teardrop and land attacks. Expect one (if not more) of the major operating systems out there to have a bug in the IP stack allowing anyone to send some currently unknown packet and get kernel level access from anywhere on the Internet.

      True, but then again there are far more people involved in the Net today than in 1994 to 1998-ish when IPv4 stacks were getting pounded.

    6. Re:Will get solved when needed to be solved by crymeph0 · · Score: 1

      I get why you say it's not needed, but I don't understand how it's not supported. Like ciggieposeur above me, I don't know that there is a way you could look at a packet and say it's NATted or not, so my question is not "why shouldn't I use NAT with IPV6?", but rather "how does IPV6 actively prevent me from using NAT?".

      --
      It should be illegal to say that freedom of speech should be limited.
  7. Is this REALLY a problem? by wild_quinine · · Score: 5, Funny

    Is this really a problem for most people? NAT really.

    1. Re:Is this REALLY a problem? by _KiTA_ · · Score: 0

      Is this really a problem for most people?

      NAT really. Except you can't NAT a NATted connection. What happens when your ISP gets the bright idea to give you a "simulated private IP address" and charge $20 a month for one of their few remaining real ones?

      What happens when server farms start having to do the same? Last I heard, two NATted clients can't talk to each other.

      This article may be crying wolf, but that doesn't mean you should ignore the very real problem.
    2. Re:Is this REALLY a problem? by ModMeFlamebait · · Score: 5, Informative

      Except you can't NAT a NATted connection.
      Sure you can.
      --
      Pavlov. Does this name ring a bell?
    3. Re:Is this REALLY a problem? by Tranzistors · · Score: 5, Informative

      Last I heard, two NATted clients can't talk to each other.

      Unless you have port forwarding (or how do you kids call it these days)

    4. Re:Is this REALLY a problem? by entrex · · Score: 0

      Why can't NAT clients talk to each other? I have no problem with NAT using torrents, ftp, etc. OpenBSD + PF = hotness

      --
      To a nail, every person with a hammer looks like a problem.
    5. Re:Is this REALLY a problem? by palegray.net · · Score: 1

      I always called "routing." Anyhow, who wants to bet on an upcoming "land grab" for IPV4 addresses? I mean this in the sense that people will start setting up whatever silly services they have to in order to justify the additional IPs in the short term, in the belief that they're going to be unavailable later or at much greater contractual cost. Sorta like the Y2K scare, but arguably more amusing to watch (not to mention profitable if you're in the right position).

    6. Re:Is this REALLY a problem? by suggsjc · · Score: 3, Informative

      Except you can't NAT a NATted connection.
      Sure you can. All NAT does is take one IP address, monitor connections and spread/translate the unique connections across different ports. The device doing the NAT doesn't care "where" it gets its source IP from, it just knows that it has an IP and it splits the connections to that IP. The only potential issue is that if the first NAT runs out of available ports. However, at that point its routing table would be huge and it would probably begin to degrade in performance (depending on the hardware).
      --
      When I have a kid, I want to put him in one of those strollers for twins and then run around the mall looking frantic.
    7. Re:Is this REALLY a problem? by m50d · · Score: 1

      Which lets one person among those being NATed run a webserver. Putting us right back to where we were before NAT.

      --
      I am trolling
    8. Re:Is this REALLY a problem? by totally+bogus+dude · · Score: 5, Insightful

      Sure, but that's because you control the NAT and can forward ports, so you can still accept incoming connections. If your public IP address (i.e. what other torrent clients will try to connect to) is controlled by your ISP, you're going to have a hard time getting them to forward the ports you need to you. In fact, they would have a hard time providing this service in a usable and cost-effective manner, even if they wanted to.

      Also, there's a good chance OpenBSD + PF is more accommodating of various protocols than an ISP's oversubscribed NAT gateway is likely to be. Even if they do their best, it can still get in the way. For example most gateways can handle FTP by watching for "PORT" or "PASV" messages and dynamically opening/forwarding the requested port (or rewriting it to use the port it wants), but this doesn't work if your FTP session is encrypted.

      Finally, a lot of the ISPs seem to be actively discouraging P2P, and will simply use "no more IP addresses" as an excuse to slap in NAT gateways that restrict people to web and email. If you want "raw internet", then you'll have to pay.

      With any luck there'll still be enough competition in the ISP space in 2010 to push the rollout of IPv6 onwards. A lot of the big ISPs will probably resist it, as a) it would cost a lot to upgrade and re-engineer their infrastructure to support it and b) they can make lots of money by charging a massive premium for routeable IPs. Not to mention that the media cartels will probably have convinced most people and politicians that the only reason one would want "raw internet access" is for piracy, child porn, and terrorism.

    9. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      Unless you have port forwarding (or how do you kids call it these days)

      If your ISPs are running NAT, port forwarding wouldn't work. There's only a limited number of ports.

    10. Re:Is this REALLY a problem? by CarpetShark · · Score: 1

      Except you can't NAT a NATted connection.


      Technically, there's no reason why not. There are plenty of different private IP ranges to use so that one NAT'd subnet isn't confused with another.
    11. Re:Is this REALLY a problem? by johannesg · · Score: 5, Insightful

      NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak.

      Do you really want to live in world where you can only connect to the servers of your corporate overlords? Wasn't the internet supposed to be offering equal opportunity for everyone?

    12. Re:Is this REALLY a problem? by $pace6host · · Score: 5, Insightful
      Really, I bet there are huge tracts of IP real estate that would function just as well on NATted private networks. I work at a place that owns lots of IP networks, and 1) we're not allowed to run our own web servers, or any other kind of servers for that matter, and 2) all our outbound traffic is through corporate control points and filtered anyway. Still, the PC on my desk at the office has a public IP address. Do I NEED a public IP address? No. Not really. Most of my traffic is to internal company data anyway (share drives, internal sharepoint intraet collaboration site, outlook servers, inward facing development servers, etc.) The rest is already going through proxy servers. You couldn't get any packets direct to me, either, the routers on the edge of our network filter practically all inbound traffic out. I, and most of my collegues, are wasting our public addresses. I'd bet it's the same in a lot of places. Corporate security policies essentially ensure that the majority of cubicle workers can't possibly make use of any of the "benefits" a publicly routable IP address would actually have, but every PC (and telephone and printer) has one.

      I'm not saying NAT is the best solution, or even the right long term solution, just that I think it could be used (fairly successfully) in many more places while we get our collective asses in gear and go IPv6.

    13. Re:Is this REALLY a problem? by joshv · · Score: 1

      "NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak."

      I must then be imagining the public web server that I run over my NAT'd DSL connection.

    14. Re:Is this REALLY a problem? by nacturation · · Score: 1

      "NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak."

      I must then be imagining the public web server that I run over my NAT'd DSL connection. So your ISP assigns your DSL connection one private IP address which you then NAT to another private IP address?
      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    15. Re:Is this REALLY a problem? by kegger64 · · Score: 1

      If your ISP NAT'd your connection, and provided you with a 192.168.x.x address, could you still run a web server? (an honest question, I wouldn't know how to do it)

      --
      653899 - Another prime Slashdot UID
    16. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0
      If you're NATing on the ISP level or really any logical level city, state, country the density of devices is just too great to really leverage NAT, it's a problem, you will run out of ports and NATing is still a fairly expensive task (compared to switching and routing.) It's good at what it does but I really don't think it's a wide scale WAN solution. If you have a network of it's own, then NAT makes sense, it really depends on the break down of who you peer to to measure if NAT will work well for an ISP, if most comcast traffic is comcast to comcast p2p traffic (which might be true) then what does NAT do? Especially if they're using a torrent tracker outside comcast to meet each other, they'll double the NAT usage when they don't even need to NAT. On a different note, NATing and the devices that do it best are also really good at filtering and rate limiting and doing other things that seem to be topical here. At the same time, IPv6 obsoletes NAT which sort of gives your ISP and everyone else a good idea how many machines maybe on your network and I imagine some people are upset about that as well.


      What I don't understand is the belief that IPv6 isn't ready, it is, it works. There are a lot of devices that don't support it and a ton of software doesn't but I think those things will be fixed a lot faster than most people think. I think most businesses will stay on IPv4 internally for a while, all of the legacy devices and stuff can live inside their networks just as they do now but their external peers should switch to IPv6. there isn't an IBM or microsoft that can simply decide the world is ready, people just have to start doing it. some of the big ISPs just need to schedule their switch.

         

    17. Re:Is this REALLY a problem? by Brian+Gordon · · Score: 1

      Port forwarding eh? Think your ISP is going to set up a port forwarding rule to forward your bittorrent traffic? There aren't even enough ports if they wanted to.

    18. Re:Is this REALLY a problem? by Courageous · · Score: 1

      The answer to you question is: without your ISP's involvement, no. NAT = FIREWALL.

      C//

    19. Re:Is this REALLY a problem? by Planesdragon · · Score: 1

      It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak. I don't know where the hell you've been, but it's been that way since before AOL.
    20. Re:Is this REALLY a problem? by anticypher · · Score: 5, Informative

      I'm so glad someone else is aware of this problem, NAT can't be infinite, or even large.

      I saw a Cisco presentation years ago on their experiences from rolling out NAT internally. They started with an address overload of a /24 (251 usable addresses) into a single external IP address. For an office with about 120 active machines, the NAT box (biggest, beefiest box they made at the time) completely fell over. With only light internet use, the NAT tables filled to take over all of the outgoing 65k ports in short time. That was in 1998, when most internet use was web pages, some email and simple IM. At the time, they recommended no more than a /26 (59 usable addresses) per external address.

      Move forward to 2007, and I made an updated presentation (for Cisco and non-Cisco NAT kit) that took into account all the new kinds of traffic we see, office workers who listen to internet radio, streaming video, youtube, multimedia conferences with H.323, peer-to-peer apps like Skype, other internet telephony apps, etc. Turns out that more than 15 to 20 active office users stuck behind a single overloaded external address would be the limit, even with a tight policy to prevent non-work traffic.

      It is much worse for ISPs with home users, who are not limited by workplace rules against peer-2-peer for popular TV shows or looking at pr0n pages. If you look at the typical pr0n page (it was a tough job, but I did it in the spirit of improving my understanding of the industry ;-), there will be between 200 and 300 embedded elements or links to affiliate sites and advertising partners. So every pr0n page view going through NAT takes 200 new external ports, with associated timeouts and state tables. A typical pr0n user (I'm guessing here, you the /. reader can supply your own values), can open a dozen or more pages in tabs in a relatively short period of time, leading to 10s of thousands of entries in the NAT state table. Remember, you have 65,533 maximum entries in the state table for a single external IP, or for a typical saturday night in basement-dweller-land, about 4 machines.

      Don't get me started about how many NAT states a typical 3Mbyte facebook page can open, and leave open for quite a while.

      If you think you can hide many ISP customers behind NAT, there are limits if you don't want a ton of calls to the support lines when your users can't effectively use the net. For modern home connections, that already have a NAT box with a handful of machines behind the NAT (Mom keeping 20 eBay pages open and doing Skype, Dad doing gaming, teenage son looking at pr0n and daughter with 20 different IM chats going while she P2Ps the latest TV episode and looks at 50 different bebo and facebook pages), you just can't NAT much more than that.

      That post was the voice of experience, if you want the nice real-world figures in a printed report and a keynote or powerpoint presentation to your CTO, you have to give me money.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    21. Re:Is this REALLY a problem? by vidarh · · Score: 2, Insightful
      You could, but in that case you'd need your ISP to run application level proxies for the protocols for which it'd be doable. For HTTP it is (starting with HTTP/1.1, since their proxy could use the Host: header to decided where to forward) but it'd require them to run extra hardware and you to tell them which domain names you'll be serving).

      That said, an alternative that is definitively possible is for ISP's to start NAT'ing everyone by default and handing out public addresses only to customers who ask. Most people would never know the difference, and frankly for many of them it'd improve security (slightly, at least).

      Another alternative is for them to give out v6 addresses, hand out routers with dual stacks to their customers and do NAT style translation to public IPv4 space combined with giving v4 addresses to customers that ask.

      I depend on having a public IP, but if my ISP put something like either of those two alternatives in place I'd be perfectly happy with it. Even if they'd charge me a nominal amount.

      And that might be a good idea for IP space in general: Charge a small fee per usable IPv4 address allocated from the RIR's. If you pay say $1 per IP address it doesn't matter much for a small business, but it will make a difference to the people holding on to huge chunks of IPv4 space where most of it either is unused or could be switched to local NAT'd addresses. Allocate the funds raised to IPv6 transition projects that anyone can apply for if they give up a certain percentage of their IPv4 space.

    22. Re:Is this REALLY a problem? by Bryansix · · Score: 2, Interesting

      But what if I want to run TWO web servers? What then? I can't port forward port 80 to two places. IPv6 is the real answer and the telecoms and ISP's need to get their heads out of their asses and support it already. The DNS records already exist.

    23. Re:Is this REALLY a problem? by Just+Some+Guy · · Score: 1

      The answer to you question is: without your ISP's involvement, no.

      And the correct answer to the question is: yes, but most people won't be able to get to it.

      NAT = FIREWALL.

      No. People, please get this out of your heads. It's not.

      --
      Dewey, what part of this looks like authorities should be involved?
    24. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      I am pretty sure you understand this point, but I think it is useful to point out that IPV6 will make it much easier to personally identify computer users and prevent the kinds of nastiness you describe.

      Today really the assumption is that networks are NAT'ed. An IP address in my apache log could be coming from a single actual machine, or more likely a router that may have anywhere from one to thousands of machines behind it.

      Its all really a shame that few aspiring network geeks get to learn from a real static IP. When I went to college and moved from dial up to a real static IP address, I was able to learn more about how the internet works than my previous three years on dial up (of course part of that was that I was paying by the hour, which made experimentation expensive).

    25. Re:Is this REALLY a problem? by Rich0 · · Score: 4, Informative

      I must then be imagining the public web server that I run over my NAT'd DSL connection.

      You probably are if you are really behind an ISP-run NAT. We're not talking about the Linksys router that you can tell to forward port 80. We're talking about the ISP handing you a non-routable 192.168.x.x address and not forwarding anything to it. Outward-ONLY connections...

    26. Re:Is this REALLY a problem? by Beorytis · · Score: 1

      I'm sure we'll see IP squatters just like we have domain name squatters. Actually, I think my employer is one of them, since our ISP sold us more static IPs than we needed. Wonder how I can resell them...

    27. Re:Is this REALLY a problem? by tacocat · · Score: 1

      One obvious solution is for everyone to get a dedicated IP address given to them based on first-in to the internet. If you don't have an IP address, you can't use the internet.

      The next would be to sell them off to individual persons, one IP per person. Again, if you don't have an IP address, you can't use the internet.

      The Final Solution would be to sell the IP addresses to individuals (no companies please) and anyone left without an IP address would have to die. This would solve the IPv4 problem, over crowding, poverty, and likely you wouldn't have any third world developing nations left over either.

      But seriously, I think the question needs to be asked, how many IP addresses does one person/company really need? One seems good. No reason for more than that in 99% of the cases anyone can present. And don't say Google. Large globally accessed search engines are in the 1%. But there one per continent would give you seven if you include Antartica.

      Actually, if you assigned one IP address per individual person, then the whole issue of security and domain parking and spam would go away. The addresses wouldn't change every time you threw up an RBL.

    28. Re:Is this REALLY a problem? by canuck57 · · Score: 2, Insightful

      NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not; a second-rank type of internet citizen, so to speak.

      This already exists, I have to pay $20 extra for my 2 statics. And looking at my firewall logs, NAT for your average user is not a bad idea. Don't worry, P2P will find a way to deal with it. But does offer the ISP ways of cutting down abuse from careless PC Internet users.

      But do also agree with the flip side, I am sure ISPs will find a way to screw customers.

    29. Re:Is this REALLY a problem? by danlor · · Score: 1

      Citation missing...

      In my entire career I have never heard of anything close to this. Please cite sources.

      We have no problems here at all with over 300 users behind 1 ip. None. Zip. Zero.

      Huge networks use Nat all the time to handle merging of incompatible networks. I have no idea what you could possibly be talking about. I call FUD.

    30. Re:Is this REALLY a problem? by Your.Master · · Score: 1

      An absolute limit for 1 NAT can be worked mathematically. 2^16 TCP connections / (maximum TCP connections/user) = Maximum number of users, assuming TCP is the limiting factor (and assuming they all use this same mythical "maximum TCP connections").

      300 people means an average of 218 TCP connections per person at peak. That sounds reasonable, actually. You just also need a router than can support this. Cisco's original presentation was "years ago" so even though webpages were simpler and needed for ports, the hardware was lacking. No idea how recent the hardware the GP used for his presentation was, but I can confirm that facebook, especially with a bunch of apps, can be CRAZY.

      Hierarchical NAT will reach routing table limitations sooner. I cannot cite because it depends too heavily on the particular hardware and use-case involved.

    31. Re:Is this REALLY a problem? by AaronW · · Score: 1

      It is similar where I work. There are around 400 employees, yet the company has an entire class B as well as a couple class C's. Every computer, gets its own public IP address even though very few are actually needed. Everything is protected behind a firewall of course.

      --
      This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
    32. Re:Is this REALLY a problem? by Matthieu+Araman · · Score: 1

      This problem can be worked around.
      When natting, you can reuse the same source port when you address different destinations ip.
      Some solutions uses this (for example Checkpoint Firewalls...)
      The biggest problem I see with nat is interconnecting enterprise networks and complexity on the nat device and on application side.
      there is a perpetual rfc1918 conflic address because everybody is using the same rfc1918 ip addresses and you have to find solutions to make communications work.
      This complexify the network and makes debugging hard.(ie sometimes, source and ip addresses have to change several times at different level on the network)
      When this breaks, it's a big pain...
      having global coherent addresses with ipv6 will be a big win, even if this cause some pain during the transition period.

    33. Re:Is this REALLY a problem? by bogd · · Score: 1

      They started with an address overload of a /24 (251 usable addresses)

      What I'm really curious about is where that "251" figure came from...

    34. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      A lot of the big ISPs will probably resist it

      Actually, some of the big ISPs have good reason to move. Comcast, for example, is deploying IPv6 infrastructure now.

    35. Re:Is this REALLY a problem? by dave562 · · Score: 1

      Take out the broadcast and gateway addresses.

    36. Re:Is this REALLY a problem? by Epi-man · · Score: 1

      Is this really a problem for most people? NAT really.


      Don't you mean:
      Is this really a problem for most people? NAT relay.
    37. Re:Is this REALLY a problem? by misleb · · Score: 3, Informative

      I saw a Cisco presentation years ago on their experiences from rolling out NAT internally. They started with an address overload of a /24 (251 usable addresses) into a single external IP address. For an office with about 120 active machines, the NAT box (biggest, beefiest box they made at the time) completely fell over. With only light internet use, the NAT tables filled to take over all of the outgoing 65k ports in short time. That was in 1998, when most internet use was web pages, some email and simple IM. At the time, they recommended no more than a /26 (59 usable addresses) per external address.


      Really? We currently NAT well over 160 machines to a single external IP address and have had 0 problems in years. Users have unrestricted internet access (and they use it).

      If 160 machines are filling up 64k of ports, something is seriously wrong with the translation algorithm. Perhaps old connections aren't being reaped properly?

      t is much worse for ISPs with home users, who are not limited by workplace rules against peer-2-peer for popular TV shows or looking at pr0n pages.


      Is it worse for ISPs? I used to work for an ISP that would NAT whole high rise condominium/apartments of home users with no problems other than pure bandwidth.

      If you look at the typical pr0n page (it was a tough job, but I did it in the spirit of improving my understanding of the industry ;-), there will be between 200 and 300 embedded elements or links to affiliate sites and advertising partners. So every pr0n page view going through NAT takes 200 new external ports, with associated timeouts and state tables.


      It is a good thing browsers limit themselves to the number of simutaneous requests, isn't it? What is it, like 6? An intelligent NAT gateway will close a translation when the client does. A pr0n page will NOT take up 200 external ports.

      Remember, you have 65,533 maximum entries in the state table for a single external IP, or for a typical saturday night in basement-dweller-land, about 4 machines.


      Bullshit.

      Don't get me started about how many NAT states a typical 3Mbyte facebook page can open, and leave open for quite a while.


      How many? I'd really like to know how braindead your router is that it doesn't know how to close translations when the TCP connection is terminated.

      If you think you can hide many ISP customers behind NAT, there are limits if you don't want a ton of calls to the support lines when your users can't effectively use the net.


      Again, bandwidth was our only limitation.

      For modern home connections, that already have a NAT box with a handful of machines behind the NAT (Mom keeping 20 eBay pages open and doing Skype, Dad doing gaming, teenage son looking at pr0n and daughter with 20 different IM chats going while she P2Ps the latest TV episode and looks at 50 different bebo and facebook pages), you just can't NAT much more than that.


      You can. You're full of shit. (Or is it FUD?)

      That post was the voice of experience,


      No, it was the voice of someone who just pulled a bunch of numbers out of his ass. 4 user limit behind a residential gateway? Come on, you can't possibly believe that.

      -matthew

      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    38. Re:Is this REALLY a problem? by misleb · · Score: 2, Informative

      300 people means an average of 218 TCP connections per person at peak. That sounds reasonable, actually.


      No, it is totally unreasonable. It just doesn't happen. I just checked the translation table of our firewall with in excess of 100 users and there's only 216 translations open. This includes connections to our web server in the DMZ. You're telling me that it is reasonable for that number to increase 2 orders of magnitude?

      You just also need a router than can support this. Cisco's original presentation was "years ago" so even though webpages were simpler and needed for ports, the hardware was lacking. No idea how recent the hardware the GP used for his presentation was, but I can confirm that facebook, especially with a bunch of apps, can be CRAZY.


      Numbers, please.

      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    39. Re:Is this REALLY a problem? by drmerope · · Score: 1

      I think you need to read more about the IPv4 allocation. "NAT" needs to be deployed by corporations for their internal workstations. This is the true cause of the shortage. Companies like Apple (gasp) have ancient class-A allocations--Yes you read that right, Apple controls a block of 16 Million IPs. Of these, only a few thousand are routable or whose ports are publically reachable (due to firewalls).

      So stop the FUD. The question isn't whether home users will get NAT'd by their ISP. The question is whether 30 year old allocations need to be rebalanced to place more addresses in the hands of network service providers.

      At my company all of our workstations are behind a NAT. We have fewer than 16 routable IPs but control the equivalent of an old "C" block allocation.

      You should take a look at this: census vs. allocation. Only a small fraction of IPs are really in use.

    40. Re:Is this REALLY a problem? by bogd · · Score: 1

      8 bits == 2^8 == 256 possible addresses. Take out the broadcast and network addresses (.0 and .255) and you have 254 left. Hell, take out even the gateway address as you suggested (although I really don't see why), and you still have 253. Where do the other 2 go?

    41. Re:Is this REALLY a problem? by gnuman99 · · Score: 5, Insightful

      NAT is *the* *wrong* solution.

      Public IP addresses make it simple to have *proper* routing tables.

      There is also the ability to track users easily. Imagine you have one of your computers compromised. The computer is then used to control another box that controls another one that drives some botnet. If you have a NAT, the 3rd party that discovered their box compromised will trace it back to ... your NAT! And the NAT is not tracked 99% of the time. So, the compromised box on your site cannot be easily discovered without packet sniffing.

      Or an employee is involved in something illegal. The 3rd party produces their logs that list your NAT as the source of the problem. Which computer was used in that activity? You are stuck with tracing the stuff though screen loggers and other invasive BS just because NAT has to exist.

      NAT is the wrong solution because of liability. NAT is wrong solution from routing point of view. NAT is wrong solution from technical point of view. IPv4 would have been replaced years ago if it wasn't or stupid NAT gateways everyone has now. Yeah, these will be obsolete with IPv6.

      When I left school I thought NAT was the greatest thing in the world aside from sliced bread. Then real world experience forces you to realize that maybe the university usage of public IP on its internal network wasn't such a stupid thing after all. Public IP should be assigned to ALL devices, and then you can use a statefull firewall to protect these assets. Private IP networks should NEVER be connected to public IP networks - let's hope that dies with IPv4. The sooner the better.

    42. Re:Is this REALLY a problem? by Rich0 · · Score: 2, Informative

      Sure, I work for one of those companies - my laptop right now is connected to the VPN and is on one of those class-A networks. It is fairly well segmented across the company although obviously not all the address space is strictly necessary.

      However, as others have pointed out if you actually got all those companies to give up all their address space it would buy you 6-12 months max. There aren't really that many of them. The problem is that address space demand is increasing exponentially.

      And in some sense those companies helped get the internet started. There are always perks to being an early adopter. By the time you'd be able to take that space back in an orderly way it would be a sizzle in the pan.

      NAT to ISP customers is EXACTLY what people are concerned about. ISPs would almost encourage it since it helps them to reduce the internet to email + large-scale websites, which is easier to support and extract ad revenue from. Stuff like games, bittorrent, etc is just a pain to them and the idea of customers not being herded to preferred sites paying ad revenue is just abhorrent...

    43. Re:Is this REALLY a problem? by gnuman99 · · Score: 1

      Screw the HTTP servers. You want to host a game for you and your buddies and you CAN'T because of NAT! You want to have a SIP phone on the network, and you CAN'T. Simple, real world usage is curtailed because of NAT.

    44. Re:Is this REALLY a problem? by bcrowell · · Score: 1

      Huh? How many people's ISPs allow their customers to run servers? Not many, AFAIK.

    45. Re:Is this REALLY a problem? by drmerope · · Score: 1

      However, as others have pointed out if you actually got all those companies to give up all their address space it would buy you 6-12 months max. There aren't really that many of them.

      This is wrong. You clearly didn't take the trouble to look at the links I posted in the GP. While the instances of 'class a' abuse are somewhat constrained, there are plenty of poorly utilized allocations. Take a look, its shockingly sparse.

      It just doesn't matter how many people repeat the shortage canard; it doesn't make it true.

      NAT to ISP customers would be a bad thing, but that isn't the solution people are recommending when they suggest switching to NAT. Instead of just po-poing NAT, we should be making clear that targetted applications of NAT make sense.

    46. Re:Is this REALLY a problem? by Rich0 · · Score: 1

      This is wrong. You clearly didn't take the trouble to look at the links I posted in the GP. While the instances of 'class a' abuse are somewhat constrained, there are plenty of poorly utilized allocations. Take a look, its shockingly sparse.

      How would anybody know how that space is allocated. It is all behind firewalls. If you pinged every address in my company's class A you'd get no response unless you were on the network.

      Ironically the whole class A connects to the internet via a NAT. I'm not sure how many hosts could even be pinged on it. That doesn't really mean the space is "wasted".

      In any case, your proposal was to take back space from the class-A owners that aren't using most of it. There are only a handful of those - claiming that space won't help much at all. The problem is that EVERYBODY is wasting space. And current routing technologies basically make that inevitable. Unless routing tables grow to a point where /24s or smaller are routable at the top level you're going to end up making much larger allocations than are needed.

    47. Re:Is this REALLY a problem? by shentino · · Score: 1

      Actually if your ISP has a decent proxy server and especially if you are using HTTP keepalive, your web traffic gets consolidated before the NAT kicks in.

    48. Re:Is this REALLY a problem? by r_cerq · · Score: 2, Insightful

      Who modded this "Insightful"? You CAN forward ports to multiple servers, easily. There's plenty of equipment to do that.

      Any half-decent load-balancer is minimally L7-aware, to the point of being able to send specific hostnames in HTTP requests to specific servers (or server groups). The ones I primarily use go to the point of allowing me to distribute traffic based on arbitrary headers, cookies, URIs, you name it. Plenty of sites and distinct server farms behind a single public IP address.

    49. Re:Is this REALLY a problem? by drmerope · · Score: 1

      Ironically the whole class A connects to the internet via a NAT. I'm not sure how many hosts could even be pinged on it. That doesn't really mean the space is "wasted".
      That's exactly what it means. Thanks for completely conceding the precept. The map shown in link #1 of GGP is a map of those hosts who ping or have open ports. Its pretty darn sparse.

      And current routing technologies basically make that inevitable. Unless routing tables grow to a point where /24s or smaller are routable at the top level you're going to end up making much larger allocations than are needed.

      No, you only need to do that sort of routing at the leaves. This isn't really a problem for 'core' routers. Second, IPv6 wouldn't improve this situation either.

      You're also neglecting that the big iron routers still suffer capacity and performance problems given the insane address length of IPv6. This has been and remains one of the principal barriers to deployment. IPv6 simply costs a heck of a lot more per route and per packet routed.

      You should also keep in mind that using NAT gateways puts the internet back into the state it was designed to be. An internet being of course a "a network of networks"

    50. Re:Is this REALLY a problem? by drsmithy · · Score: 1

      8 bits == 2^8 == 256 possible addresses. Take out the broadcast and network addresses (.0 and .255) and you have 254 left. Hell, take out even the gateway address as you suggested (although I really don't see why), and you still have 253. Where do the other 2 go?

      One for each of the two redundant routers the gateway VIP is on ?

    51. Re:Is this REALLY a problem? by $pace6host · · Score: 1
      Considering that our enterprise security team tracks practically everything we do on our corporate PCs, from logging the IP addresses we access down to filtering the content we're allowed to see on the internet (sorry, that page contains information that might be useful for your work, please contact security!) I bet they could tell where the compromised PC is. To them, a "proper" routing table is one that doesn't include the PC and telephone on my desk at all, because you the outsider doesn't have any reason to route anything to them, and if I want to get to YOU, they want it to go through their central control anyway. IP was not designed for central control, it was designed for redundancy and repair. That's really of no use to our enterprise security people. They'd be happiest if they could have every packet in the company go through one router that would print out a hard copy for filing in your personnel record. Only practicality stops them.

      Right now, if an employee is involved in some illegal activity, a 3rd party IS just going to get a single IP address, the IP address of our proxy server. Because that's what everything goes through, so enterprise security can filter and restrict it. Which computer was it REALLY? The proxy server knows, and so could the NAT. There's little reason the NAT router has to have less logging capability than the proxy server does now.

      And when I say everything that goes outside goes through the proxy, I mean everything. HTTP, HTTPS, TELNET, SSH, SMTP. Everything that doesn't go through the proxy is forbidden. So, if it isn't one of the proxied protocols, or tunnelable over one of the proxied protocols, you can't have it. I'd find it hard to believe that there aren't a lot of other people who work in the same sort of environment.

      Any way, you're right, IPv6 is better, and the right way to go. NAT is just a stopgap.

    52. Re:Is this REALLY a problem? by Bryansix · · Score: 1

      Ya, using Host Headers is ok. But what if I want my website to come up if I type in the right IP address too?

    53. Re:Is this REALLY a problem? by r_cerq · · Score: 1

      if you had specific URIs in that site, or any unique header in the request (say, a specific user-agent) it could still be done. Other than that, just opening the IP address would fail (or it would be sent to a default "unidentifiable site" server)

      It's been a long time since I've seen a legitimate website (other than small and usually personal stuff) without a proper hostname, though.

    54. Re:Is this REALLY a problem? by Rich0 · · Score: 1

      That's exactly what it means. Thanks for completely conceding the precept. The map shown in link #1 of GGP is a map of those hosts who ping or have open ports. Its pretty darn sparse.

      Uh, could it be possible that a host not respond to any packets sent to it by a spider, and yet it accepts packets that are incoming from other hosts, and consequently needs a publicly-routable address?

      Also - wouldn't it be nice that when two mega-corporations merge that their networks could just be joined with no migration needed at all? That would be because their address spaces didn't collide - unlike what you get with non-routable addresses?

      NAT is a hack. It really isn't the way things ought to be.

      You're also neglecting that the big iron routers still suffer capacity and performance problems given the insane address length of IPv6. This has been and remains one of the principal barriers to deployment. IPv6 simply costs a heck of a lot more per route and per packet routed.

      I doubt it is the address length on its own that causes the problems. Most likely it is a failure to have optimized hardware to handle it - due to a lack of demand for this capability. The presentation linked in the original article states this. There is no reason that doubling the address length increases the routing complexity on its own. Now, if you hand out routes in an insane manner that would mess things up. However, having more breathing space should in theory make it EASIER to make nice consolidated routes. ISPs could request a single huge block of addresses and then split them up in a tidy way with plenty of room to grow. They wouldn't need to request them in blocks of 10-100k at a time and have a bazillion fragmented networks.

      There is no doubt that routes will only get more complex in the future, and that routing hardware will become more capable.

      I'm not suggesting that problems don't exist. However, turning the internet into a "network for networks" isn't really the solution (regardless of how it started). Maybe the internet would be better off without P2P, small servers, e-commerce, and games - but if that is how you feel why don't you just start your own internet? You won't have to worry about complex route tables if it is so featureless that nobody wants to bother to connect to it... :)

    55. Re:Is this REALLY a problem? by runningduck · · Score: 1

      This sounds very bunk. I do not deny that the presentation exists, just that the facts do not hold water. In 1998 I deployed a 3,000 workstation enterprise behind a single public IP address with no problems. Active connections were rarely more than 1500 concurrently. Over the years I decided to enforce TCP timeouts because I feared IE's aggressive half open behavior, but even being I never saw the active timeouts reaching more than 5,000 as a high water mark.

      --
      -rd
    56. Re:Is this REALLY a problem? by multi+io · · Score: 1

      Well, first of all, decoding application layer protocol information is too slow to be done on really large border routers. Second, if you do that, all routers will have to know all IP-based protocols (and even many TCP-based ones if they want to support connection initiation in both directions) they want to be able to route, which is basically impossible, kills end-to-end connectivity and (and this point is very important) prevents newcomers/startup companies from freely inventing new, innovative services and protocols on the net.

    57. Re:Is this REALLY a problem? by tzot · · Score: 1
      I have been given many, many mod points lately, and I spared them on mostly indifferent discussions. I wish I had mod points now; since there is no "FUD", an "overrated" would do fine.

      • 254 (2^8 - network - broadcast) usable addresses per class C network. Where this 251 comes from?
      • I've got the 192.168.1.42 address, and I have started two connections to 10.1.1.1, specified by the following two tuples:
        (192.168.1.42,17890,10.1.1.1,80) and
        (192.168.1.42,17890,10.1.1.1,22).
        One of them is a connection to a FTP server, the other is a connection to a SSH server. Both are valid, both are NATted fine, both work, even if the local port is the same. Learn what is the key to the NAT state table. Hint: it's not just an "external port number".
      I won't dispute the parent's math; I'm too flabbergasted to even continue. I'm sure further on others, too, dispute the parent's post.
      --
      I speak England very best
    58. Re:Is this REALLY a problem? by Courageous · · Score: 1

      And the correct answer to the question is: yes, but most people won't be able to get to it.

      For some definition of the word "most" so sufficiently close to "all" as to not particularly matter.
      Although, of course there are ways. Like Hamachi and the like.

      NAT = FIREWALL.

      There's a difference between truth in theory and truth in practice. I understand the truth in theory is that a NAT might even nat N:N, simply doing simple address translation, passing through ports and addresses, any NAT that is translating small N to large N will not be doing this, so indeed will basically be a firewall. While the ISP may elect to pass through a port on the limited N outside subset, this again is a technicality. They won't, or won't if you don't pay.

      So what I said was, as a matter of reduction to practice, correct.

      Just so you know. While you were correcting me, n' all.

      And with that, I'll give you an amusing todbit of philosophy, and it's source:

      "In theory, theory and practice are the same. In practice, they are not."

      --Winnie the Pooh

      C//

    59. Re:Is this REALLY a problem? by petermgreen · · Score: 1

      So every pr0n page view going through NAT takes 200 new external ports, with associated timeouts and state tables
      surely a good nat should be able to remove the entries from the table as soon as it sees the connection close at least for TCP (for UDP you have to rely on timeouts since there are no proper close messages).

      and if you wan't to be really clever you can reuse the same external port for multiple connections provided those connections have different targets.

      --
      note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
    60. Re:Is this REALLY a problem? by sjames · · Score: 1

      And if someone complains of an attack, all your security guys have to do is sift through all those logs and hope the 3rd party's clock isn't off by 10 minutes. Or w/ v6, they could just look at the logged IP and look up the MAC address in the asset tracking database. No matter how far off the clocks are, they would know unambiguously what machine produced the bad traffic.

      Meanwhile, NAT doesn't do anything for security that simple filters can't do just as well with less resources. Most places doing nat now will just drop incoming TCP traffic with the SYN flag set and UDP traffic that isn't related to a recent outgoing UDP packet (pretty much what NAT does anyway).

    61. Re:Is this REALLY a problem? by sjames · · Score: 1

      Now try that with SMTP, ssh, and ftp. Better yet, DNS.

    62. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      Exactly. It astounds (and saddens) me that people still think that NAT is in and of itself a security control. If hiding IP addresses makes any difference whatsoever in your security, you are seriously doing some things wrong.

    63. Re:Is this REALLY a problem? by t_ban · · Score: 1

      It is much worse for ISPs with home users, who are not limited by workplace rules against peer-2-peer for popular TV shows or looking at pr0n pages. If you look at the typical pr0n page (it was a tough job, but I did it in the spirit of improving my understanding of the industry ;-), there will be between 200 and 300 embedded elements or links to affiliate sites and advertising partners. So every pr0n page view going through NAT takes 200 new external ports, with associated timeouts and state tables. A typical pr0n user (I'm guessing here, you the /. reader can supply your own values), can open a dozen or more pages in tabs in a relatively short period of time, leading to 10s of thousands of entries in the NAT state table. Remember, you have 65,533 maximum entries in the state table for a single external IP, or for a typical saturday night in basement-dweller-land, about 4 machines.

      Well i don't know, but I set up this network for a friend of mine that has only one public ip on the gateway, and about 30 NAT-ed machines behind it. It's a popular web surfing shop in Calcutta, and stays filled up most of the time between 9 am and 10 pm. The gateway is a dual core AMD64 6000+ with 2 gigs of RAM running OpenSuSE 10.3. Customers do all sorts of things like IM, youtube, pr0n, MySpace and so forth. The setup has been running for a few months now, and I am yet to see as much as a hiccup. Caveats being it's only a 2MbPS line, and we're running a large transparent proxy cache. Still, it seems a far cry from your '4 machines maximum' calculation. I'm not challenging your formula, not being qualified to do so, but just giving you my personal experience which at least seems to contradict what you said. Care to enlighten?

      --
      First they ignore you. Then they laugh at you. Then they fight you. Then you win. -Gandhi
    64. Re:Is this REALLY a problem? by ewanm89 · · Score: 1

      Then how do I run webserver at home on my DSL, and then connect to it on my mobile phone while out?

    65. Re:Is this REALLY a problem? by amorsen · · Score: 1

      An absolute limit for 1 NAT can be worked mathematically. 2^16 TCP connections / (maximum TCP connections/user) = Maximum number of users, assuming TCP is the limiting factor (and assuming they all use this same mythical "maximum TCP connections"). There is no limit of 2^16 TCP connections, unless they all happen to be to say www.yahoo.com, and www.yahoo.com only resolves to one IP address.
      --
      Finally! A year of moderation! Ready for 2019?
    66. Re:Is this REALLY a problem? by a_nonamiss · · Score: 1

      Your hubris is unjustified. I have personally seen a (rather beefy) Linux router that had 150 - 200 users at any given time on a single public IP, and ran fine. My friend was re-selling wireless Internet access at a campground, so it's likely that at least 4 out of every 5 of those connections were surfing porn.

      I've admittedly been out of the Cisco game for a few years, but as of 2002 or so, most of their equipment was running 368 and 486 level processors with a few megabytes of RAM. That's much more likely the problem in your example. My friend's Linux box was a dual processor high end XEON with 4GB of RAM. He ran these connections through NAT as well as a SNORT firewall, and the load on the box stayed relatively low. Also, the NAT software has a lot to do with it. On the linux distro that I use (ClarkConnect) the NAT table expires the states in like 2 minutes. Unless you're running persistent services on these machines, I think each user would have trouble keeping 300+ connections up all the time. That's not saying that they couldn't get 1000 connections up for a short period, but for 200 users to keep 300 connections up for any length of time would likely take some sort of organized effort. Plus if they're surfing porn, their high level of activity probably doesn't last more than 5 minutes.

      --
      -Arthur
      Cave ne ante ullas catapultas ambules
    67. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      When I left school I thought NAT was the greatest thing in the world aside from sliced bread.

      I don't buy sliced bread (from the supermarket), give me fresh bread any time. About NAT, there is no problem as long as you use proxies (for client/server traffic) -or- use meeting points or setup port forwarding (for P2P traffic). If a traffic in your LAN can not tunnel trough proxies or uses a modern P2P protocol that can negotiate a peer to peer route, that traffic should probably not be allowed. Let me give an exmaple, I run a server and use bittorent all the time.... behind NAT. I don't see any real advantage of IPv6 and I can't understand the recurring "we are running out of IPv4 addresses". Maybe it is time for IPv6 when we really need it?

    68. Re:Is this REALLY a problem? by joshv · · Score: 1

      I am not terribly worried about ISP NATing. Besides, one IP per housesold doesn't consume but a tiny fraction of the overall addresses. Even if ISPs began regularly NATing their customers, services would spring up to allow you to serve content via a persistent tunnel to somebody who is publicly routable. Or gosh, the ISPs could do the forwarding themselves for a fee. If there is a demand, people will find a way, but I'd guess far less than 1% of ISP customers are running any sort of publically addressable service on their PC.

    69. Re:Is this REALLY a problem? by misleb · · Score: 1

      One for each of the two redundant routers the gateway VIP is on ?


      Nah, the addresses are for the NSA and DHS wiretaps. Turns out that listening to your internet traffic isn't enough. They want to know what's on your LAN!

      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    70. Re:Is this REALLY a problem? by misleb · · Score: 1

      Actually if your ISP has a decent proxy server and especially if you are using HTTP keepalive, your web traffic gets consolidated before the NAT kicks in.


      How common is this? I know AOL does it, but when I tried to implement transparent proxying it seemed problematic. From what I understand, it violates the way HTTP is supposed to work.

      Anyway, even without proxying, clients generally don't keep many simutaneous connections. And even if they did, I believe most NAT gateways can overload external ports as well as addresses. You can match up a destination IP with a port and have two translations using the same external port as long as they are to different destinations.

      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    71. Re:Is this REALLY a problem? by misleb · · Score: 1

      Plus if they're surfing porn, their high level of activity probably doesn't last more than 5 minutes.


      Yes, their "high level of activity" :-)
      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    72. Re:Is this REALLY a problem? by r_cerq · · Score: 1

      I have deployed similar solutions for SMTP, POP3, and DNS. ssh, not really (but in the case of SSH, you usually want to reach a specific machine, instead of accessing a certain service).

      In the case of DNS (resolvers), we split internal domains to a server group, the most common ccTLDs to another specific server group, and the rest of them, which represent lower loads, to a weaker set of servers.

      SMTP and POP3 both require the load-balancers to have a minimal knowledge of the protocol. They respond to the initial part of the conversation on their own, up until the point where they identify the correct server farm (by domain in the RCPT TO/USER commands). Once that's been caught, the connection is passed to the final server, and the previous parts of the conversation replayed; from that point on, it's the real server who's answering.

      This doesn't really scale well, though, as it requires large (for a switch) amounts of memory. We ended up doing this sort of split in the servers themselves; even then, from the Internet's perspective, it's still a single IP acting as the SMTP server.

    73. Re:Is this REALLY a problem? by r_cerq · · Score: 1

      Well, first of all, decoding application layer protocol information is too slow to be done on really large border routers.

      Agreed. It's perfectly feasible on data-center edge switches, though. Why use 30 public IP addresses in a set of MXs when a single one will do? Why use multiple IPs to split websites by technology (say, one IP for the IIS server that hosts the ASPs, one for the apache that hosts the PHP, and one for the plain-jane HTML hosting) when the switch can look into the URI, see the .asp/.php/.html extension and deliver the connection to the right server? Unless the requirements are ridiculously high, it can be done.

      Second, if you do that, all routers will have to know all IP-based protocols (and even many TCP-based ones if they want to support connection initiation in both directions) they want to be able to route, which is basically impossible, kills end-to-end connectivity and (and this point is very important) prevents newcomers/startup companies from freely inventing new, innovative services and protocols on the net.

      Again... Agreed. Protocol-based "routing" isn't a magic bullet, and there's a lot of situations where it doesn't apply. However, it _can_ be used to solve a lot of the current address-space waste, especially for simpler and well-established protocols. Webservers, mail servers, and DNS servers come to mind. In ISPs, there's no need to keep DHCP and RADIUS servers, BAS, NAS, or DSLAM in public IP spaces, yet many do so.

      OTOH, the major consumption, at least where I work, doesn't come from these areas: it's the increase in customers, and the habit of giving each and every user connection a public IP address; why do UMTS-enabled cell-phones need a public IP? Or GSM-enabled tracking devices? Or even most of the residential-market ADSL / Fiber / dial-up connections? We're getting around 4 new /16s every year (and using them), and we're not that big, so I can easily understand where the quoted 17 /8s went to. What I don't understand is why ISPs and telcos keep using public addresses everywhere...

    74. Re:Is this REALLY a problem? by sjames · · Score: 1

      Now, imagine how popular that will be if the domains in question are related only by their choice of colo facillity. It will be particularly bad if you want to do authenticated relaying.

      As you say yourself, it doesn't scale well, so it wouldn't help for long at the current rate of growth, especially since it will do nothing at all for a newly developed application.

      Given those issues, moving to V6 looks pretty good. The big problem in general of course is that v6 only public servers aren't much good until the clients support it, but there's not much individual incentive to take the needed steps for the average net user.

      For now, it will probably be done by businesses that need or want a cleaner infrastructure for internal servers (especially when teleworkers are involved).

    75. Re:Is this REALLY a problem? by Bryansix · · Score: 1

      That's not the point though. The point is to prevent censorship through allowing websites to come up with a simple ip address.

    76. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      There is no reason that doubling the address length increases the routing complexity on its own.

      "quadrupling". IPv6 addresses are 128 bits; IPv4 addresses are 32 bits.

    77. Re:Is this REALLY a problem? by Anonymous Coward · · Score: 0

      Take a look, its shockingly sparse

      "look; it's".

      Instead of just po-poing NAT

      "poo-pooing".

  8. simple: ip cohabitation by circletimessquare · · Score: 4, Funny

    i'm sharing my blog ip address with a porn site dedicated to a fetish for women with moustaches, some guy's home security system in hong kong, a government bureaucrat's cell phone in helsinki, and an email server for a truck dispatching company waco texas

    i think it's also a pretty good premise for a reality show or situation comedy

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    1. Re:simple: ip cohabitation by Anonymous Coward · · Score: 0

      women with moustaches You leave my mom out of this!
    2. Re:simple: ip cohabitation by PrescriptionWarning · · Score: 1

      I don't think he's your mom.

    3. Re:simple: ip cohabitation by pumpkinescobarsof2 · · Score: 1

      lol, that's a great idea for a tv show

      or maybe expand it to the data center, call it 'the colo' and totally rip-off 'the office'

  9. Just buy a cheap SOHO router by blake1 · · Score: 5, Funny

    And put China behind it. IPv4 addresses, plenty. Botnet problem, solved.

    1. Re:Just buy a cheap SOHO router by killmofasta · · Score: 1

      Mod parent +2 funny. That was good. Really really good!

    2. Re:Just buy a cheap SOHO router by nitehawk214 · · Score: 1

      > Mod parent +2 funny. That was good. Really really good!

      But don't mod him +3 funny. It wasn't that good?

      --
      I'm a good cook. I'm a fantastic eater. - Steven Brust
    3. Re:Just buy a cheap SOHO router by sakdoctor · · Score: 1

      If you do that, China will just make its own internet. Without blackjack, or hookers.

    4. Re:Just buy a cheap SOHO router by killmofasta · · Score: 1

      It didnt hit the 10+ minute laugh, and try to call someone while Im chokeing type laugh. It was a long and loud laugh though. It was good though...

      Put china behind a NAT... hahahhahahhaha! Stop spambots .... hahahhahahhahah
      It is a subtile and good joke.

    5. Re:Just buy a cheap SOHO router by calebt3 · · Score: 1

      I am failing to see a downside. What better way for them to implement their Great Firewall (not that we want that) than to make a private internet?

  10. Hardware compatibility and updating. by rfelsburg · · Score: 2, Interesting

    The shift will also depend on hardware vendors making sure that their hardware is completely ipv6 compatible. Even with quite a few vendors saying that their stuff is compatible, I know of a quite a few major bugs still lurking with those same vendors. Not many large companies are going to switch to IPv6 until they need to upgrade hardware, if their existing hardware is only IPv4 compatible.

  11. Randy Bush? by Anonymous Coward · · Score: 0

    My girlfriend's "pet name" is Randy Bush!

    1. Re:Randy Bush? by Anonymous Coward · · Score: 0

      I don't think you have a girlfriend. Enjoy your pet.

  12. host header? by circletimessquare · · Score: 0

    would it be feasible to host, for example, 100 different websites on one ip using header information? or does that have traffic spike issues/ latency issues/ wasted cycles involved?

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    1. Re:host header? by thegameiam · · Score: 1

      Lots of folks do this: google "virtual hosting" - it's been around since the mid-90s.

      However, it doesn't solve the depletion problem, becuase most of the depletion comes from access users not content providers.

      --
      Need Geek Rock? Try The Franchise!
    2. Re:host header? by fbjon · · Score: 1

      Yes. In fact a lot of hosts and web site farms do that already (private IP costs extra), and we're still running out.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    3. Re:host header? by Lord_Sintra · · Score: 1

      My website shares it's IP with ~360 other people. But you can only do it for smallish sites.

  13. Time for the Government(s)? by grumbel · · Score: 5, Interesting

    One thing is rather clear to me: We won't run out of IPv4 addresses anytime soon, instead the price will increase more and more and thus people will end up behind ISP enforced NATs, because IPs are to expensive for the average consumer. This is after all already the case, at least in part, static IPs are a premium service, not something you get for free from most ISPs.

    So how to fix this? How about some good old government regulation? If you want to provide a "Internet service", you have to provide IPv6 or you can't call it "Internet". With a little force it shouldn't take all that long till the switch to IPv6 is done. But unless that happens the rarity of IPv4 addresses will simply be seen as a nice way to make money, instead of a problem that needs to be fixed.

    1. Re:Time for the Government(s)? by zsau · · Score: 5, Funny

      Or just ban porn sites from using IPv4. Everyone's happy then: Think of the Children types will have porn apparently banned, techies will see IPv6 adopted widely, and civil liberties types will have porn available if they want it.

      --
      Look out!
    2. Re:Time for the Government(s)? by saider · · Score: 1

      Governments need not legislate, but rather simply direct their IT departments to require IPv6 from their service providers. They can use their purchasing power to stimulate change. The federal and a few state governments is all it would take to make this happen.

      If they legislate it, then we would really be stuck with IPv6. Imagine trying to update to the next version, when there is a law on the books holding you back.

      --


      Remember, You are unique...just like everyone else.
    3. Re:Time for the Government(s)? by lys1123 · · Score: 1

      So to get this resolved in a timely and efficient manner, we should get governments (all of them maybe?!?) involved. With the track record of government involvement I am amazed that no one else thought of this!

    4. Re:Time for the Government(s)? by poot_rootbeer · · Score: 1

      This is after all already the case, at least in part, static IPs are a premium service, not something you get for free from most ISPs.

      Unless I'm running a server off my residential broadband connection -- something forbidden by the TOS of most residential ISPs -- or need to interact with some poorly-configured remote service that uses IP address for authentication, I don't need my home computer's IP address to be static. (And in the former case, I could always sign up for some dynamic DNS service.)

      As long as my household gets a public IP from the ISP, I don't care whether it's static or dynamically-assigned. Browsing the web works pretty much the same with either.

    5. Re:Time for the Government(s)? by Timinithis · · Score: 1

      Actually, time for the *AA's to step in. Right now, it is hard to "prove" that it was you that downloaded their material -- it could be anyone from your ISP with that IP, right?

      Well, with IPv6, the ISPs can now permanently assign an IP to each customer and not run out! Why the *AAs are not behind moving to IPv6 has me stumped. I would think anything that would help support their current business model would be good.

      Perhaps it would cost too much to purchase enough Congresscritters to make IPv6 a reality?

      --
      Sig? What's a Sig?
    6. Re:Time for the Government(s)? by Thelasko · · Score: 1

      Yes, I mean the US government has been so good at mandating the switchover of standards. I mean the Metric Conversion Act of 1975 worked flawlessly. The end of analogue TV in the US happened in 2006 exactly as the FCC mandated in 1997.

      I do think the best thing the FCC did for the digital television switchover is to make the sales of analogue TVs illegal. The same should be done for IPv6.

      --
      One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
    7. Re:Time for the Government(s)? by mea37 · · Score: 1

      Right now, it is hard to "prove" that it was you that downloaded their material -- it could be anyone from your ISP with that IP, right?

      Not exactly. Yes, the IP may change hands among all users of your ISP; however, at any given point in time, it is in one person's hands, and the ISP knows who that one person is.

      IP + time does accurately identifiy the subscriber account used to obtain internet access by the computer being used to, in your example, download copyrighted material. That's not the problem with it -- the problem is that knowing what subscriber account was used doesn't prove who actually infringed the copyright (unless you buy into the idea that TOS can assign all civil and criminal liability with language like 'you are responsible for how your connection is used', which I don't).

    8. Re:Time for the Government(s)? by dwye · · Score: 1

      > So how to fix this? How about some good old government regulation?

      Which government, pray tell? Will China bow to the USA government mandate to abandon their IPv4 ranges (although it would make great sense, given the desire to keep their people behind the Great Firewall)?

      Anyway, the Internet isn't really under government control on a day-to-day basis, it is a feudal system under loose control by the great monarchs (i.e., the owners of the backbone services and links), advised by the various organizations (IETF, IANA, IAB, etc.), to which they sometimes have ambassadors or servants.

      > If you want to provide a "Internet service", you have to provide IPv6 or you can't call it "Internet".

      So the Not-legally-allowed-to-call-itself-an-ISP sells not-allowed-to-be-called-internet-service which happens to be perfectly compatible with "internet service" -- not a solution.

      Furthermore, IPv4 fits into a small area of IPv6. The problem will continue until some major player decides to jump into the non-IPv4 addresses in IPv6 and reduce their old footprint to one or two (or 100 or 200) "public" addresses, AND TELLS EVERYONE ABOUT IT. I would be amazed if MIT, Stanford, IBM, or any of the other major computer research sites are not already internally IPv6-ready (for the most part; cell phones and coke machines, probably not), but no one knows because they are still in their IPv4-compatible address range.

    9. Re:Time for the Government(s)? by Anonymous Coward · · Score: 0

      After all, the only ones who would "suffer" from a move to IPv6 are the ISPs - everybody else wins big time. Of course based on the government's record with controlling the telcos, who are now mostly the same as the ISPs, I don't think this is likely to happen.

    10. Re:Time for the Government(s)? by WallyDrinkBeer · · Score: 1

      Get comcast to block anyone using IP addresses on their network. After all, according to comcast's logic, it would count as a valid network management procedure.

    11. Re:Time for the Government(s)? by vidarh · · Score: 1
      Most users don't need a public IP from their ISP either. MORE users need a public IP than need a static IP, though, so it's a service that'd need to be easier to enable. Just defaulting to giving people a private address but having a website to switch on public IP for a $1/month or something would make a huge difference - I doubt most people would ever notice they were running on a private IP.

      A huge percentage of users are behind routers that NAT anyway, and don't notice or even know if their router supports port translation or default forwarding of incoming connections.

    12. Re:Time for the Government(s)? by Anonymous Coward · · Score: 0

      http://www.ipv6porn.com/ seems on topic.

  14. Bad, but not fatal by Anonymous Coward · · Score: 2, Informative

    There are measures in place to try and aid in conservation as the migration occurs. RFC 3021 provides the ability to utilize /31 address space on point to point links instead of a /30. This will literally halve address utilization by point to point links (a significant use of space among carriers). It requires some work to renumber, but following that, space can be re-allocated for other things. Cores can also be built into v6 space before transported networks killing more space. Private space can be utilized for equipment management instead of utilizing public addresses for everything. There are many ways that at least on the carrier side, this can be pushed off a bit with a little work, while the v6 migration continues. Carriers are crafty, they will find a way to make it work.

    All of that said, that just means I think we will find a way to get by until V6 is fully in place. Not that we should forgo finishing V6 migrations.

  15. America Will reign supreme! by 140Mandak262Jamuna · · Score: 4, Funny

    America will then become the Saudi Arabia of ip addresses. Price of oil will drop to something 200,000,000 barrels for one address. Woot!

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:America Will reign supreme! by Jesus_666 · · Score: 1

      Then Europe will switch over to IPv6 and use the newly-gained addresses to seize control of the world oil market. We don't really know what to do with all that oil, but we'll probably come up with something. Probbly oil-based ink for new legislation drafts; the world's entire supply of oil should be enough for up to one year's worth of European legal texts.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
  16. People are starting to work on solutions by Anonymous Coward · · Score: 5, Informative

    The basic solution to this problem is to deploy IPv6 as soon as you can, figure out what problems remain to be solved before you can use IPv6 100% and then put pressure on your ISPs, vendors, etc. to solve these problems. That's how the Internet grew like topsy in the first place, and its not too late to get this going. Two to three years is enough time.

    ARIN has published a web site which collects information about how to move to IPv6 here: http://www.getipv6.info/
    It's oriented towards the things that ISPs and other service providers (hosting centers, large IT depts) need to do to get IPv6 working in production.

    Soon, the stock market analysts will be asking the big ISPs and telecom companies what actions they are taking to avoid going bankrupt in two years when the crunch hits. Any company that can't get new IPv4 addresses will have to stop growing their IPv4 networks. If they have an IPv6 network to take up the slack, no problem. If not, then customers will flock to the providers that have IPv6 ready to roll.

    There was a network operator meeting at NANOG recently where they showed that it is almost possible to provide full Internet access, both IPv4 and IPV6, using an IPv6 connection. Yes, I know, "almost" means there were problems, but they were not massive problems. They were the kind of things that people were working on fixing with IPv4 networks back in the early 90's. And they did that because they went ahead and built IPv4 networks and tried to make them work for everything imaginable. When things broke, they fixed the bugs and moved on, eventually becoming the global Internet that we know today.

    There is a way to avoid going bust when the address crunch hits in two-to-three years and that is: Get yourself IPv6 Ready!

    1. Re:People are starting to work on solutions by Just+Some+Guy · · Score: 1

      ARIN has published a web site which collects information about how to move to IPv6 here: http://www.getipv6.info/

      .info? Seriously? ARIN couldn't afford a domain that didn't scream "Beware of the Leopard"?

      --
      Dewey, what part of this looks like authorities should be involved?
  17. The IPv6 mess by philippic · · Score: 2, Informative

    I think this article by Dan Bernstein is a pretty good read regarding this subject.

    1. Re:The IPv6 mess by Anonymous Coward · · Score: 0

      I agree it is a good article; however, it misses one thing: they are asking us to go from an 11 digit phone number where the first 3 digits are usually either the same or from a very small pool of 3 digit numbers to a 44 digit phone number. I like his idea that all IP4 address should map to a IP6 address but I would expand that so that the IP4 address map regionally to IP6 address. Within a region, you can use IP4. Outside the region, you must use IP6. My address translates transparently to IP6; the destination address alos translates transparently -- DNS takes care of it.

      Similar to the phone number situation. Until a few years ago, I called someone in my city with a 7 digit number. I called someone in my country with an 11 digit number. And I called someone else in the world with a whole bunch of digits -- something I rarely did. I had a world phone number but I never had to think about it on a day to day basis. IP4/IP6 should be the same way!

    2. Re:The IPv6 mess by rs79 · · Score: 0

      "I think this article by Dan Bernstein is a pretty good read regarding this subject - http://cr.yp.to/djbdns/ipv6mess.html"

      Bernstein is quite right as always, but you don't care and unlike Bush, don't need to panic. There's lots of milage left in the protocol and those that think we're running out of addresses just aren't looking at the packet headers. They're in meetings instead.

      http://rs79.vrx.net/interests/computers/net/v6failure/

      This is a non-issue.

      --
      Need Mercedes parts ?
  18. And? by SmallFurryCreature · · Score: 4, Interesting

    That is one way to do it, keep patching it up and hope it becomes somebodies elses problem.

    The problem is simple, the way we want to use the internet means we are getting more and more devices which desire their own internet adress. Some people suggest solutions like NAT but these only have so many uses especially when mobile phones become internet capable. If you want your internet node to be independent then you need an ip adress.

    Don't believe me? Fine, give up your internet connection with its own IP and use the NAT solution of your ISP. Good luck running a torrent.

    We could easily solve the entire problem if we just used NAT for every major ISP. It would free up countless adresses and keep IP4 usuable for decades rather then years.

    So who is first? Who is going to give up their IP for their home for the greater good?

    Thought as much, absolutly nobody.

    It is the problem with humans, we don't want new power installations, we don't want to use less power and we refuse to switch to more economical appliances. Something has to give, but goverment or business is NOT going to do it. Sooner or later it just breaks down (see the LA brownouts) and finally a decission will have to be made.

    Same with a solution to IP4 limited adress space. We will keep coming up with patches and ignore the problem until finally it can no longer be ignored and then we will have to really bite down to implement it at great cost and inconvenience when we could have solved it easily right now.

    Because lets be honest, it ain't all that much of a problem. In the EU we switched currencies. A hell of a job but because it became accepted that it had to be done, it just happened.

    We could easily do a switch to IP6 but only when the majority just accepts that it has to be done, and bites the bullet.

    Analog mobile phones no longer work in the US, holland no longer airs analog tv signals, switches happen all the time. It is nothing special, but in each case somebody just had to say "we are switching and if you are not ready, though".

    So what if countless devices will no longer work, at a given point you just have to be able to say "upgrade or be left behind" or you will be forced to increasinly bend over backwards to accomadate out of date tech.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

    1. Re:And? by powerlord · · Score: 1

      So what if countless devices will no longer work, at a given point you just have to be able to say "upgrade or be left behind" or you will be forced to increasinly bend over backwards to accomadate out of date tech.


      Sounds like a Marketing Slogan Intel and MicroSoft could really get behind. :)

      Heck, it might even help Vista's adoption rate.
      --
      This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
    2. Re:And? by Sancho · · Score: 1

      So who is first? Who is going to give up their IP for their home for the greater good?

      Thought as much, absolutly nobody. I'd do it. The only service I run from home is SSH, and I could do without that given my co-lo. Most moms and pops and grandmas who only use the Internet for browsing the web and sending e-mail could do it, too. Heck, they'd probably never notice.

      It could be marketed pretty well, to boot. It's a free firewall, free virus protection, free RIAA protection. Real IPs could be leased at a higher rate, meaning the ISP makes more money.

      Of course, I don't really want this to happen, but mostly because I'd like to see us get on with it and implement IPV6. I'm getting tired of all of the hoopla in the headlines.
    3. Re:And? by Tony+Hoyle · · Score: 1

      It'll happen sooner rather than later.

      Most mobile phones are on 10/8 address space nowadays, and I don't see anyone noticing. I reckon an ISP could do that (advertising the free firewalling, etc. as you mention) and 99% of users simply wouldn't notice.

    4. Re:And? by pebs · · Score: 1

      Don't believe me? Fine, give up your internet connection with its own IP and use the NAT solution of your ISP. Good luck running a torrent.

      We could easily solve the entire problem if we just used NAT for every major ISP. It would free up countless adresses and keep IP4 usuable for decades rather then years.

      So who is first? Who is going to give up their IP for their home for the greater good?


      I'd be ok with that if I got a small block of ports that were reserved for me (for SSH and torrents). And ideally get a discount.

      --
      #!/
    5. Re:And? by Anonymous Coward · · Score: 0

      My ISP uses NAT right now and I'm as happy as a clam.

      I don't need nor do I use bitTorrent.

      And if I wanted to run a server, all I'd have to do is implement the following:

      1) Periodically, software in CRON determines my current IP address, then it logs into an account via SSH and uploads it to a config file on some hosted server somewhere, and

      2) The client software for my server (say, a Java client I'm using on a laptop, on vacation at a hotel) logs into the same account via SSH and checks the hosted server to see the current address of my home server, then uploads ITS IP address back to the hosted server, and

      3) While the client software is setting up its connection (it retries until connected), the home server has already logged in and checked the hosted server to see which IP address the client is using, opening up the firewall for that IP address.

      BENEFITS:

      1) The ISP doesn't know you're running a server, because its scans are rejected by the firewall.

      2) Nobody but you (and those you permit) can access the server because the firewall only lets specified IP addresses in, and those are governed by the accounts you create so people can access your server.

      3) It all works with NAT and is practically invisible to the internet as a whole.

      Who says you can't learn from the black hats, and apply it in lawful and socially-acceptable ways?

    6. Re:And? by Znork · · Score: 1

      We could easily do a switch to IP6 but only when the majority just accepts that it has to be done, and bites the bullet.

      Frankly you don't even need a majority to do it, you can extend with v6 capability on your own. I've switched to IPv6. I had to look up the SI prefix for the number of addresses that are _mine_ now (1 yottaadresses or something). Mine mine mine. Um.

      Anyways. For those who can be bothered to it's not that hard. Get a tunnel from sixxs.net or set up 6to4. IPv4 will still work fine, but suddenly you can have as many fixed adresses you want. Very nice to be able to ssh and scp directly to nodes behind a NAT. And, of course, it gives you the right to smugly outdo your geek friends with your immense address range.

    7. Re:And? by Tony+Hoyle · · Score: 1

      Then you've not switched - you still have an ipv4 address (if you didn't you couldn't even see slashdot.org). By switched people mean switch ipv4 off.

      Most ISPs do not route 6to4 so that's out. sixxs.net is as unreliable as hell (I had a sixxs tunnel for 6 months. The London pop was down for 4 of them)... not really an option for most.

    8. Re:And? by vidarh · · Score: 1
      I don't think you understand what the GP meant. If your ISP NAT's you, you have no way of just "opening your firewall" to let a client connect back in, because you'd have no way of passing data too your firewall without etablishing a connection from the inside.

      My home network is NAT'd, and yes, I can do what you describe, but the router I'm connected to my ISP via has a public IP address and supports NAT with port translation etc. If my router hadn't had a public IP address, there'd be no way for me to transparently connect to it from outside my ISP's nework.

    9. Re:And? by Bert64 · · Score: 1

      The trouble is, there is no single entity in control of the internet.
      Changing a currency in a country, or turning off analog tv is pretty easy. The government can simply order it to be done. This won't work on the internet, any country forcing the use of V6 will effectively be cut off from everywhere else.
      What could be done however, is require that any device with a V4 address also has a V6 address. Any networking device being sold must support V6. Any ISP supplying connectivity must supply V6 etc... Force everyone to go dual stack, and then phase out V4 at a later date. It's not until everyone uses v6 that anyone will even consider dropping V4.

      The current state is terrible. I don't know of any consumer level broadband routers which support V6, I had to buy a Cisco device to get V6 support. I only know of 2 ISPs which provide IPv6 over DSL, and none who provide it over cable... And relatively few who provide it for hosted services in a datacenter.
      And having spoken to a friend at the ISP i use, of roughly 1000 users connected to a DSL access node, 2 have IPv6 fully active and routed (him and me), and 3 more have IPv6 capable devices but aren't using the capability.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    10. Re:And? by Frank+T.+Lofaro+Jr. · · Score: 3, Insightful

      Anybody can use Linux for routing, or if they need something better, they use Cisco.

      Both support IPv6.

      When IPv4 runs critically short of addresses, give people a NAT'd IPv4 address and a real IPv6 address.

      They can switch to IPv6 if they want/need to, and they won't have a leg to stand on if they don't like it.

      --
      Just because it CAN be done, doesn't mean it should!
    11. Re:And? by Anonymous Coward · · Score: 0

      Ah. In that case, modify the suggestion thusly:

      1) The client stores its IP address on the shared hosted site after logging in, then waits for an incoming connection from the server.

      2) The server looks up the client IP address on the shared hosted site after logging in, then opens a stream socket to the client computer.

      3) IF THE CLIENT COMPUTER IS ALSO NAT'ed, as the case may be, then put a servlet on the shared computer that exists only to foward packets back and forth. Then the client AND the server are BOTH enjoying an outgoing connection.

      Actually this idea is probably the best one. Just create some kind of central traffic cop so the client and the server can both connect to it with outgoing connections. Hmm... I think I'll make me one of these!

    12. Re:And? by Shotgun · · Score: 1

      It is the problem with humans, we don't want new power installations, we don't want to use less power and we refuse to switch to more economical appliances. Something has to give, but goverment or business is NOT going to do it. Sooner or later it just breaks down (see the LA brownouts) and finally a decission will have to be made.

      Which is absolutely the way it should be, because it maximizes efficiency.

      -What happens when we spend all the time switching to IPv6, and IP registrations drop off to nothing tomorrow? Right now, IP registrations would be at a peak rate, because no one has them. Everyone wants to get them at once. Once everyone has one, the demand drops to nothing. Projecting current rates into the future is a fool's game. In 2000, the feds were predicting the the US Federal Deficit would be paid off by 2020 or something silly like that. They were using figures from an economy that was on megaSteroids, induced by Y2K buying and an Internet bubble (among other things). It was stupid to predict current economic activity that far into the future, and it is silly to predict the end of IPv4 address on nothing more than current trends.

      --
      Aah, change is good. -- Rafiki
      Yeah, but it ain't easy. -- Simba
    13. Re:And? by Rich0 · · Score: 1

      Uh, I don't think you understand what is being proposed:

      1) Periodically, software in CRON determines my current IP address, then it logs into an account via SSH and uploads it to a config file on some hosted server somewhere, and

      Ok, your home computer (or router - whatever connects to your ISP directly) has the IP 192.168.234.123. You upload that.

      2) The client software for my server (say, a Java client I'm using on a laptop, on vacation at a hotel) logs into the same account via SSH and checks the hosted server to see the current address of my home server, then uploads ITS IP address back to the hosted server, and

      Ok, your laptop in the hotel knows your home is at 192.168.234.123. Your laptop has the address 192.168.123.234. It uploads that.

      3) While the client software is setting up its connection (it retries until connected), the home server has already logged in and checked the hosted server to see which IP address the client is using, opening up the firewall for that IP address.


      Ok, your home firewall is opened up to 192.168.123.234. Too bad the incoming connections would be coming from 192.168.234.001 - the NAT router at its ISP. EVERY incoming connection would be coming from there. But, that isn't the problem since you won't be getting any incoming connections at all. That's because when your laptop tries to open a connection to 192.168.123.234 the hotel filters it because that isn't a routable internet address.

      The only exposure most people have to NAT is when their home firewall gets a routable IP and then issues non-routable IPs internally. That works fine because you own the firewall with the routable IP, and you can forward any ports that you'd like.

      Now, imagine that I set up a router in your home. It is a black box to you - it hands out 192.168.x.y addresses to anything in your house, and doesn't forward anything to you. You can't even find out what IP it has from upstream because it won't tell you. Now you can't run anything - the only way you can find out your public IP is to connect to something else that does have a public IP and ask it where you seem to be coming from. However, that won't do you good since the NAT router will drop any incoming connections to that IP.

      The only way you could do what you want to do is to set up some kind of tunnel on a routable host. Both sides of the link would connect out to the proxy, and then the proxy would forward packets between the connections. It would work, but only with a lot of hacking. It would be difficult to use standard web tools and your aunt edna definitely couldn't connect to your home web server...

    14. Re:And? by Anonymous Coward · · Score: 0

      I'd give up my "routable" IP address for a NAT-ed one if NAT was done right.

      Right now, NAT is a flat-level system. Requests from behind NAT are translated to a "public" IP. When a response comes back, the NAT router sends it on to the "private" IP. Unfortunately, this breaks down easily and is a pain in the butt when routing any non-trivial amount of traffic. An example for later reference: 192.168.1.2 sends through 192.168.1.1 (which is actually 203.24.85.2) and a response comes back to 203.24.85.2 on the port opened for 192.168.1.2.

      NAT-Done-Right would be more on the order of creating a namespace. A NAT-D-R router would simply prepend its own "public" addressing info to the "private" response address. Compare this example to the previous one: 192.168.1.2 sends through 192.168.1.1 (which is actually 203.24.85.2), the same as before. But 203.24.85.2 passes the request on with a return address of 203.24.85.2:192.168.1.2. When the response comes back, it gets routed to the first valid segment in the return address, 203.24.85.2. When it reaches that NAT-D-R router, it forwards it to 192.168.1.2. Of course, a DNS record could be set up for a huge chain of IP addresses, guiding requests straight to an individual machine at a location of a company using an ISP using a larger ISP attached to a backbone. I count 6 levels of nested NAT routers there, without a huge routing problems or limits on addresses.

    15. Re:And? by Znork · · Score: 1

      you still have an ipv4 address

      Currently it's most practical to keep it for legacy applications.

      if you didn't you couldn't even see slashdot.org

      Sure, and without NAT I couldnt see slashdot.org from this computer either. Routing ipv4 traffic through an address translator isnt exactly new, and doing the same thing (but mangling a few more headers) once you're v6 only isn't that different.

      Yes, as long as someone, somewhere has v4 only, someone somewhere else has to have a v4 and v6 adress to provide a gateway. I could do it myself and kill ipv4 completely on my internal network, but frankly, I have no need to.

      Running v6 only at this point is something you could do to prove you can, but frankly it'd be more bother than it's worth. Running both I get the advantages of v6 without having to worry about legacy connectivity issues.

      Most ISPs do not route 6to4 so that's out.

      Here I have yet to find an ISP that doesn't. The ones I've tried route to 192.88.99.1 without any problem. Call your ISP and complain, they obviously have some routing issues.

    16. Re:And? by PitaBred · · Score: 1

      And you're a moron, because we're talking about that IP address that you so easily determine with your cron job would GO AWAY. It'd be a non-world-routable private IP.

      IPv6 isn't a solution in search of a problem. The problem is quite real... it's just a matter of time before we embrace the solution.

    17. Re:And? by dafunn · · Score: 1

      The only way you could do what you want to do is to set up some kind of tunnel on a routable host. Both sides of the link would connect out to the proxy, and then the proxy would forward packets between the connections. It would work, but only with a lot of hacking. It would be difficult to use standard web tools and your aunt edna definitely couldn't connect to your home web server... It's really not that difficult to set up the tunnel you're describing - OpenVPN comes to mind.

      And, yes, as you point out that still does nothing to allow public inbound connections to your home web server.
    18. Re:And? by Cramer · · Score: 1

      Both support IPv6.
      IN SOFTWARE. That's generally ok for linux machines. However, that's not ok for "real routers" as they do almost everything with dedicated hardware; they have very small, cheap, underpowered processors for dealing with thousands of packets per second. Go build yourself a linux router out of an old 386 and see how well it deals with IPv6 -- I can tell you from experience, the answer is "poorly." IPv6 means new switching hardware, substantially faster processors, and significantly more memory. Just because I can load IPv6 aware software on a Cisco 1601 doesn't mean it's a good plan to do so.
    19. Re:And? by Anonymous Coward · · Score: 0

      [blockquote]It is the problem with humans[/blockquote]

      Fuck you, there's nothing wrong with me. And there is no "problem with humans."

    20. Re:And? by Bert64 · · Score: 1

      And what will the first people do with v6? nothing, they will just complain loudly about it.
      Everyone should be given both V4/V6 right now, so that by the time V4 is critically short there are actually a significant proportion of sites worth visiting on V6.
      Some legislation to demand ISPs supply V6 alongside any deployment of V4 would be very welcome, and should really have been implemented a few years ago.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    21. Re:And? by SJS · · Score: 1

      The only way you could do what you want to do is to set up some kind of tunnel on a routable host. Both sides of the link would connect out to the proxy, and then the proxy would forward packets between the connections. It would work, but only with a lot of hacking. It would be difficult to use standard web tools and your aunt edna definitely couldn't connect to your home web server...

      The problem with asserting that some solution is the only way is that the assertion is hard to prove (and often not true). It's a sign of arrogance, just like the old-time "we might as well close the patent office because everything worthwhile has been invented" thinking we like to laugh at.

      NAT at the ISP level can be done and still leave me the ability to connect to my home server, all without some external proxy. Figuring out how is a matter of taking off the evangelical hat and putting on an engineer's hat. Here's the problem, here's the constraints, find a solution.

      Remember that network communication is almost never IP to IP. We use UDP or TCP on top of IP.

      When your browser connects to a web server, the packets are identified by a 5-tuple: source ip, destination ip, protocol, source port, and destination port.

      So one possible solution (that we may not like) is this:

      The ISP sets up a NAT. You, as a customer, are assigned a static non-routable IP address, and a set of ports that will be reserved for your use alone. Let's say that the ISP has been assigned 123.45.67.89 for its IP address, and you're given 10.11.12.13 for your (internal-to-the-ISP) IP address, plus they've assigned ports 2037-2044 to you. Anyone connecting to 123.45.67.89:2040 will be connected to 10.11.12.13:2040.

      If TWO people connect to 10.11.12.13:2040, that's okay, because if the source addresses are different or the source ports are different, there's no ambiguity. If ONE person connects twice to 10.11.12.13:2040, their ISP can ensure that separate source ports are used, and so there is still no ambiguity.

      One problem with this scheme is that the source-ports will quickly become exhausted.

      But there's no reason why the ISP can't re-used source ports as well. When you connect to two different web-servers (i.e., separate IPs), there's no reason why the ISP can't re-use the source-port. It's a different connection, after all, so there's still no ambiguity, at least not until you open up two parallel connections to the same server. At that point, the ISP will need to allocate another source-port to handle the connection. And, of course, that source-port doesn't have to be reserved for your use alone -- the ISP can re-use that port all day long, so long as the 5-tuple is unique.

      Sure, it's hairy. And ugly. And will piss off a lot of people. But it will work good enough, most of the time. It'll fall over in pathological situations, but what doesn't?

      --
      Pick One: http://www-rohan.sdsu.edu/~stremler/sigs/sigs.html (Note - disable Javascript first!)
    22. Re:And? by Rich0 · · Score: 1

      Yes, but why would the ISP want to support port-forwarding at all?

      If they don't forward ports, email still works fine. The web (outgoing) works fine as well. That's all the internet they really care to sell in the first place.

      I'd think NAT would be a good excuse to kill off P2P and everything else once and for all.

      And I can't imagine that all this port-forwarding would be easier to implement than IPv6...

    23. Re:And? by Anonymous Coward · · Score: 0

      Yes, but why would the ISP want to support port-forwarding at all?

      Um, because they could then sell you that service? Why do some ISPs give you an IPv4 address now, when they could just DHCP a non-routable address? Because the customer pays for that service.

      If they don't forward ports, email still works fine. The web (outgoing) works fine as well. That's all the internet they really care to sell in the first place.

      If that's truly the case, then there's not an IPv4 problem at all.

      I'd think NAT would be a good excuse to kill off P2P and everything else once and for all.

      Supporting P2P (and a higher cost, of course) is a business model. Once all the world is NAT, they can charge you $5 per port opened thru the NAT and firewall. It's not like the big ISPs will be trying to look at ways to make less money, and Google and friends don't care -- a NAT-filled world doesn't hurt their business model.

      And I can't imagine that all this port-forwarding would be easier to implement than IPv6...

      Failure of imagination makes for a poor analysis.

      The fine article discusses the problems with IPv6 (and the flaws justify an effort to scrap IPv6 and try again, rather than letting ourselves be forced into a broken system because "there is no time left"), one of which is the transition is not going to be smooth. IPv6 is not backwards compatible with IPv4, but a NAT-filled world is. We can get there from here via a bunch of small, easy steps.

      If anything does force a transition to IPv6, it will be to keep up with Asia.

  19. One correction by Random+Q.+Hacker · · Score: 2, Funny

    "... shows the reality of the problem in stark detail."

    s/stark detail/comic sans/;

  20. SSL by mother_reincarnated · · Score: 3, Informative

    would it be feasible to host, for example, 100 different websites on one ip using header information? or does that have traffic spike issues/ latency issues/ wasted cycles involved? The real problem is https not http - you don't get the host header until well after you had to present a certificate to the browser. For http 100 'virtual host-by-name' sites on one IP wouldn't even break a sweat for a good setup.
    1. Re:SSL by Anonymous Coward · · Score: 0

      Not any more. Multiple SSL sites can be hosted on one IP, with or without wildcard certificates.

    2. Re:SSL by mother_reincarnated · · Score: 1

      How?

    3. Re:SSL by The+Moof · · Score: 1

      X.509 v3 Extensions (specifically the subjectAltName). RFC 3280 has all the gory the details.

    4. Re:SSL by mother_reincarnated · · Score: 1

      X.509 v3 Extensions (specifically the subjectAltName). RFC 3280 has all the gory the details. Ahh yeah ok I wasn't thinking about subject alternate names. I wasn't really thinking of a case where one organization simply uses multiple domain names. That requires that the webhost maintains a single certificate for all of the secure domains hosted. That won't always work in cases where the different sites are owned by different entities- or more specifically this wouldn't always be allowed.
    5. Re:SSL by mcrbids · · Score: 1

      The real problem is https not http - you don't get the host header until well after you had to present a certificate to the browser.

      Except that isn't exactly 100% true, either. This flies in the face of years and years of conventional wisdom, but I'm already doing it! You can host any number of SSL sites at *different* domains using the same certificate, with certain limitations, if it's set up correctly. I host nearly a hundred websites at the same IP address with different domains, without errors in common browsers. (Firefox, IE, Safari, Opera)

      This trick is accomplished with wildcard SSL certificates! As you can see, Prices aren't even all that unreasonable. All it is is a certificate that wildcards subdomains. EG: *.mydomain.com instead of "secure.mydomain.com".

      So technically, if you could get one of the "approved" certificate providers to make a wildcard DNS for *.com, SSL could be applied to any number of SSL websites on the same server, and you could host every single .com website with SSL support on a single IP address. (if you could come up with a server or cluster that could handle the load, that is)

      This fact might be viewed by some as a *MASSIVE* security hole. Imagine being unable to trust *any* SSL website certificates!?!?

      The problem is the limit of root domains: .com, .org, .net, .gov, .biz, the 2-letter countries, and a few others. This creates an artificial chokepoint with limited numbers of root domains.

      But we may soon see an end to this, since ICANN has been making noises about unlimited TLDs. Really, there's no reason to have limited TLDs, when you think about it - even technically. This doesn't completely answer the question/issue of SSL certificates and domain names, but it sure does reduce the problem, and in fact, would improve security!

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    6. Re:SSL by cortana · · Score: 1

      Google: TLS SNI :)

    7. Re:SSL by gbjbaanb · · Score: 1

      Unfortunately, wildcard SSL only secures subdomains of a host - so if you were an ISP hosting 2 unrelated websites, they would both have to use a common URL for https traffic. eg if you hosted 'www.kiddietoys.com' and 'www.adulttoys.com', kiddietoys would have to use 'https://kiddietoys.myisp.com' as the secure part.

      This isn't so bad for some cases, but most websites would want their own SSL certificates as they would not want anyone to confuse them with those other sites running on your certificate's domain name. (ie myisp.com).

      If you had a certificate for *.com, then certificates would be useless for identity checking sites, sure it would be good enough to encrypt traffic, but you couldn't be sure the website you were talking to really was the one you intended.

      The only way to fix it is for name-based SSL lookups, so the initial part of the connection is unencrypted as it detects the individual website you're surfing to. The initial part could not be encrypted unless yu had a certificate for your server and referenced it in the subsequent SSL website name lookup. Mind you, unencrypted handshaking wouldn't be much of a security risk, I think.

    8. Re:SSL by mcrbids · · Score: 1

      The only way to fix it is for name-based SSL lookups, so the initial part of the connection is unencrypted as it detects the individual website you're surfing to. The initial part could not be encrypted unless yu had a certificate for your server and referenced it in the subsequent SSL website name lookup. Mind you, unencrypted handshaking wouldn't be much of a security risk, I think.

      Which sounds fine, but that ain't going to happen. Also, the value of this is greatly mitigated when root domains (eg: .com) cease all restrictions. At which point, there is no "wildcard DNS that is a gaping security hole" problem.

      I mean, why the .com? Why not just bill@ibm or me@mycompany?

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
  21. Not compatible, not happening by fuzzy12345 · · Score: 4, Interesting

    DJB said it best at http://cr.yp.to/djbdns/ipv6mess.html Why switch from an Internet with a billion people on it to one that has nobody on it that can't be reached by IPv4?

    --

    Everybody's a libertarian 'till their neighbour's becomes a crack house.
    1. Re:Not compatible, not happening by powerlord · · Score: 3, Funny

      Actually, that makes it sound lots more appealing. :)

      --
      This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
    2. Re:Not compatible, not happening by heper · · Score: 1

      Well it shouldn't be hard for the isp's to set up ipv6-to-ipv4 tunnels, thus they can give out ipv6 address' to their customers
      while still allowing them to access ipv4 based systems. But that would cost money and isp's only want to make money

      I personally experimented with it in one of the schools i work; you can get an ipv6 subnet for free to experiment with at one of the
      many tunnel brokers. The problem is that currently I have to use my ipv4 address on my router/firewall to tunnel to an ipv6 broker
      in another country (kind of slow) .... then i have a zillion ipv6 address i can assign to each of my computers(yey no more NAT)

      Now only to find something to do with my fancy ipv6 adress, cuss that animated gif at kame.net get boring after a while

    3. Re:Not compatible, not happening by IkeTo · · Score: 1

      I think there is one question that DJB asks is worth thinking: which big site gonna be the first one to run an IPv6-only site? Until we have an answer to that question, we are kept with the chicken-and-egg problem: no one runs dual stack because no one run IPv6 (I wouldn't lose anything if I wait), no one run IPv6 because no one run dual stack (I can't reach anyone if I use IPv6).

    4. Re:Not compatible, not happening by Nullav · · Score: 1

      Does it matter? Eventually, it'll be IPv6 or nothing. Forget switching over just for a site or two, people will be switching to connect. Also, IPv6 would make static IPs much more practical and make it more awesome to be able to recite one's own IP from memory.

      Also, there is a handful of IPv6 sites, but, for the most part, they're worthless to most people. (Well, at least they're there.)

      --
      I just read Slashdot for the articles.
    5. Re:Not compatible, not happening by renoX · · Score: 1

      Thanks: it's much more readable than the PDF linked in the article..

    6. Re:Not compatible, not happening by IkeTo · · Score: 2, Insightful

      > ... it'll be IPv6 or nothing.

      The problem is that this is simply not true. Most people can continue with IPv4 under NAT until the first IPv6 big site arrives. But, nobody's going to be that first guy.

    7. Re:Not compatible, not happening by Just+Some+Guy · · Score: 2, Informative

      Why switch from an Internet with a billion people on it to one that has nobody on it that can't be reached by IPv4?

      DJB has an awful problem of confusing "I don't know how it can be done" with "it can't be done". For example, he doesn't seem to realize that you can run IPv4 in parallel with IPv6. In reality, you can access my homepage linked above through either protocol, or send me email from an IPv6-only server. In fact, all of my FreeBSD mailing list traffic comes in via IPv6, right now, today.

      --
      Dewey, what part of this looks like authorities should be involved?
    8. Re:Not compatible, not happening by Nullav · · Score: 1

      And eventually, you're just replacing pipes with duct tape.

      --
      I just read Slashdot for the articles.
    9. Re:Not compatible, not happening by Anonymous Coward · · Score: 0

      Why would anybody hop off the RMS Titanic with 3500 people and into a lifeboat with 35 people that has nobody on it who wasn't already on the Titanic?

    10. Re:Not compatible, not happening by optimus2861 · · Score: 1

      DJB has an awful problem of confusing "I don't know how it can be done" with "it can't be done"

      That's not what I took from his writeup. If I had to sum it up, I'd say his take on it would be akin to, "This could've been done the easy way (make ipv6 backwards-compatible with ipv4) or the hard way (don't) - so why on earth did the designers of ipv6 choose the hard way?"

    11. Re:Not compatible, not happening by 5pp000 · · Score: 1

      From DJB's page, it appears that Randy Bush, the author of TFA, was part of the problem: Randy Bush shut down the ngtrans working group on 2002.08.14: ``It is time for ngtrans to declare victory ... The combined v4/v6 network is no longer the future, it is today.''

      --
      Your god may be dead, but mine aren't!
  22. remove dumb domains that don't have any use... by Anonymous Coward · · Score: 0

    Lots of squatters buy tons of domain names with the sole purpose of just putting up a bunch of ads, and nothing else. Remove that and ipv4 will probably last for another 50-100 years.

    1. Re:remove dumb domains that don't have any use... by RPoet · · Score: 2, Informative

      Squatter domains typically don't have unique IPs.

      --
      "Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
    2. Re:remove dumb domains that don't have any use... by dwye · · Score: 1
      > Lots of squatters buy tons of domain names

      Names aren't numbers. The IPv4 numbers are running low, not the set of possible names using [A-Z0-9\-_] strings separated by as many periods as needed.

      Ok, the really short names in .com or .org are largely gone, but 8 char names are still findable, especially if you get them from "odd" domains, like Tonga and Tuvalu, aka .to and .tv, who sell domain names to sites outside their nominal geographic area.

  23. Top to bottom responsibility would be nice. by PrimalChrome · · Score: 1

    Not only that, but maybe a little ISP responsibility across the board would be a good thing. Over the past few years I've had multiple clients with entire class C's. Total INTERNAL hosts for each client was less than 30. By a slim margin, most of those class C's were being given out by Sprint.

  24. Why should most people (including 'nerds') care? by apathy+maybe · · Score: 2, Interesting

    OK, I'm interested in technology, I know what IPv4 and IPv6 are, I know that there are many more advantages to IPv6 then to IPv4 etc. Yet I'm failing to see why I should care whether IPv4 addresses are running out or not.

    But more to the point, what can I (as an individual who isn't part of the technocratic elite) do about it if I did care?

    I don't code network stacks, nor kernel drivers, most of my software is written by someone else, and is automatically updated to fix problems and include new features.

    I assume that by the time everyone else is using IPv6 I shall be too (simply by virtue of my software being updated).

    So, why should I care? And what should I do if I did care?

    --
    I wank in the shower.
  25. we had Y2K by zakeria · · Score: 1

    no we have Y2K0xA

  26. Three Things for Widespread IPV6 Acceptance: by JoeD · · Score: 5, Informative


    1. Home routers that support IPV6 off the shelf.

    2. Cable/DSL modems that support IPV6 off the shelf.

    3. (The biggie) ISPs that hand out IPV6 addresses.

    In a vain attempt to forestall the inevitable followups:

    Yes, I am aware that I could install new software in my WRT-54G, and convert my home network to IPV6. But as long as my upstream connection is IPV4, this gains me NOTHING except a bunch of aggravation and downtime getting the thing set up. No thanks. When my ISP supports IPV6, then and only then will it make sense for me to convert.

    1. Re:Three Things for Widespread IPV6 Acceptance: by bendodge · · Score: 1

      Actually, I installed DD-WRT in just a few minutes, set the basics, and it's all done with automatic IPv6 support. Boosting the transmit signal to improved wireless a good deal too.

      --
      The government can't save you.
    2. Re:Three Things for Widespread IPV6 Acceptance: by nsayer · · Score: 1

      1. Home routers that support IPV6 off the shelf. Done.

      2. Cable/DSL modems that support IPV6 off the shelf.

      3. (The biggie) ISPs that hand out IPV6 addresses. Don't let that stop you from setting up 6to4. The journey of a thousand miles starts with a single step.

    3. Re:Three Things for Widespread IPV6 Acceptance: by JoeD · · Score: 1

      You miss the point. What do I gain by converting to IPV6, when my upstream and current static IP address is IPV4?

      And it will take more than "a few minutes" to get my DNS, email, web, and other misc server crap reconfigured for IPV6.

      Like I said, it's just not worth the time and aggravation for me to convert.

      When I can get an IPV6 connection from my ISP, which they will support should something go wrong, then I'll think about it.

    4. Re:Three Things for Widespread IPV6 Acceptance: by schnikies79 · · Score: 1

      Does it really matter if your internal home network is ipv6? As long as my router can get an ipv6 address for my isp, that is fine.

      I don't need millions of addresses for my home. 192.168.1.x is enough for me.

      --
      Gone!
    5. Re:Three Things for Widespread IPV6 Acceptance: by Kenshin · · Score: 1

      192.168.1.x is enough for me.

      Bah! 10.x.x.x is enough for me!

      --

      Does it make you happy you're so strange?

    6. Re:Three Things for Widespread IPV6 Acceptance: by Cajal · · Score: 1

      The Airport Extreme only supports 6to4 tunneling. It doesn't handle IPv6 prefix delegation, and its IPv6 firewall is buggy from personal experience.

    7. Re:Three Things for Widespread IPV6 Acceptance: by anticypher · · Score: 3, Interesting

      That is true, the AEBS only does 6to4 tunneling, but that tunneling works with both Hurricane Electric and Sixxs static service. In fact, it works pretty well for home use, and if you've got Macs behind it, they pick up their IPv6 address quite nicely and it all works pretty transparently. I'd recommend it as a good (but expensive) way for geeks to get up and running on v6 with a minimum of hassle.

      I've tried making some of my AEBSes work on a native dual-stacked network connection, with no luck. It doesn't listen to Router Advertisements, DHCPv6 service, or anything I can detect. You can manually set a local node address, but it doesn't seem to route or bridge at that point. Apple's forums have been less than enlightening, and I've never heard back from their developer tech support on the issue. There firewall is very buggy, it seems to be just a simple two line IPFW entry to block incoming connections and keep state on outgoing. Any kind of P2P activity causes the firewall to fail badly.

      A Chinese company last year gave me a DSL router that speaks IPv6. It is some kind of OEM version of a popular Belkin model, but with a Chinese only firmware installed. They claimed it was the most widespread model inside of China, where many ISPs can only hand out IPv6, and there is a NAT-PT+totd translation service somewhere within the ISP. I played around with it for the few days I had, and couldn't figure out how to make it work for what I expected. Some of the configuration pages looked identical to Belkin, but in Chinese and with some obvious IPv6 entries on some pages. It certainly worked as an IPv6 only DSL modem, and dual-stack v4/v6 just like a Belkin, but I never got it to work with a NAT-PT gateway.

      There was a muttered admission that by having a lot of IPv6 only services that aren't announced outside of China it makes it a lot easier to do the great firewall of china function. There is apparently a government funded push toward IPv6, but none of it is announced externally because of firewall issues.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    8. Re:Three Things for Widespread IPV6 Acceptance: by bendodge · · Score: 1

      I don't have IPv6 upstream either, but at least my router will be ready. I bug my ISP about it every now and then.

      I'd also say it's worth upgrading the router just for all the cool stuff you get (like working UPnP).

      --
      The government can't save you.
    9. Re:Three Things for Widespread IPV6 Acceptance: by cdwiegand · · Score: 1

      > 1. Home routers that support IPV6 off the shelf. -- Check

      Apple Airport Extreme N supports IPv6, will even auto-create tunnels for you if it detects it's upstream is a public IPv4 address. Very very cool.

      --
      . Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.
  27. Itojun by eldavojohn · · Score: 3, Informative

    Yeah, we always fall back on the government to help us out when us nerds aren't satisfied with how capitalism is driving the technological trends that need to happen.

    But let's not forget those that went before us. Jun-ichiro Hagino, better known as Itojun, was one of the first researchers that was pushing for IPv6 since as long as I can remember (at least 2001). On top of that he was developing specifications for it and working through the BSD code to make it one of the first operating systems fully capable of being IPv6 compliant--starting a trend that needs to happen in more operating systems sooner. He even started documenting draft APIs to get developers thinking about how this would work inside software.

    And then he died in a car accident at age 37. It's funny how you don't appreciate their work until they're dead. Almost like a painter or author.

    Although many still carry on his work, the saddest part is that all his efforts to bring awareness to everyone about IPv6 may fall into the responsibilities of the government or, worse, capitalism.

    --
    My work here is dung.
    1. Re:Itojun by BJH · · Score: 1

      Wasn't a car accident. He'd been ill a while, and had been slowly recovering, but it got him in the end.

    2. Re:Itojun by krbvroc1 · · Score: 1

      Yeah, we always fall back on the government to help us out when us nerds aren't satisfied with how capitalism is driving the technological trends that need to happen. They did this in Nov 2005 requiring compliance in 2008. Here is a link to the whitehouse OMB memo:

      http://www.whitehouse.gov/omb/memoranda/fy2005/m05-22.pdf

    3. Re:Itojun by gclef · · Score: 1

      Well...sort of. That OMB mandate requires US gov't agencies to prove that they're IPv6 *capable*. However, once they prove that they can run IPv6 on their core, there's nothing in the mandate that requires them to actually use it. (Unfortunately.)

    4. Re:Itojun by krbvroc1 · · Score: 1

      Well here is the relevant mandate. Is your experience different? It reads to me as meaning more than just a capability.

      June 30, 2008
        All agency infrastructures (network backbones) must be using IPv62 and agency networks must interface with this infrastructure. Agencies will include progress reports on meeting this target date as part of their EA transition strategy.

    5. Re:Itojun by gclef · · Score: 1

      Yeah..."using IPv6" has been re-defined a bit. (disclaimer: I'm a contractor to the feds these days) The end result of the interpretation is that the agencies have to prove they can do it, but they can turn it off after proving that.

  28. Re:Abolish domain tasting by Eternauta3k · · Score: 1

    Getting a domain doesn't give you an IP address

    --
    Yeah. Would you choose a neurosurgeon who pokes around people's brains in his spare time? I wouldn't.
  29. Re:Abolish domain tasting by TheOldSchooler · · Score: 1

    That has absolutely nothing to do with this. Registrars aren't using dedicated IP's for the singular purpose of hosting one "tasted" domain. Domain name issues really don't have anything to do with the IPv4 issue.

  30. It is not what you want by SmallFurryCreature · · Score: 1

    Computers communicate by ip address not domain name. For instance the slashdot server I am posting this on has IP 66.35.250.150

    Now that doesn't mean that ALL of slashdot is hosted on that address, it doesn't mean ONLY slashdot is hosted on that address and it doesn't even mean slashdot the site/code is there.

    What it means is that if my computer requests a connection on port 80 with certain information from that IP I will be given a slashdot page.

    There might be a NAT solution with 66.35.250.150 being nothing more then a router, it might be a server where the webserver swiches me to the right set of pages based on the requested domain name.

    There are PLENTY of solutions to host multiple sites from a single IP or have multiple servers behind a single IP.

    The problem is that one of them are "sexy".

    The problem is that shared IP is used mostly for cheapo sites, those sites where you share a server with many others. These solutions are typically very bad making everyone who has a site dream of the day they can afford a dedicated server.

    Now there is no real reason why a dedicated server (the computer) could not share an outward IP address with other servers BUT that is not the way these things are done. IP adresses are cheap and plentifull and if you get your own dedicated server your hosting company will gladly give you a handfull of IP's to go with it.

    What might be needed but will be very hard to do is convince people that they don't need their own ip for their site. Good luck with that, until the crunch becomes really thight what hosting company is going to take away something their customers have taken for granted for the good of the rest of the world? Might as well expect a car maker to stop making big gass guzzlers to save the enviroment.

    Yes it is possible to host sites under a single IP. The only limit is how much the hardware/software that redirects the requests it receives to the right site can handle.

    Think of it like this, the limit to the performance of your NAT solution at home is your router. You can't host 10 100mbit sites behind a 10mbit router.

    But the tech doesn't matter, the problem is simply that people don't want it.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

  31. 400GB of v6 porn online by Anonymous Coward · · Score: 0

    http://prujem.cz/ ... unlike ipv6porn.com, this one actually has some interesting content ;-)

  32. Re:Abolish domain tasting by Anonymous Coward · · Score: 0

    You *do* know a domain isn't an IP address, right, moron?

  33. Class 'C' address space for sale. by arthurpaliden · · Score: 2, Interesting

    The company died and no longer needs it. Maybe I will put it up on ebay.

    1. Re:Class 'C' address space for sale. by anticypher · · Score: 4, Informative

      But you don't "own" that netblock, you were allocated it from ARIN for a single use.

      Put it on eBay and ARIN will then send you a polite email about how they have now reclaimed the netblock since it obviously no is no longer being used for it's original declaration. They will then turn around and allocate it to the next demand in their queue. They have all the authority, you have none.

      If your sale goes though on eBay, for selling something that did not belong to you, you have committed fraud. I hope you have put aside some of your windfall for legal fees.

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    2. Re:Class 'C' address space for sale. by arthurpaliden · · Score: 2, Informative

      So tell me. How does it feel to go through life with out a sence of humor?

    3. Re:Class 'C' address space for sale. by Anonymous Coward · · Score: 0

      So tell me. How does it feel to go through life with out a sence of humor?
      Probably a lot better than going through life without a quality education.
  34. Why not use greater than 32 bit addresses ? by dam.capsule.org · · Score: 1

    I know that IPV6 support 128 bit addresses but it also has a lot of other improvement/differences that might be slowing down it's adoption. Why not keep the IPV4 protocol but just changing the ip address size?

    This certainly is a stupid idea but please explain me why.

    --
    What sig ?
    1. Re:Why not use greater than 32 bit addresses ? by Anonymous Coward · · Score: 0

      Because most of the pain involved in shifting to IPv6 has to do with the increase in the address size.

      If you can get over that pain, the additional pain for the other features of IPv6 is minimal.

    2. Re:Why not use greater than 32 bit addresses ? by xous · · Score: 1

      The ip address field in a packet has a fixed length of 32 bytes. Increasing this value would break any device that operated at a higher OSI level than layer 2. Routers Layer 3 Switches Applications TCP/IP Stack implementations. This would almost be the same as switching to IPv6. http://en.wikipedia.org/wiki/IPv4

    3. Re:Why not use greater than 32 bit addresses ? by xous · · Score: 1

      * that's 32 bits not bytes. (4 bytes) http://en.wikipedia.org/wiki/IPv4 has a nice diagram.

  35. Re:Why should most people (including 'nerds') care by anticypher · · Score: 3, Insightful

    Why? Your money is why.

    If you want to continue to use an IPv4 address from your upstream ISP, you currently pay about US$10 per month for that address, more if you want a nice static address to run services on.

    After 2012, or if one of the hair-brained free-market schemes to buy & sell netblocks comes into effect, the price your ISP has to pay for an IP address goes from ZERO to $10 or $20 per month per address. Currently, with a freely available pool of IP addresses, there was minimal cost associated with obtaining a netblock, just some administrative overhead to ask, and some technical cost to program the routers. ISPs discovered that they could charge US$30/month to a user, of which $10/month covers bandwidth, $10/month for the connection, and the remaining $10/month is the pure profit from renting you an individually addressable IP address.

    When the crunch hits, IPv4 addresses will be accounted differently, no longer will they be seen as a free resource that earns $10/month, they'll be seen as a cost center that needs to have a margin associated with it. So if the company has to start paying even $1/month per address, they'll pass that cost on to the end users as a higher monthly fee.

    In the end, those who don't have an IPv6 service with a migration strategy will see their internet connectivity increase in price. Maybe only a little in 2010, more in 2012, and if there isn't a mass migration to v6, significant costs after that. You, and every consumer, better hope that ISPs and hosting centers get a migration strategy in place soon, or your costs are going to skyrocket.

    That was costs from the consumer PoV.

    From the techie PoV, imagine what will happen to your router FIBs if some of those nicely aggregated /8s and /16s de-aggregate into 100s of thousands of individual prefixes. Is there any Cisco router right now that can handle a BGP IPv4 routing table of 2 million entries? Are you willing to scrap your entire Border Router investment in 2010 when the routing table grows from 300,000 routes to 750,000 routes? Do you know what the cost of a Cisco CRS-1 is, even if you can find one used?

    the AC

    --
    Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
  36. Heard that before... by guruevi · · Score: 1

    http://www.glocom.org/tech_reviews/tech_bulle/20020227_bulle_s2/index.html

    "We will run out of IP addresses by 2008." (ICANN 2001) The estimate was derived by assuming that the number of remaining addresses as of 2000 was about 1.7 billion and demand for new IP addresses will be 75 million in 2000, and moreover that demand for IP addresses will increase in a geometric progression after 2001. Based on these assumptions, the addresses would be depleting by 2008 if demand grows by a factor of 1.3 each year, and by 2006 if it grows by a factor of 1.5.

    --
    Custom electronics and digital signage for your business: www.evcircuits.com
    1. Re:Heard that before... by Tony+Hoyle · · Score: 1

      That's why nobody believes them any more.

      I could dig up an old one that said we'd run out by 2000. There have been multiple doomsday prophecies. All wrong.

      The statistics are actually a *lot* less alarming than the doomsayers make out.

      http://www.bgpexpert.com/addrspace2007.php

      "January 1, 2007 we were at 64.9% utilization and a year later we're at 69.7%"

      That's a bit less that 3% growth a year. For this prediction to be right we'd have to increase our growth to 15% usage a year - 5x the current allocation rate - to run out by 2010.

      A pure linear growth has us running out in 10 years at that rate.. maybe it'll be a little less, maybe a little more. But saying we'll run out in 2 years just doesn't fit the figures.

  37. Re:Abolish domain tasting by Anonymous Coward · · Score: 0

    I`m all for getting rid of domain tasting.. but it has nothing to do with running out of IP addresses. You can host a bazillion domains on one IP address (and most tasting companies do).

    Purple monkey dishwasher :(

  38. Windows 2008 is IP6 by Atreide · · Score: 1

    In Windows 2008 server
    IP6 and IP4 can coexist,
    also does Vista.

    Even more, you can have
    IP6 over IP4.

    Question : is W2008 really an answer to IP shortage ?
    or is IP4 solution to Microsoft to sell W2008 ?

    I am surprised by the coincidence the news come out when W2008 is live.

    --
    The world belongs to those who get up early. - I'm far from being the king of Earth then :-(
    1. Re:Windows 2008 is IP6 by Tony+Hoyle · · Score: 1

      It'll be 10 years before that makes an impact.

      Win2003 can't run active directory over IPV6.

      XP can't do DNS over ipv6.

      You really should read the pdf in FA (I know it goes against the slashdot meme), but it covers these issues and finally makes a reasonable argument for transition rather than the current policy of 'the sky is falling let's create a new internet at great expense' that the summary seems to be talking about).

  39. simple solution: IPv7 by mrtexe · · Score: 0

    IPv6 has too much overhead. Drop it.

    Here is a skeleton design of IPv7: take IPv4 exactly like it is today, and drop in IPv6 addresses.

    Everything else, like encryption and IP addresses that move around the Internet, can be proposed for IPv8.

  40. 17 million? They really need 24 million by davidwr · · Score: 1

    "Nine million for the secretaries fair
    Seven million for the hackers scarce
    Five million for the interns in smoky lairs
    Three million for system admins

    One net to rule them all
    One net to bind them
    One net to hold the files
    And in the darkness pipe 'em"

    With apologies to whoever wrote the original

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  41. Off topic by oyenstikker · · Score: 2, Interesting

    That you mentioned India might come up with a solution reminds me of a book I read that discusses in the context of game theory (primarily Prisoner's Dilemma) why people (Indians in particular) make poor decisions as far as society is concerned to maximize personal returns.

    "Games Indians Play" by V. Raghunathan
    ISBN: 9780670999408

    --
    The masses are the crack whores of religion.
    1. Re:Off topic by Phil06 · · Score: 0

      I would expect the India or China "solution" to be a hackneyed workaround upon workaround unless they were told exactly what to do every step of the way.

      --
      "...and yet, I blame society" Duke - Repo Man
    2. Re:Off topic by mikael · · Score: 3, Interesting

      I've read some of the reviews for that book. The story about everyone in a street ending up using water amplifiers (pressure boosters) to guarantee that they get their fair share of water is funny. Some things don't seem to different from other parts of the world.

      Dumping garbage in the street - that happens elsewhere whenever the authorities impose apparently madhatter legislation; Example, a country in Europe creates a whole nation-wide network of recycling centers to reduce the amount of waste going into landfill - Totally sensible. Anyone could enter, and recycle their old boxes, cartons, polystyrene boxes, lawnmowers, furniture, whatever. Then the authorities decide that too many people are making too many journeys, so they decide that each family can only get a ticket to allow them to recycle once every two months. So now, everyone drives around looking for somewhere to dump their recyclables, even filling in the communal rubbish bins of neighbouring villages. Others simply burn it instead.

      --
      Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
  42. I believe that it will be called by WindBourne · · Score: 1

    the MS solution.

    --
    I prefer the "u" in honour as it seems to be missing these days.
  43. Believe it or not ... by Anonymous Coward · · Score: 0

    A lot of this migration has been well thought out.

    For starters, you can run v6 and v4 off the same device. So you could maintain your v4 connection while people start using v6. E.g. your ISP would give you both types of addresses (could even map your v4 address to your v6, e.g. 8123:ABCD::24.132.17.81 to make it easier to keep tabs on). Then services could start adding v6 support, and slowly we just turn off v4.

    So it isn't like it's all or nothing. Granted, a lot of routers will need updating [or replacing] unless you want to do IPv6-in-IPv4 tunneling [which sucks]. But the point is you can run both stacks at once.

    The problem is people don't want to deal with this new information. So we'll be stuck with the most inferior solution.

  44. Progress from the top 100 sites - none! by GReaper · · Score: 2, Interesting

    One useful site I tend to look at on a regular basis is Lars Eggert's IPv6 Deployment Trends, it uses the Alexa rankings to find the top 100 sites for various countries. You could always argue that these aren't the most visited sites - but it does give you an idea.

    The top 100 sites for all these countries comes to a big fat total of 0%. I'm not expecting fast adoption, but it would've been nice to see some progress being made with these sites. Even the two sites which I regularly visit that report about IPv6 stories (Slashdot and Ars Technica) don't even have IPv6 records!

    I suppose I'm just as bad as none of my personal sites don't have IPv6 records either, but then again my server host doesn't provide any native addresses yet.

  45. Oh god, not again. by Anonymous Coward · · Score: 0

    I get so tired of reading this story every couple of years. This has been a problem for a long time - and it's always portrayed as gloom and doom that is only a couple years away. Realistically what does this mean for us? PAT. Woo woo, BFD.

  46. What are all those bits really for? by Anonymous Coward · · Score: 0

    Does anyone else think that perhaps the jump from 32 bits to 128 was driven by more than tech factors? With 128 bits to play with there is more than enough space to reserve a portion of the address for a social security number or some other government readable personal identifier. Then there will no longer be any need for court orders to map IP addresses to people - only a single piece of legislation that says every ISP should assign those bits in every address that is given to the customer. If you think this won't happen then I ask, why not? Are you thinking of the children and the terrorists?

  47. Interesting... by Thelasko · · Score: 1

    use of pink and purple.

    --
    One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
  48. Gubmint by Stanistani · · Score: 1

    Actually, the U.S. Government is beginning to roll out IPv6 now, internally.
    They have even cloned a bunch of IPv6 evangelists to convince PHB types.

  49. Move mobile to IPv6 first by foniksonik · · Score: 1

    Mobile devices don't really need to connect to IPv4 addresses and the number of mobile specific services out there is pretty limited and can more easily be switched over to run on IPv6 servers. Seems like a fairly targeted resolution to me.

    --
    A fool throws a stone into a well and a thousand sages can not remove it.
  50. Stark detail? by Bazman · · Score: 1

    Randy Bush's PDF presentation entirely in multi-coloured MS Comic Sans may well contain 'stark detail' but it looks like a nursery school show :)

  51. easy way to postpone the inevitable by Anonymous Coward · · Score: 0

    Relinquish the wasteful Class A subnets allocated to US corporations. Most sovereign nations don't even have IP blocks of this size, and these corporations have no need for such a block, either. Only a small percentage of their allocated addresses are even routeable from the public Internet. Then CIDR out the recovered Class A subnets. This will also give the big corps an incentive to make the IPv6 transition happen.

  52. Migration to IPv6 (it's on it's way) by Midnight+Thunder · · Score: 4, Informative

    There is a lot of feet dragging going on, partly because too many business plans rely on short term spending. The irony is that some of the companies which you expect to be leading the way in IPv6 migration don't even have web sites that are IPv6 enabled. This includes IBM, Apple, Microsoft, RedHat and Cisco. I make the point because they should be picking up the torch now that research sites have already done their part, and showing that it is an achievable goal, and not some sort of pipe-dream. /. readers at the same time, should probably get to know and understand the technology, since it is not a question of whether it will happen, but when. When it happens if the IT crowd doesn't understand IPv6, then we really have issues.

    If you want to get an IPv6 web site running there are number of solutions, including using Apache 2 with IPv6 support activated and making sure you have an OS that supports an IPv6 stack - most modern OSs do.

    Migration technologies for people stuck behind IPv4 NATs include Aiccu and Teredo (Vista includes this, and for other OSs there is Miredo). If you are at home, then one of the 'consumer' routers to support IPv6 out of the box is the Airport Extreme. If others support it out of the box I am not aware of this.

    When you are ready see the dancing turtle - if you don't see it you are accessing it via IPv4.

    Other stuff you can do in the meantime is checking to see if some your favourite network based applications handle IPv6 and if they don't make some noise. Its best to make the noise now, when it doesn't matter so much, than waiting until it does. On the bonus side they can advertise the fact they are IPv6 ready.

    --
    Jumpstart the tartan drive.
    1. Re:Migration to IPv6 (it's on it's way) by anticypher · · Score: 1

      I've asked before if /. is truly geek enough to be the first major tech site to start testing IPv6 connectivity. It's time to ask again, so slashdot people, consider it asked, again.

      Slashdot has good admins and programmers behind it. Certainly CmdrTaco seems to be constantly improving the slashcode base, and for those of us with low IDs we can see the improvements being rolled out on a regular basis (and it's all appreciated, despite occasional grumbling, thanks all).

      What needs to happen is for one of their more competent OSTG network admins to obtain a tunnel from either Hurricane Electric or Sixxs. If they were to send an email to one of the people at either HE or Sixxs, there would probably be all kinds of technical assistance offered. Both tunnel providers have ubergeeks behind them, and a high profile site like /. would be a major win for them.

      Putting the tunnel on one of their Cisco 3745 routers is about 9 lines in IOS for the routing and interface addressing, and a handful of ACLs to protect the router on the new addresses. Finish it off by providing a /64 subnet to the VLAN where one of their test or development webserver machines resides.

      After that, the fun begins. They can put a static IPv6 address onto one of the test or development machines, make Apache bind to it, and they will be off and running. More like off and limping, because there will be work to do before they are ready to make any kind of announcements or even put the AAAA record into DNS. They'll have to make sure the local firewall also deals with IPv6 addresses, and a ton of other little sysadmin things to make sure badness doesn't sneak in on the new connectivity.

      First off, CmdrTaco will probably find bugs or deficiencies in the slashcode and database structures when dealing with a new address family. There WILL be bugs found in perl network modules and in mySQL. Logging scripts may need to be updated. Statistical packages run against logs may choke or ignore longer addresses. Some functions may mangle colon delimited addresses. RSS feeds may not deal with square brackets around v6 addresses. Although there will be some things needing fixing, a surprising amount will just work with IPv6 with no modification.

      When most of it seems to be functional, they can stick a separate AAAA record in their DNS for something like ipv6.slashdot.org and ask those of us with connectivity to test for a while. No need yet to add it to the main A record of slashdot.org. Just get it out for those of us with IPv6 to test.

      Even if the network admins were to have the tunnel up by next week, I wouldn't expect to see even basic functionality before mid-summer, and if limited testing all went well to just put a AAAA record in parallel by the end of 2008. It takes a while, but it can be done.

      When /. does have a working IPv6 code base, they can put pressure on their upstream provider to get native v6 connectivity, because a tunnel isn't going to hold up for too long.

      All website upgrades are going to follow a path like what I've just described. The networking takes almost no effort, but the coding of website functionality will require some work, work that can be rolled into ongoing website maintenance.

      I've been thinking about this post for the last few IPv6 stories on /., this seemed like a good time to point out the easy and hard parts for a dual-stack rollout. After this, we can only wait and hope...

      the AC

      --
      Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
    2. Re:Migration to IPv6 (it's on it's way) by Midnight+Thunder · · Score: 1

      The idea /. supporting IPv6 early on the game, would certainly earn it another star on its nerd card. In the meantime I would be curious to know whether anyone has tried out slashcode on an IPv6 based server/network.

      --
      Jumpstart the tartan drive.
  53. Better than selling spectrum? by Anonymous+Meoward · · Score: 1

    and some like the Defense Information Systems Agency (whoever they are) own multiple blocks! That's an awful lot of addresses.

    Sounds like an interesting way to put a dent in the US current account deficit. The gummint is sitting on a scarce resource that a lot of well-heeled corporations would be willing to pay for.

    And then the US government can move to IPv6 shortly after sale, leaving the buyers with devalued assets. (Psych!!!)

    --
    --- The American Way of Life is not a birthright. Hell, it's not even sustainable.
  54. What would you have to do? by mitchplanck · · Score: 2, Interesting

    At my company we have two main Cisco routers. One is about 7 years old and the other about 3 years old. The older one used to be able to handle full BGP routes but as the routing table grew and Cisco IOS bloat happened it's 128MB of RAM could no longer hold all that. I've had to trim it to connected routes and I can't update the IOS as all the current ones use too much RAM and wouldn't even work with what I've got it doing. So forget doing IPv6 on that one.

    The other router isn't doing BGP and could probably handle IPv6. The problem then becomes all the machines on our network. Lots of legacy systems. If they can't handle IPv6 then we either have to replace them or have an IPv4/IPv6 gateway - another machine probably since I don't think the newer router could handle this.

    The next issue then becomes our upstream providers. Neither of them are Tier-1 providers and neither offer IPv6 addresses yet.

    Then there's the issue of network admins knowing how to use IPv6 addresses. I've been doing a bit of reading about them but until I start actually working with the systems it won't really sink in. I know my colleagues here haven't been attempting to learn anything about this and it will probably fall to me to educate them on this.

    I'm not looking forward to any of this...

    1. Re:What would you have to do? by jguthrie · · Score: 2, Interesting
      You know, when a megabyte was a lot of RAM, this whole "routing table is getting too big" argument carried some weight. The size of the routing table is an incredibly stupid thing to worry about, now. Perhaps it isn't because people don't do routing the way that they should.


      With BGP, you're not going to route anything smaller than a /24, so your entire routing table can be an array with 2^24 entries in it. Those entries are going to be (for the most part) outbound queues, one per interface, so all you need in most cases is a single 8-bit number with the queue number in it. I can buy 16 MBytes of RAM with pocket change, nowadays.

      To route a packet, you simply shift the destination address right eight bits, look up the queue number, and put the packet in that queue. The total elapsed time for that operation is easily measured in nanoseconds. Some queues might do further routing (you might have a queue to route local packets, for example,) but you wouldn't see a lot of those on any router that needs a full picture of the Internet.

      Now, building that array is a lot more work, but it's not that much more work and, besides, it's the handling of the incoming packets that is time-critical. Processing of BGP (or RIP or OSPF or whatever) can take a lot more time and still be plenty fast enough to handle the changes as they happen.

  55. LIES ! by Anonymous Coward · · Score: 0

    I am VERY ready for IPv6, what isn't is the f***n industry !

    It's impossible to find a router modem wifi ADSL expresso coffe machine IPv6 ready at the street-corner wallmart.

    THIS is the real issue.

  56. Major French IAP "Free" deployed IPv6 months ago by GNUPublicLicense · · Score: 1

    Indeed, one of your 3 major IAP provides IPv6 connectivity. For FTTH (Fiber To The Home) it will enable all VoIP (Voice over IP) and similar "public internet address to public internet address" protocol to work on an universal plane (ex:XMPP/JINGLE/SIP/RTP/RSTP...), namely for all computers sharing internet access at home. The real challenges for IPv6 are mobility (signaling is very expensive traffic/latency wise), QoS (Quality of Service for low lantency traffic) and priority (emergency traffic). There is also the big issue of available and standardized mobile terminals...

  57. Vista by Supergibbs · · Score: 1

    At least Vista has IPv6 enabled by default! *ducks*

    --
    First post! (just in case I am...)
    1. Re:Vista by GNUPublicLicense · · Score: 1

      Sorry, but I do not give a damn of a non-GPL OS...

    2. Re:Vista by Anonymous Coward · · Score: 0

      Just to be an ass about your username: There is no such thing as the GNU Public License. It's the GNU General Public License.

  58. The biggest problem is by Anonymous Coward · · Score: 0

    Lazy people. It seems like everyone is reluctant to adopt it because no one is using it, and no one is using it because no one has adopted it.

  59. p2p by upside · · Score: 2, Insightful

    I foresee a - perhaps shortlived - opening for lots of filesharing.

    --
    I'm sorry if I haven't offended anyone
    1. Re:p2p by Agripa · · Score: 1

      I have had IPv6 connectivity for more then a year and there are a couple of rules:

      The first rule about IPv6 file sharing is . . . do not talk about IPv6 file sharing.

  60. Something tells me by EdelFactor19 · · Score: 1

    That pron sites arent to blame, and arent even the primary target to blaim. Call it a hunch; but I have a feeling that millions more people connecting to the internet and needing ips, and poorly distributed addresses (in terms of address class) also plays a very large factor. The number of addresses available hasn't changed; just the consumption of them. It seems like a similar problem to the domain names as well; there are plenty more of them that are being wasted on cynbersquatters, typosquatters, and 'blank pages' that are just serving ads and adsense and circular links to more of the same. The adult sites may take a large amount of them but then again you could also argue that the pron sites played a larger role in the expansion of web bandwidth and expansion than many other things. Perhaps the pron sites are gettign more out of control, but so are the bogus prescription drug sites, adult friend sites, 'shopping' sites, and other random garbage that I couldn't even begin to explain.

    I would imagine that to some extent the dominant forces with the most financial interest in current IP address control probably also are playing some role in the hinderance of IPv6 because the increased address space will devalue existing IP's (whatever value that might be), allows for a power shuffle, etc.

    Reminds me a lot of the "phone number" problem occuring in america, where the consumption of numbers has gone way up since the cellphone became mainstream and it feels like new area codes are constantly added such that you can almost never make a 7digit call, but more and more always a 10digit.

    --
    "Jazz isn't dead, it just smells funny" ~Frank Zappa
    EdelFactor
  61. Presentation is wrong, on oh so many levels by Anonymous Coward · · Score: 0

    The presentation is clearly anti-IPv6, and makes several incorrect assumptions to trump up his baseless arguments. Thank goodness most techies will see right through it. Exactly how seriously are we supposed to take someone who writes their ideas up in PowerPoint and, for their primary font, chooses MS-freakin'-Comic-Sans?

  62. We are NOT running out ... by Anonymous Coward · · Score: 0

    ... we just need to perhaps allocate them a bit more fairly.

    According to the 2007 report, http://www.ip2location.com/ip2location-internet-ip-address-2008-report.aspx/, 50.5% of the whole IPv4 space is taken by just two countries ... US and UK.

    IANA has reserved all these class A nets (reserved for WHAT exactly ... and at what point are they considering UNRESERVING them ?)

    1,2,5,7,23,27,31,36,37,39,42,77-79,92-123,173-187,197,223,240-255 ... in real terms that is 79 / 255 or 31% of the whole bloody IPv4 structure STILL not being used .. all "reserved" by IANA.

    Have a look at the 1-31 class A nets, and see exactly who stil has huge gobs of the internet for themselves.

    GEC, Army, IBM, DoD, AT&T Bell Labs, Xerox, HP, DEC, Apple, MIT, Ford Motor Company etc etc all feel the need to have IPs for 16,777,216 computers EACH !!!

    If you downclassed even the "private" corporations in that bunch to class B nets, and left the gov and mil alone, you'd still be able to free up about another 100 million IP addresses to the rest of the world.

    The sky is NOT falling, they just need to perhaps make better use of what they've got.

  63. If you really care... by Lonewolf666 · · Score: 1

    -make sure your software IS updated (I'm sure many people will be surprised when they find out their software is only IPv4 capable)
    -get an ISP that supports IPv6
    -actually use it once it is available to you, and report bugs to your ISP or software vendor.

    That's it for a non-network programmer, nobody can expect more from you. Unless you have lots of free time and WANT to do more, then you could learn network programming and support the migration of some open source project ;-)

    --
    C - the footgun of programming languages
  64. Already classes of users by CarpetShark · · Score: 1

    NAT is a really, really bad solution. It creates two classes of internet user: those that may run servers, and those that may not


    There are already many classes of users: those who own a /8, those who own less, those who have their own AS, those who can modify their reverse DNS entry...

    I agree that considering equality is very important in the net's future, but it's certainly not equal now, and the first step to fixing it would be recognising that.
  65. So what are we supposed to do if we do care? by argent · · Score: 1

    Until my upstream supports IPv6, the fact that all my computers support it is pretty much irrelevant.

    So yes, I care, but what can I *do*?

    1. Re:So what are we supposed to do if we do care? by Frank+T.+Lofaro+Jr. · · Score: 1

      Switch to an upstream provider that support IPv6.

      --
      Just because it CAN be done, doesn't mean it should!
    2. Re:So what are we supposed to do if we do care? by argent · · Score: 1

      Switch to an upstream provider that support IPv6.

      Name three broadband IPv6 providers.

    3. Re:So what are we supposed to do if we do care? by DigitalSorceress · · Score: 1

      I don't know where you live, but I've got exactly two choices where I live.... the local cable company, and the local phone company. Of the two, I would rather MOVE then pay the local idiot phone co for one of their craptastic DSL "never on" connections. So, if my cable co doesn't offer IPv6, I either stay with IPv4 or I move. What a lovely choice.

      --

      The Digital Sorceress
    4. Re:So what are we supposed to do if we do care? by am+2k · · Score: 1

      Name three broadband IPv6 providers.

      Sixxs provides a list of ISPs providing native IPv6.

    5. Re:So what are we supposed to do if we do care? by argent · · Score: 1

      OK, so in the US, and apart from Lavanet (a great company, I used them when I was visiting Hawaii, but they're not nationwide) that's:

      CITYNET - great company for metropolitan office buildings and office parks. Not a broadband company.

      Spectrum Networks - Whoops, Pacific Northwest only.
      Cutthroat Communications - Whoops, Montana only.

      I guess you *did* technically name three broadband IPv6 providers, one each for Hawaii, PNW, and Montana.

      So, here I am in Houston, and you want me to switch to IPv6 at home... what are my options? Get a PRI pulled to my demarc and peel off a fractional T1 for Citynet? That's hardly cost effective. I think I'll pass.

    6. Re:So what are we supposed to do if we do care? by jguthrie · · Score: 1

      On that list, there are four ISPs listed as serving customers in the US. Of those, it appears as if three of them provide consumer-grade access. Of those, none, that is not a single one, offers service in my area, which happens to be Houston, Texas, US. So, can you name one broadband IPv6 provider that is willing to sell me the services I'm willing to buy (I get business-class cablemodem service) in a place that I either live or work?

  66. IPv6 is more ready than you think... by thermowax · · Score: 1

    Hm. Most of the comments here seem to focus on IPv4 and natting and torrentabiliy, rather than v6.

    I've deployed IPv6 at my employer. There's plenty of v6 stuff out there, and most (all?) of the major carriers support it. Cisco's implementation is working fine for me. The Unices I've tried seem to work properly, although v6 support is definitely unpolished at this point.

    What doesn't work is Windows.

    Vista's support may be better, but we all know the issues with Vista. XP support is abysmal.

    I'd argue that the v6 infrastructure _is_ ready, despite some misgivings I have with it. What isn't is Microsoft.

  67. Problem seems simple by BigJClark · · Score: 1


    Necessity is the mother of invention. If/When the crunch does come, there will be a big push to merge to the IPv6 model, fix whatever is wrong with it (I'm not sure anything is, anyone?), segued with some fancy advertising for "new, improved" networks, some slick campaign ads, and next thing you know, we'll all be forced into buying $100 nics again.

    I can't wait.

    --

    Hi, I Boris. Hear fix bear, yes?
  68. What's wrong with this plan? by argent · · Score: 2, Insightful

    The logical way to go would have been to switch to IPv6 for everything in the core of the internet, working out to the edges, so that IPv4 was routed over an IPv6 network, without requiring anyone at the end points to change... IPv4 packets would be turned into IPv6 packets in the IPv4 subset of the IPv6 address space when they left the IPv4 endpoints, and then turned back to IPv4 if the destination didn't support IPv6. To access IPv6 resources you'd need a gateway that did both DNS and NATting, so your IPv4 lookup for an A record would be handled as a lookup for an AAAA record, and then a private IPv4 address would be assigned to that IPv6 address for you, and a fake A record comes back.

    For many purposes proxy gateways would work just fine, with increasingly many programs supporting HTTP proxies for connectivity.

    Why didn't this happen?

    1. Re:What's wrong with this plan? by rubycodez · · Score: 1

      some of the big carriers already have ipv6 at their "core", really it can just be their problem when the true crunch comes 3 to 4 years from now (if not later, even though it's fun here at slashdot to run around doing chicken little)

    2. Re:What's wrong with this plan? by Neil · · Score: 3, Informative

      IPv4 packets would be turned into IPv6 packets in the IPv4 subset of the IPv6 address space when they left the IPv4 endpoints, and then turned back to IPv4 if the destination didn't support IPv6.

      Unfortunately the IPv4 address space isn't embedded in the IPv6 address space in the way that you suggest. Dan Bernstein pointed out many years ago that this was a mistake.

    3. Re:What's wrong with this plan? by argent · · Score: 2, Insightful

      Unfortunately the IPv4 address space isn't embedded in the IPv6 address space in the way that you suggest.

      I thought there was a chunk of IPv6 address space allocated to IPv4 addresses.

      [...]

      Ok, so, according to DJB this address space (RFC 2893) could be used for this purpose, but the folks responsible for implementing IPv6 have said that this shouldn't be done.

      So I guess that gets back to my original question, why wasn't this done? There's technical support for it in the standard, they just say you're not supposed to do it? Why the hell not? What is the motivation for the bizarre behavior that DJB is complaining about in that article.

    4. Re:What's wrong with this plan? by TaliesinWI · · Score: 1

      Politics. Or religion, pick one. These guys assume that because in their little fiefdom, they were able to completely switch over to IPv6, that the rest of the world can too. They don't like anything that is a "kludge" that would keep the world operating in kind of a dual-state mode for some time. In their view, when it's time to switch to IPv6, it's time to switch, period. Anything else isn't "pure" enough. They assume that if they give people an "out" to avoid switching over to pure IPv6 that everyone will take it and just kind of sit there and the problem (resource exhaustion) will simply have moved to a different domain (there's still going to be the same amount of IPv4 addresses buried in the RFC2893 space) and won't be solved. This is wrong for two reasons. A) the resource exhaustion, as I mention in another post somewhere in this thread, has been "coming" for about a decade now, and we somehow always find a way to stave it off, be it switching web servers from single-IP-per-domain to host header-based hosting (what you all know as many web sites on one IP) or telling companies with 200 PCs "here's your /28, please NAT everything that doesn't need to be touched from the world" or some other vaguly kludgy but overall workable scheme. Yes, eventually this will run out, but it won't be in two years. B) if you DID use the 2893 extensions to "park" all of the IPv4 space in IPv6, you could pretty much, more or less, that day, stop handing out IPv4 space and make all new allocations move to IPv6, but it wouldn't be a problem because everyone would be able to "talk" to everyone else. If for legacy reasons you still need to give out a few more IPv4 blocks, (companies that have large allocations needing a little more space before they completely switch in a couple years, for example) you'd have the space to do that in, but once you have more than 50% of the net using IPv6 you've hit the tipping point and there's going to be less need for people to even have IPv4 legacy blocks. Eventually you just stop handing them out altogether, full stop. At all times during this sort of move, all clients could reach all servers and life would be grand.
      But that wouldn't be "pure".

    5. Re:What's wrong with this plan? by argent · · Score: 1

      B) if you DID use the 2893 extensions to "park" all of the IPv4 space in IPv6, you could pretty much, more or less, that day, stop handing out IPv4 space and make all new allocations move to IPv6, but it wouldn't be a problem because everyone would be able to "talk" to everyone else.

      Well, yes, obviously. That's what I assumed they would do, anyway.

      That is obvious, isn't it?

      No?

    6. Re:What's wrong with this plan? by TaliesinWI · · Score: 1

      Right, I was agreeing, but it was 2 AM and I wasn't being clear. :) My point was that the IPv6 camp seems to think we'd all do the intermediate step and then "just stop" and never really adopt IPv6 completely (i.e., the internet would be hybrid until the end of time.) Because I was wandering a little in my writing I ended up repeating you/myself. Sorry about that.

    7. Re:What's wrong with this plan? by argent · · Score: 1

      No fear, I didn't think you disagreed.

      What I want to know is why this wouldn't be obvious to the folks who came up with all this.

      That's what I mean, why wasn't it obvious to them? How could they expect adoption of IPv6 to "just stop" if interoperability was permitted?

      Is it not too late to adopt 2893 as a core part of IPv6?

    8. Re:What's wrong with this plan? by TaliesinWI · · Score: 1

      What I want to know is why this wouldn't be obvious to the folks who came up with all this.

      That's what I mean, why wasn't it obvious to them? How could they expect adoption of IPv6 to "just stop" if interoperability was permitted?


      I don't know, you'd have to ask them. :) But actually I'd like to hear _any_ sort of reason out of them why they don't support this idea. The "not pure" argument I put forth above is pure conjecture WRT the IPv6 working group but a philosophy I've encountered time and time again in my line of work. In many situations where a company/department is using solution A and IT/management wants them to move to solution B, oftentimes an easy migration path between A and B is convieniently left out or made difficult so that the end users don't take the easy way out and use just enough of B to feel like they "switched" but in reality are only 80% cut over before they move on to the next project. I don't support this at all, I'm just saying I've seen it coming from others, people who in general have a problem seeing the forest for the trees.

  69. comic sans by khuber · · Score: 1

    Comic sans is never the right choice for a typeface. That presentation hurts my eyes. -Kevin

  70. Oddly, Google will Fund Switch to IPV6 by RonBurk · · Score: 2, Interesting

    The untrue, but unchangeable, folklore of Google Adsensers (people who try to make a living via free search engine traffic to web pages that display Google ads) is that it's crucial for your Google rankings that your website be hosted on a server with a "static IP" (I don't know why people can't say "IP address" anymore in that community). These are the folks that will pay more, and more, and more for the privilege of having their own IP addresses as scarcity increases. Thus, Google money will ultimately and indirectly fund the switch to IPV6, as ISPs serving the hordes of must-have-my-own-static-address Adsensers will be able to afford conversion.

    The best thing that can be done to accelerate this process is to perpetuate the myth that it's crucial for your search engine rankings to host your website on a server with its own static IP address.

  71. No DNS Queries? by quibbs0 · · Score: 1

    No DNS queries from XP in a IPv6 only environment? Hmmm...that seems kind of important.

  72. I've already solved this problem at work by cwolfsheep · · Score: 2, Informative

    At work, we use IPv6 for our VPN, and IPv4 for Internet access. All the separate LANs are using private IPv4 addressing, using NAT with static IPs on the external interfaces; OpenWRT-based routers (take a $70 ASUS router and re-flash it with Linux); and tinc VPN software to link the routers together with a private (unique local address) IPv6 subnet. Furthermore, I run a SixXS tunnel at our main server farm that lets me provide IPv6 Internet access to all the sites via the VPN: hence I have both public and private IPv6 subnets running concurrently. If you want automatic routing, you can use Quagga to set interface addresses, do route advertising, and use OSPFv3 or RIPng to manage the subnets.

    http://www.openwrt.org/
    http://www.tinc-vpn.org/examples/ipv6-network
    http://www.wolfsheep.com/index.php/Bookmarks/IPv6
    http://en.wikipedia.org/wiki/Unique_local_address
    http://www.quagga.net/

    --

    Life is irony, and nothing ever goes as planned.
  73. Don't forget the magic mineral lead! by Anonymous Coward · · Score: 0

    Use lots of lead. Much good yang.

  74. Good target: the client side by Random+BedHead+Ed · · Score: 2, Insightful

    No one wants to run a publicly available site on an IPv6 address, as that would create problems, but the client side is easy to convert, as long is there is incentive. Few customers of major consumer ISPs need real IPv4 addresses, so most ISPs can run their networks on IPv6 and require their customers to have IPv6 enabled (XP, Vista, OS X and Linux can all do this). This would free a lot of IP addresses.

    Clearly the market is not embracing this solution, partly because they don't want to force their customers into a transition, but also partly because the market is based upon the cost of procurement, rather than on future availability. Procurement has been cheap up until now. It's the same reason that gas is only about $3.00 a gallon (yes, I said only), despite the anticipated future scarcity. So there are three options:

    • Regulate by incentive. Give tax breaks for ISPs that meet a goal (for example, roll out 100% IPv6 networks in urban areas).
    • Regulate by disincentive. Set a mid-2009 deadline for the above and penalties for failure to meet the goals.
    • Let the market decide. ISPs will willingly shift address space for IPv4 away from consumers who don't need IPv4 addresses, if there's a crisis. So we wait for a crisis to present itself, and IPv6 will start to appear. This is risky though, as TFA points out that (1) this will hit the developing world first, and (2) the crisis will seriously affect innovation in the short term, even if we solve it in the longer term.

    It would also be nice to see some financially independent and influential non-profit organizations make the switch, like major Ivy League universities. They're the ones who should really be leading this because they don't have the profit motive that makes businesses shy away from what appears to be a set of risky changes.

  75. Awesome Presentation by Anonymous Coward · · Score: 0

    Randy is my hero.. This is one of the best presentations I've ever seen on the topic.

  76. no one likes IPv6 because it sucks by lutz7755 · · Score: 1

    IPv6 is a good (or bad, depending on your perspective) example of engineering by committee. Anyone who wanted anything in the spec got it. No one was refused. And the committee was headed by a bunch of "intellectuals", without any regard for migration.

    IPv6 goes over the head of most people. Just the addressing sucks. You tell the average network guy that their address has to change from 10.2.4.5 to 2001:0de8:3d4a:0011:0000:0000:abcd:ef12, their eyes glaze over and say "umm.. no thanks, I'll stick with 10.2.4.5, since it works fine".

    If they would have just added an additional 4 octets to the IPv4 scheme, everyone would understand it, and it would have been adopted 10 years ago. Instead we're left with this shit.

  77. Then it breaks SSL. by SanityInAnarchy · · Score: 1

    SSL cannot be done with name-based virtual servers, or really, anything else that depends on the Host: header.

    The reason is, all headers are encrypted, including the Host header. In order for the encryption to be setup, you need to know which SSL certificate should be sent. In order to know that, you need to know which hostname the client expects -- which means you need the Host header.

    In short, separate SSL domains need separate IP addresses, or, at the very least, separate ports. I'm not sure how browsers would react to separate ports, but then the ISP needs to allocate one port on its NAT gateway for everyone behind it running SSL.

    --
    Don't thank God, thank a doctor!
    1. Re:Then it breaks SSL. by raynet · · Score: 1

      In the past, it was impossible to run name-based virtual servers with SSL in a shared IP, but now it can be done, example here: http://www.g-loaded.eu/2007/08/10/ssl-enabled-name-based-apache-virtual-hosts-with-mod_gnutls/

      --
      - Raynet --> .
    2. Re:Then it breaks SSL. by curious.corn · · Score: 1

      Production ready? Without browser client support? Maybe someday, not today...

      e

      --
      Mi domando chi à il mandante di tutte le cazzate che faccio - Altan
    3. Re:Then it breaks SSL. by Tacvek · · Score: 1

      Production ready? Without browser client support? Maybe someday, not today...

      e

      There is client browser support. All major browser except Safari support SNI according to that page. SNI is a TLS extention where the browser sends the intended hostname as part of the TLS setup process.
      --
      Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
    4. Re:Then it breaks SSL. by Anonymous Coward · · Score: 0

      for the encryption to be setup

      "set up". "Setup" is a noun.

  78. Re:Why should most people (including 'nerds') care by DogDude · · Score: 1

    So, what you're saying is that regular people will have to buy a new router. Excuse me if the prospect of spending $50 on a new router in a few years doesn't make me wet my pants.

    --
    I don't respond to AC's.
  79. Yes, FUD by Russ+Nelson · · Score: 2, Insightful

    There are plenty of IPv4 addresses to go around. It's just that they're literally priceless. With no price for an IP address or the routing that goes with it, there's no market. So surprise surprise, there's a shortage!

    Why don't people listen to us economists when we tell you how to solve your problems? There's plenty of evidence for what happens when you DON'T listen to us.

    --
    Don't piss off The Angry Economist
    1. Re:Yes, FUD by alexborges · · Score: 1

      For an economist, you sure dont get the internet at all.

      IP addresses are NUMBERS of a certain SIZE. It should cost us NOTHING, but some smarts in the initial design to make the SIZE bigger, and thus have lots and lots of adresses. Infinite addresses. As many addresses as there are atoms in the solar system, for example.

      Numbers, no matter how much of an economist you are, DO NOT COST A DAMNED THING! what costs are engineering and design mistakes that now have to be MENDED.

      You can start thinking as an economist now. The problem we have TODAY is that there is not economic INCENTIVE for the people holding some of the address numbers from the limited pool of available addresses.

      But EVEN IF THERE WAS ONE, even if they gave it all back and we all natted (which is a technique that allows us to "save" some of the addresses so that we dont have to give one for each and every computer), there would be not enough numbers for the whole world, which we inheritors of the original engineers of the net, creators of true freedom of information, think is the FUCKING GOAL of the net itself: communication, coordination and collaboration, for software running in a networked environment. (now, the original guys did this for war, mostly, but also to show some panache after occident got kicked in the butt by the sputnik launch)

      I now direct you to the foundational essays of JCR Licklider (he convinced the DOD that arpanet was a good idea), for all you should care, GOD of the internet, so that you can start to understand what kind of ideas gave us the thriving internet you see today.

      This will be an issue of freedom next because government regulators and media and ISP oligopolies, will have more economic incentive to keep the address space FINITE, so that they can skwat and charge for doing exactly NOTHING of value, but feed us whatever media they decide is good for us, to the addresses they think we deserve, in the manner they choose, at the (really high) price they arbitrarily set.

      The thing here, the SAD thing, is that it does NOT NEED to be this way. Numbers are numbers, my angry economist, they dont "run out" at all, not if the design and engineering is done right. IPv4, or so the storytelling goes, was implemented quite fastly by bill joy (some put the duration at about three long nights). Those were the pioneer days, everything went on really, really fast. They made one mistake among others: making the thing limited in its address space.

      We do NOT NEED to make this mistake again, we need to GET IT RIGHT this time, so that information can be free and everyone can communicate with each other, and we can get all the books online, and all the writers writing up here in our cyberspace, that is not, should not be held to the laws of the "real" universe. We need to cut communication of information costs to damn right near zero. That is what the internet is ALL ABOUT and if youre an economist that doesnt get this simple and beautyfull fact, then youre the ugly kind of economist.

      I know i seem slightly nutty, but read Licklider: its the way good engineers should be.

      --
      NO SIG
    2. Re:Yes, FUD by sjames · · Score: 1

      First, they're not priceless, a /24 allocation costs $2500/year. Believe me, you're paying for your IPs one way or another.

      The other price is in the required justification. Ages ago, getting a /24 went like "ARIN, I need a /24 so I can" "HERE YA GO!". Now it's approaching "OK, we need to know exactly how many servers you will deploy in the next 6 months, why, and for whom and the results of your last 3 colonoscopies".

      Economists will also tell you that given a choice between scarcity and abundance, go with abundance every time. That's what IPv6 gives us.

  80. Forgive me if I don't seem alarmed by merreborn · · Score: 4, Informative

    The IPv4 crunch has been 2 years away for at least 10 years.

    By the way, the idea of reallocating parts of Class-A blocks has been technically feasible for over a decade. Say hi to CIDR

    1. Re:Forgive me if I don't seem alarmed by TaliesinWI · · Score: 1

      The IPv4 crunch has been 2 years away for at least 10 years.

      What he said. I've been in the ISP biz since 1995, and I've been hearing "the sky is falling on IPv4" since about 1998. I _know_ how hard it is to get newly minted IP space from ARIN or an appropriate body. They had to get tough on it when CIDR took off not just to curb IP usage, but to curb the routing table size. (It was growing like crazy for a while because everyone and his brother was allocating a /24 out of what used to be a /8 or a /16, and routers were starting to fall over.) The nice side effect of this is you can't have Joe SOHO apply to ARIN for a block of IPs - you have to be able to PROVE you can use a /20 right out of the gate (as in, you're already using the equivalent of a /20 from your upstream provider - that's _16_ class C's, boys and girls). Otherwise, you're getting your new IP space from your upstream until you reach that size. I don't have the link handy but there are still something like 65 million IP addresses available _before_ you start making places like M.I.T. or Ford give back some of their old pre-ARIN /8s. Now yes, it's true that eventually this space will run out, because it is a finite resource. But they've been getting it wrong on predicting this resource exhaustion for pretty much the Internet's entire adult life (if you figure it hit adulthood when non-academic interests were allowed access around about 1994.) And this takes into account the .com bubble, where pets were getting their own IP spaces. The instant I realized that IPv6 was a _replacement_ for IPv4 rather than an augmentation to it, I knew it was going to be a brutal, nasty switch. Hopefully we can keep the alarmists in check and work out a way to move onto the next big thing before resources become scarce - but that probably means taking IPv6 out behind the barn and putting a bullet in its brain and working out something that extends IPv4 so that the instant a new customer gets on this new network they can access everything that we know as "the internet" without having to worry about 6to4 tunnels or any of this other crap. The guys who developed IPv6 seem to think that since it was easy to change their ten PCs in the lab to the new addressing scheme that it's going to be that easy for everyone. Right now, we seem to be in a big game of chicken. No one's going to move until everyone moves, and that's a self-fulfilling doomed prophecy.

  81. Disassocited pain and reward by Anonymous Coward · · Score: 0

    The basic problem is that the cost of migration to IPv6 falls primarily on those who already have working IPv4 networks, but all the benefits go to those who have not yet implemented their networks.

    My company has a very nice class B network. Do I care if all of China has to live in one or two class A slots - not even a little bit.

    If the rest of the world is forced to go to IPv6 to continue building out the the internet do I care - not even a little bit - My ISP will just have to provide a bridge between the two address spaces to keep my business.

    Will I ever convert to an IPv6 network? Yeah sure, right about the same time I teach my sales force to speak Esperanto and convert all my trucks to have speedometers enumerated in the metric system.

    Fortunately in the real world it is economics and not propeller-head geek measures of technical merit that govern decisions.

    Which is why for most of the existing economic base IPv6 is an irrelevant non-issue. EVEN AFTER the IPv4 address space runs out - we just don't care, and don't need to care.

  82. IPv6 = IA64 by Anonymous Coward · · Score: 0

    IPv6 is like IA64, what we need is an AMD64 equivilent!

  83. A sage of the environmental movement once said: by Deagol · · Score: 1
    "People do not begin conserving until the last roll of toilet paper."

    This can be seen with nearly any resource which approaches depletion. IPv4 addresses will, inevitably, be no exception.

  84. How to make IPv6 popular fast by Skapare · · Score: 1

    Make all file trading done over IPv6 legal under a 4 year copyright moratorium.

    --
    now we need to go OSS in diesel cars
  85. 6 to 4 by PeterJFraser · · Score: 2, Interesting

    I do not know why since every IP4 address has exactly 1 IP6 address, the backbones could be made to run IP6, and at the edges, there would be a transparent 6 to 4 and 4 to 6 for those set of addresses. Big companies who converted to IP6 would directly continue to use their IP4 address in its IP6 format so IP4 users could communicate with them. Associated with each IP4 address is 2^16 IP6 sub addresses with the sub address 0 being the natural mapping for IP6 to IP4. If users were initially restricted only to the IP4 sub set of IP6, it still allocates each IP4 address 2^16 new IP6 address, so there would be no shortage for users with at least 1 IP address. An IP6 user (using this subset) setting up an connection would attempt to use IP6, but if the connection failed then the router would NAT the none zero sub address to IP4 subset address and try again.

  86. The simplest solution - SUPPLY AND DEMAND! by hackingbear · · Score: 1

    The technology is here the problem is the adoption. and that can only be solved by economic means. If IPv4 addresses are running out, like petroleum, then you can expect the price of fixed IPv4 address to go up, one hand lowering the demand (like relinquish existing addresses that you don't really need) and on the other forcing more and more people to adopt IPv6. Problem solved!

  87. Need good IPV6 references by Eponymous+Coward · · Score: 1

    I'm working on adding IPv6 support to a server package written in java. Part of what it does is use a subnet mask to discriminate LAN and WAN clients. Can I still do this if everything is IPv6? Would I just have a different subnet mask?

    Are there still LAN ranges like 192.168 or 10. in IPv6? Do I still have a DHCP server on my LAN? Admittedly, I haven't spent a whole bunch of time researching this yet, but it seems like there aren't 1:1 relationships between IPv4 and IPv6 concepts.

    -ec

    1. Re:Need good IPV6 references by Koutarou · · Score: 0

      I'm working on adding IPv6 support to a server package written in java. Part of what it does is use a subnet mask to discriminate LAN and WAN clients. Can I still do this if everything is IPv6? Would I just have a different subnet mask?

      Are there still LAN ranges like 192.168 or 10. in IPv6? There are link-local and site-local address ranges

      Do I still have a DHCP server on my LAN? v6 has an autoconfigure mechanism that assigns addressing within a subnet based on an encoding of the mac address of the device (in a predictable manner to boot)
    2. Re:Need good IPV6 references by amorsen · · Score: 1

      I'm working on adding IPv6 support to a server package written in java. Part of what it does is use a subnet mask to discriminate LAN and WAN clients. If you are doing this by making RFC-1918-space (192.168.0.0/16 and the others) imply LAN, and everything else WAN, it's broken already. There are still organisations with public addresses on the LAN's.
      --
      Finally! A year of moderation! Ready for 2019?
  88. IPv4 has a solution, so why do we need IPv6? by hasdikarlsam · · Score: 1

    I read a blog article a while back that explains one possible solution quite well - one that strikes me as far more elegant than the monster that is IPv6. Yes, I know there are security issues with LSRR, but they certainly aren't insurmountable. Why is nobody looking at this?

    Article, verbatim

    The Soapbox
    New ideas in computers, networking, and technology in general
    " Lightweight Multicast (LWM)
    Will Multicast kill Packet Switching? "
    NAT and the Failure of Source Routing

    Paul Francis, in the conclusion of his 1994 Ph.D. thesis, traces the evolution of the IPv4 address scheme. After quoting a June 1978 Clark/Cohen paper (IEN 46), Francis notes:

    Well, something happened here. An argument was put forth that 32 bits is enough because the address does not have to do routing - the source route can handle the rest. Clearly it was recognized that a variable length something was needed, but the source route was deemed sufficient for that, and the 32-bit address won out in the end. So, perhaps what killed IP is not that the address is too short (though probably it is), but that the ability for DNS to hand a host a source route (which it could then put in the header so that the right thing could happen in the network) was not created.

    (p. 177)

    Not only did the failure to fully implement source routing (in DNS) make it impossible to address into a private network, it also created the situation where NAT had to be implemented as it was.

    Consider the following network:

    **** Deleted by lameness filter. Click article link above. ****

    H1 is on a private network. H2 is a server of some kind on the public network. The two networks are interconnected by a router with address X on the private network and address Y on the public net.

    Can H1 initiate a working TCP session to H2 without NAT tables on the router? The answer is yes! H1 addresses its packet as follows. Address X is the IP Destination Address. A Loose Source and Record Route (LSRR) option is also used with a single address - H2's. What happens?

    Well, the packet routes first to X on the private network, then the LSRR is processed. RFC 791:

    If the address in destination address field has been reached and the pointer is not greater than the length, the next address in the source route replaces the address in the destination address field, and the recorded route address replaces the source address just used, and pointer is increased by four.

    The recorded route address is the internet module's own internet address as known in the environment into which this datagram is being forwarded.

    So H2's address is moved into the destination address field. Yet note carefully what else happens. The "recorded route address replaces the source address", and the "recorded route address is the... internet address as known in the environment into which this datagram is being forwarded". So address Y is placed into the LSRR option!

    So H2 receives a packet addressed to it (of course), with H1's private IP address as the source address and an LSRR option listing the address Y. This is enough information to construct a return packet addressed to Y with H1 listed in an LSRR option. Now, can H1 count on H2 to do this? According to RFC 1122 (section 4.2.3.8) it can:

    When a TCP connection is OPENed passively and a packet arrives with a completed IP Source Route option (containing a return route), TCP MUST save the return route and use it for all segments sent on this connection.

    So far, it certainly seems like we don't need NAT! What's the problem, then? Well, consider what H1's routing table has to look like:

    Destination

  89. DNF/Hurd supports it by Gothmolly · · Score: 1

    Good thing my DukeNukemForever/Hurd 1.0 kernel supports v6! I might need it someday!

    --
    I want to delete my account but Slashdot doesn't allow it.
  90. Myth in the article about test equipment wrong by AaronW · · Score: 2, Informative

    The article claims that there is no good IPv6 test equipment. I know this to be false. The old test equipment we have in our lab at work (Adtech) handles IPv6 performance testing just fine, just as well as IPv4. Granted, we only have OC-48 adapters, but higher speeds are available. This will test for speed, dropped packets, out of order, etc. I would be very surprised if any modern test equipment did not natively support IPv6 since supporting IPv6 is basically required for any decent router, especially if you plan to sell to the enterprise or government market.

    The biggest problem I see at this point in terms of equipment is that few home firewall routers support IPv6, plus it sounds like Windows XP is missing some needed functionality if it doesn't properly handle IPv6 DNS or AD. I have a small Linux network at home running dual IPv4/IPv6 and have had no issues with IPv6.

    Most of the Internet backbones no longer do IP routing, instead using MPLS for making forwarding decisions. MPLS doesn't really care what protocol runs on top of it, only the routing protocols do (i.e. BGP) which do support IPv6.

    --
    This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
  91. Pink & Purple & Comic Sans MS, Oh my! by milsoRgen · · Score: 1

    read that pdf if you don't believe me I am reading it... but what's with the choice of colors? And Comic Sans MS font? And the references to politics? For some reason I just can't take that pdf seriously. It's lack of professionalism is stunning. As is it's unwarranted self assurance.

    And on another note, why are you knocking XP? It does offer IPv6 support, in fact I'm looking at in my network properties right now...
    --
    I'm sick of following my dreams. I'm just going to ask where they're goin' and hook up with 'em later.
    1. Re:Pink & Purple & Comic Sans MS, Oh my! by Brian+Gordon · · Score: 1

      The DNS client service doesn't accept replies of IPv6 addresses. If you paid someone to mail you a dvd with a giant HOSTS file on it, that might work?

    2. Re:Pink & Purple & Comic Sans MS, Oh my! by Anonymous Coward · · Score: 0

      It's lack of professionalism

      "Its".

      is stunning. As is

      "stunning, as".

      As is it's unwarranted

      "its".

      offer IPv6 support, in fact I'm looking

      "support; in fact, I'm".

  92. Comic Sans by Anonymous Coward · · Score: 0

    Is that PDF written in Comic Sans ?
    Just say no ! http://bancomicsans.com/

  93. Exactly when it happens by Anonymous Coward · · Score: 0

    Who wants to bet the IPs run out on December 21st, 2012?

  94. It's the DoD's fault, they should fix it by Anonymous Coward · · Score: 0

    The US DoD has lots and lots of addresses. They should move to IPv6 first and free up all those IPv4 networks. They have a lot of internal networks that don't need to be routed on v4 backbones, and what does would be a lot easier than a bunch of random domains mixing it up. The side benefit would be that the v4/v6 incompatibilities would give them an extra measure of security, which they could really use.

    Later . . . Jim

  95. Steering an UDP packet is delicate business... by Anonymous Coward · · Score: 0

    ...but sometimes you just have to punch your way through.

  96. Double byte AS numbers are running out too by MavEtJu · · Score: 1

    Not only the IPv4 IP space is running on empty, at the last AusNOG conference (a must for everybody who is into internetworking in Australia) a talk was given about the similarities and differences in the allocation of AS numbers.

    Where the IP space allocation graph shows an exponential line since 1990something, the AS number allocation graph shows a linear line.

    The interesting thing is that somewhere in 2010/2011, when the IPv4 IP space is running out, also the double byte AS number allocation is running out. At around the same time!

    So while the big world has to deal with the IPv6 (which by now should be common knowledge and practise), the ISP world has to deal with the four byte AS numbers.

    That last part isn't 100% true: If you have a double byte AS number and your BGP speaker doesn't understand four byte ASN numbers, you will see some strange things in your BGP table but everything will keep working. On the other hand, if you have been handed out a four byte AS number, you'd better make sure you got a speaker which supports four byte AS numbers :-)

    --
    bash$ :(){ :|:&};:
  97. If the client is talking v6, so is the server by Marrow · · Score: 1

    The server needs to send packets to the client..so has to know
    and route the ipv6 return addresses.

    The servers have to go first in my opinion. Anyone who wants to run
    an internet -addressable- business will need to run dual stacks for
    a while.

    Once the -servers- are addressable via ipv6, then the clients will have
    somewhere to "go", and they can be migrated.

    Personally, the ipv6 thing seems like a fiasco, and they should have found
    a way to extend ipv4. There is a lot of available space in an ipv4 header.
    More than enough to solve the addressing problems.

  98. Not serious by kir · · Score: 1

    I will not take seriously a presentation that uses Comic Sans as its primary font.

    --
    3cx.org - A truly bad website.
  99. It could be made easy. by brainbuz · · Score: 1

    First, I only know a little bit about IPV6, but the important thing is that at an IPV6 address 32 bytes instead of 8, and I can conceptually view it as a string of 4 IPV4 addresses.

    As far as I know the designers of IPV6 didn't have the forethought to make IPV6 readily encapsulateable over IPV4. There are proprietary methods. But what we need is a universal method that requires minimal change and doesn't require touching the IPV4 standard at all.

    IPV6 moves away from the notion of private address blocks to something called link local, but the idea I'm expressing could co-exist with or become a revision of it. So here is my idea and apologies if I'm reinventing a wheel.

    The IP address of slashdot is 66.35.250.150. Conceptualize assigning anything beginning with a bunch of zeros 0:0:0:xx.xx.xx.xx as a private network (using colons to represent a string of 4 .0 octets). Now conceptualize 0:0:66.35.250.150:0.0.0.1. During the transition the third octet preceded by zeros is reserved for the special network of legacy IPV4 addresses. 0:0:66.35.250.150:0.0.0.0 is the IPV6 version of slashdot's address. Note that the last 4 octets are normally a network address. Imagine that later in the transition you're not so worried about IPV4 hosts, but intermediate ISPs that haven't upgraded those four zeros can be replaced by numbers effectively allowing one IPV4 address to NAT billions of hosts.

    IPV6R2 obviously would need to be standardized and the router companies have time to get updates out, but once it starts to roll it can coexist in a fashion where if I'm IP6 and you're IP6 its no longer a problem that the route between us is still IP4.

    --
    minds, get scrambled like eggs, abused and erased. Hard Hearted Alice is who you want to see.
  100. I've been ready for years by Brandybuck · · Score: 1

    I've been ready for years. So has my ISP. All they need to do is flip a switch. But until everyone else switches to IPv6, it's less hassle to stick with IPv4. It's sort of like HDTV. It won't take off until a sufficient number of people are capable of it.

    p.s. And heaven forbid Congress go mandating IPv6 like they did with HDTV. Those guys can barely find their asses to wipe them, let alone make technical networking decisions for anyone else. The market will work this one out. The technology is ready and waiting, it just needs the demand to flip it on.

    --
    Don't blame me, I didn't vote for either of them!
  101. IPv6 is faggotry at its finest by Anonymous Coward · · Score: 0

    Some of us have to work with IP addresses, unlike the bureaucrats at IANA. I don't want to deal with g46:ge35hyf:35gw:g34th46j76:h34fewd23:f3g35hg45yh:54g34g34g.

    There is nothing wrong with IPv4, it just needs proper management. Force the Class A hogs to release their subnets (only a few are being used), and kick the myspace/facebook/web2.0 shits off the Internet. NAT them if they really need Internet access (they don't), the only servers they're running are those of their botnet which they joined when they opened LOL FUNNY EMALE.

  102. IPv6 should have had this by Krellan · · Score: 1

    IPv6 should have had this:

    1) Easy drop-in of existing TCP, UDP, ICMP, etc. protocols. Just widen the IP address field and leave it at that. Don't try to reinvent 25 years of protocol engineering overnight. There should have been "IPv5", which would have just widened the various IP address fields in all the protocols from 4 to 16 bits, and left it at that. Existing semantics, roles, security models, etc. would be left unchanged.

    Even better, this would enable trivial IPv4-to-IPv5 mapping: simply zero-extend all IPv4 address fields and you have a perfect IPv5 packet. It would be an easy 1-to-1 mapping that could be cheaply implemented in hardware. The migration to IPv5 from IPv4 could be nearly seamless. After that, new IPv6 features could be adopted whenever there is demand, so IPv5 would eventually become IPv6.

    2) To encourage use, give every existing public IPv4 address its own /64 space of IPv6 address space behind it. For example, the public IPv4 address 129.65.2.119 would get the public IPv6 address block 0.0.0.0.129.65.2.119/64 for "free". Which brings me to my next point.

    3) IPv6 should have kept existing syntax. Applications and protocols break, with IPv6's goofy colon-based syntax. The colon has many other longstanding meanings in software, such as port number. An easy and obvious migration path would be to keep the numbers-and-dots notation. Just add more "octets".

    SMTP already uses this notation, so it will not be unfamiliar to existing IPv4 sysadmins.

    4) Integrate IPv6 addressing with NAT forwarding. Each layer of NAT would correspond to simply filling in 32 more bits of IPv6's 128-bit address. The IPv6 address would simply become a "NAT path", describing how to reach machines behind multiple layers of NAT, just like directories in a filesystem. The /64 subnet of IPv6 would give enough room for 2 layers of IPv4 NAT, at 32 bits each.

    Let's say the public IPv4 address 129.65.2.119 is a NAT router, and it has the IPv6 address of 0.0.0.0.129.65.2.119.0.0.0.0.0.0.0.0. Behind the NAT is an interior router at the private address of 192.168.1.100. Filling in 32 more bits gives us the IPv6 address of 0.0.0.0.129.65.2.119.192.168.1.100.0.0.0.0. Let's say that router at 192.168.1.100 is also a NAT. Behind that NAT is a computer with the address 169.254.1.1. Now, we have an IPv6 address of 0.0.0.0.129.65.2.119.192.168.1.100.169.254.1.1. This computer, even though it's behind 2 layers of NAT, can still address any other computer in the world that is also behind 2 layers of NAT. With some creative bit-shifting and address rewriting, an IPv6-aware IPv4 NAT could scale this up to even more layers.

    5) Finally, for hardware that just can't be upgraded to process IPv6 packets, have a standard way to encapsulate an IPv6 packet in the payload portion of an IPv4 UDP packet. Perhaps reserve a "special" IPv4 address, such as 255.255.255.254, and use it for the destination, when embedding an IPv6 packet inside of an IPv4 UDP packet in this way.

    This gives an upstream router the opportunity to intercept the packet and apply further processing, similar to what is now done for IPv4 SSM multicast. The upstream router could notice the packet being sent to that special nonexistent address, and strip out the IPv6 packet from the payload, and send the IPv6 packet on its way. The process would also work in reverse, so that replies could be received.

    I would appreciate responses on why these ideas wouldn't work. Or, would they indeed work?

    1. Re:IPv6 should have had this by brainbuz · · Score: 1

      I posted a similar idea at http://it.slashdot.org/comments.pl?sid=463044&cid=22523006.

      The critical concept in both these ideas is to create an automatic encapsulation for IPv6 over IPv4, so that if I'm on 6 and trying to reach someone else on also on a 6 network, but our ISPs aren't all up to speed on IPv6, the routers can automatically encapsulate the IPv6 traffic over IPv4 routes and then once the IPv4 segments are traversed finish the journey as an IPv6 packet. As more of the internet is on IPv6 people will stop caring as much about the v4 only parts of the internet and will start accepting cheaper v6 IP addresses.

      I also agree that with those who say the crisis isn't quite as looming because there are still huge untapped reserves of Class A networks, that once those addresses become valuable will get sold, and more rationing of ip addresses. I would sooner see a move to a permanent solution rather than this continual stretching of the lifespan of IPv4, to make this a reality we need a better transition strategy. I would be very happy to replace my cheap home routers in a year or two because IPv6 was beginning to matter. For that matter I've been turning the IPv6 off on all of my computers, because right now it truly doesn't matter.

      --
      minds, get scrambled like eggs, abused and erased. Hard Hearted Alice is who you want to see.
  103. Pr0n by Fuzzums · · Score: 1

    You have to create a demand for ipV6.

    If we pass a law that forbids porn on IPv4, we'll see a rapid increase in the use of to IPv6.

    --
    Privacy is terrorism.
  104. DISA by Lanboy · · Score: 1

    I recommend not trying to take away DISA's allocation. If you like breathing.

  105. Take the middle ground by Anonymous Coward · · Score: 0

    Why can't we just compromise and all use IPv5?

  106. Would you please read the PDF file? by Lanboy · · Score: 1

    As randy bush says, IPv6 implementation will INCREASE NAT usage for the next 10 years.

    1. Re:Would you please read the PDF file? by gnuman99 · · Score: 1

      He is wrong or maybe inarticulate in the presentation. The usage of NAT will increase *only for the IPv4*. That will happen regardless of IPv6!

      He says IPv4 NAT will be used to route IPv4 traffic to IPv6 only sites. So? How is that different from having a few IPv4s and having to route traffic to your private space servers??

      IPv6 fixes the problems. No more *necessity* for stupid NAT for IPv6-IPv6 connections. Just because Ipv4 run out of space and needs more NATing, too bad. Has nothing to do with IPv6.

      Anyway, most problems he lists are not really problems. Stale code is not really a problem - did we stop the calendar because of year 2000? IPv6 transition may be the next "dot-com bubble" - more free money! Regardless, it will happen and is happening now.

  107. Why don't YOU read the PDF. by Lanboy · · Score: 1

    Windows, including XP, does not have DNSv6 support.

  108. Cisco's NAT code in 1998? by Lanboy · · Score: 1

    Really? Thats what you are going with? That is what? IOS code 11.X ?

    Cisco IOS NAT has lagged behind the crappy residential home routers. They just did not drop the address port states fast enough.

    Besides the which, they were only mapping the external connection to source ( the external gateway ) destination port. which gave them 40,000 or so connections total. When they finally started mapping it to the whole flow, including destination address, this issue went away.

    NAT is not a solution from the internet core perspective however.

  109. Please, read the PDF. by Lanboy · · Score: 1

    IPv6 only sites can not connect to ipV4 only sites. So The fact that China's universities have gone ipV6 just means that they are okay not talking to the world. Or they are NATing.

    1. Re:Please, read the PDF. by sjames · · Score: 2, Informative

      Actually, some of the servers ARE v6 only, and indeed, IPv4 cliants out there cannot reach them at all. No NAT is happening for those servers.

      The client machines, OTOH are either running dual stacks or they are NATing v6 prefixes into v4 addresses at the edges of their v6 network.

  110. Read the PDF please. by Lanboy · · Score: 1

    Its written by Randy Bush. He knows something about internet routing. Then check and see if your core routers are actually doing IPv6 in ASICs. Don't ask the marketing rep or the account executive, ask someone who knows and can speak honestly.

  111. It was good for you. by Lanboy · · Score: 1

    Now take a second to think about this....

    Windows active directory, when you take the time to watch the protocol usage, depends on name resolution for just about everything. I would have to say that 30-60% of the lookups still use WINS - netbios over tcp - name service. Plug that into IPv6 why don't you.

    About half of my time is spent convincing Microsoft Experts that it isn't the god damn network. I am eager to project these mistakes into an IPv6 future.

    1. Re:It was good for you. by BeanThere · · Score: 1

      So just reconfigure the name lookups to use DNS and/or use LLMNR, it hardly sounds like the end of the world to me, although I admit I'm no expert on this.

    2. Re:It was good for you. by Lanboy · · Score: 1

      The problem is that "Microsoft Experts" think that it currently only uses DNS, and when confronted with packet data, they get on the phone to microsoft untill the problem goes away. Combining this with the fact that Microsoft, as yet, has no operating system that can do DNSv6 makes me wait for a large heavy shoe to drop.

      Which would all just amuse me, but as usual, microsoft blames the network, management believes the people most like them ( project managers with only microsoft experience ) and the shit falls on the network engineers to fix active directory.

  112. single server _can_ host many sites by reiisi · · Score: 1

    but the question is whether that's what's really happening.

    I mean, yeah, they want to build those as cheap as possible to get profit up, but has anyone done a survey of the actually density of domains per IP address? Or of how many different addresses are being used by those parking sites?

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
  113. I wonder ... by reiisi · · Score: 1

    There are a lot of things we do on the net that don't _look_ like we are running servers.

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
  114. Sure there are enough ports by reiisi · · Score: 1

    ... that is, enough ports if they really wanted to.

    Somehow, I think the tools to handle the allocation of ports per bridge would be more expensive to develop and put in place than simply biting the bullet and rolling out IPV6, however.

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
    1. Re:Sure there are enough ports by Brian+Gordon · · Score: 1

      There are only 65535 TCP/UDP ports.. not nearly enough for Comcast, for example.

    2. Re:Sure there are enough ports by reiisi · · Score: 1

      Well, yeah, not nearly enough if everyone were on the same private, of course.

      We do assume that comcast doesn't just give up all its current set of IPs and try to put their entire customer base NATted under a single real address. They start NATting by block router or something.

      But, then again, we also don't assume this is a smart thing to do.

      Now, if I could have suggested a plan for beyond IPv4, I'd have suggested an extensible addressing scheme, some way of either just adding up to 12 extra octets to IPv4, or of concatenating up to three additional IPv4 addresses. Call it IPv4' or something, and if the extension scheme were carefully worked out, heel-draggers would simply be left unable to access parts of the net until they themselves upgraded.

      I'm sure there's some technical reason it couldn't have worked.

      I'm also sure a lot of people don't understand the difference between a truly extensible scheme, such as I might have suggested, and NAT. Maybe some don't understand the difference between ports and IP addresses, for instance.

      --
      Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
    3. Re:Sure there are enough ports by Brian+Gordon · · Score: 1

      The guys who badly designed IPv6 could have used variable-length addressing, which would have allowed IPv4 addresses to continue to work fine and I think make v6 on-the-wire compatible with v4. I don't know why they didn't.

  115. So, I have a solution. Update IPv4! by reiisi · · Score: 1

    Let's change the IPv4 addresses to look like this:

    123.32.1.23:0.0.0.0 is a host.
    123.23.1.23:255.255.255.255 is a router.
    123.23.1.23:1-254.1-254.1-254.1-254:0.0.0.0 is a host.

    Cool idea, huh? ;-¥

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
  116. Japanese IPv6 by reiisi · · Score: 1

    My Japanese ISP does not offer IPv6 last I asked. Nothing on their site mentions it at this time, near as I can tell.

    (I could e-mail them again and ask if things have changed over the last four years since I last asked, though.)

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
  117. M$olutions by reiisi · · Score: 1

    at it again

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
  118. Problem Solved by na1led · · Score: 1

    The solution is simple. DYN-DNS. Half the people that have static IP's don't need them. Everyone gets them from their ISP for things like, home servers, security camera systems, office computers, etc. The price of static IP's will go up and the alternative will be to use DYN-DNS services to access your networks. WEB Hosting prices will also go up, no more lame websites lingering around. The Internet is filled with waste and garbage, time to clean it up.

    --
    -- By all means let's be open-minded, but not so open-minded that our brains drop out.
  119. Slashdot on IPv6 by pawal · · Score: 1

    So when can I reach Slashdot over IPv6?

  120. Right on. by Anonymous Coward · · Score: 0

    This thread is a little old but I just wanted to confirm this.

    My company has student housing. We have 76 students in one residence, with about 50 computers between them. They all use the internet like students do: WoW, p2p, skype, and of course web browsing. One kid was even serving a web page for a while. They are all hooked in to one generic 4-port router (it was kind of expensive at 80) that is hooked to four generic 24 port switches. It is a standard ADSL line at 1024mbps.

    We have not had a single complaint.

  121. Re:Why should most people (including 'nerds') care by wertigon · · Score: 1

    No, what he's saying is that your nice, $20/month broadband connection will suddenly increase to $50 a month.

    --
    systemd is not an init system. It's a GNU replacement.
  122. Why does every computer need a IP4 address? by Chili-71 · · Score: 1

    Some corporate business still think they need a class C (or worse, class B) address space for their systems. Firewalls and NAT routing these days eliminates the need for some greedy corporate tycoon to grab all those IP_ADDRs. If corporations (and individuals to a less extent) were more conservative, it would be a very long time before we ran out of IP4 space.

  123. Re:Why should most people (including 'nerds') care by Anonymous Coward · · Score: 0

    This is such an old discussion that nobody will read this anyway, but here goes ...

    When the crunch hits, IPv4 addresses will be accounted differently, no longer will they be seen as a free resource that earns $10/month, they'll be seen as a cost center that needs to have a margin associated with it. So if the company has to start paying even $1/month per address, they'll pass that cost on to the end users as a higher monthly fee.

    You are correct in what it you say, but you are totally wrong as far as the "big picture" of charging for addresses is concerned.

    If everyone has to pay $1/mo (i.e. $3+ billion/mo) for an IPv4 address, 99% of them would be returned. Even if everyone had to pay $1/yr for an IP address, there wouldn't be an IPv4 shortage for 10 or 20 years.

    And I do mean everyone. You think that MIT or IBM would pay $16 million per month for their "legacy" IP assignment? I don't think so!

    Just don't give this money to ICANN, IANA, the RIRs, or anyone like that. That would corrupt those organizations even more than they are corrupted now.

  124. Good solution by shentino · · Score: 1

    ICANN and the internet registries should start charging maintenance fees.

    For a small charge of, say, 1 dollar a year per IP address, you get the privilege of having a routeable IP address, officially recognized by the IANA and all the global internet registries.

    You quit paying your maintenance fee, boom, you lose your address, and it goes to someone else.

    This token amount would, as a result of being very small for a single IP address, but large for address space hogs, encourage economy and get them to give up the masses of IPs that they're squatting on.

    Also, we need to move away from this "ownership" paradigm. Routing protocols like BGP greatly benefit from aggregation, which, in turn, can be facilitated by heirarchial numbering schemes. Ownership and squatting kill those.

    1. Re:Good solution by shentino · · Score: 1

      Or it could even be 10 cents a month.

      The point is to make it a burden to hang onto IPs and not do anything with them.